IndicatorPublished 29 Oct 2025Updated 30 Oct 2025

ThreatFox IOCs for 2025-10-29

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 293

azure.m365.1drive.zipUnknown malware botnet C2 domain (confidence level: 100%)
www.accounts.m365.1drive.zipUnknown malware botnet C2 domain (confidence level: 100%)
onyx.do-k-3.ruClearFake payload delivery domain (confidence level: 100%)
hot.x2lu.ruClearFake payload delivery domain (confidence level: 100%)
rum.da5v.ruClearFake payload delivery domain (confidence level: 100%)
m4qy.7l-0b.ruClearFake payload delivery domain (confidence level: 100%)
fin.je9r.ruClearFake payload delivery domain (confidence level: 100%)
v9tc.7l-0b.ruClearFake payload delivery domain (confidence level: 100%)
sage.do-k-3.ruClearFake payload delivery domain (confidence level: 100%)
pit.n4ym.ruClearFake payload delivery domain (confidence level: 100%)

URLs 27

http://23.94.145.109/mbjdf8dsh/index.phpAmadey botnet C2 (confidence level: 100%)
http://23.94.145.109/mbjdf8dsh/login.phpAmadey botnet C2 (confidence level: 100%)
http://165.154.244.221:8099/wc7lCobalt Strike botnet C2 (confidence level: 75%)
https://pdo.tweethost.com/Vidar botnet C2 (confidence level: 100%)
https://pdo.united-gs.net/Vidar botnet C2 (confidence level: 100%)
https://secureapimiddleware.com/s/x.jsClearFake payload delivery URL (confidence level: 100%)
https://upaste.me/r/d5ba60033ceb6c832:123XWorm botnet C2 (confidence level: 100%)
http://95.217.139.186Stealc botnet C2 (confidence level: 100%)
https://asturiasactiva.es/pfol.wavNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://varorg.com/5f3e.jsKongTuke payload delivery URL (confidence level: 100%)

IP addresses 170

104.21.37.230Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
108.181.115.243Havoc botnet C2 server (confidence level: 100%)
198.252.109.34Havoc botnet C2 server (confidence level: 100%)
59.110.29.198Unknown malware botnet C2 server (confidence level: 100%)
101.42.187.238Unknown malware botnet C2 server (confidence level: 100%)
167.172.182.247Unknown malware botnet C2 server (confidence level: 100%)
51.77.220.174Unknown malware botnet C2 server (confidence level: 100%)
5.188.29.124Unknown malware botnet C2 server (confidence level: 100%)
137.184.118.154Unknown malware botnet C2 server (confidence level: 100%)
213.199.38.144Unknown malware botnet C2 server (confidence level: 100%)

Hashes 1

Unknown Stealer payload (confidence level: 100%)

774dec46a037d1d89ac036b985f390c2a8887c9dfb626a658a0d2365427f9c3c

Description

ThreatFox IOCs for 2025-10-29

Impact

The potential impact of this threat on European organizations is limited due to the lack of specific exploit details, affected products, or active campaigns. Since no known exploits are in the wild and no patches or vulnerabilities are identified, the immediate risk to confidentiality, integrity, or availability is low. However, the presence of malware-related IOCs related to network activity and payload delivery suggests that organizations should remain vigilant against possible future attacks leveraging similar tactics. European entities that rely heavily on OSINT and network monitoring may benefit from integrating these IOCs into their detection systems to enhance early warning capabilities. The medium severity rating reflects a moderate concern, primarily from a threat intelligence perspective rather than an active exploitation standpoint. Overall, the impact is more about preparedness and situational awareness than direct operational disruption or data compromise at this stage.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing Security Information and Event Management (SIEM) and threat intelligence platforms to enhance detection capabilities. 2. Maintain up-to-date network monitoring and anomaly detection systems to identify unusual payload delivery or network activity patterns. 3. Conduct regular threat hunting exercises using OSINT feeds to proactively identify potential indicators related to this or similar threats. 4. Ensure robust segmentation and least privilege principles in network architecture to limit potential malware spread if payload delivery attempts occur. 5. Educate security teams on the importance of incorporating OSINT-derived IOCs into daily operations for improved situational awareness. 6. Continuously monitor ThreatFox and other reputable threat intelligence sources for updates or new indicators that may provide more actionable information. 7. Since no patches are available, focus on detection and response capabilities rather than remediation of vulnerabilities. 8. Collaborate with European CERTs and information sharing communities to exchange intelligence and best practices related to emerging malware threats.

Community reviews

Loading reviews…