IndicatorPublished 30 Oct 2025Updated 31 Oct 2025

ThreatFox IOCs for 2025-10-30

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 264

perropa.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
menuderg.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
cdn.m365.1drive.zipUnknown malware botnet C2 domain (confidence level: 100%)
beautybalcony.comHavoc botnet C2 domain (confidence level: 100%)
y27.po5m.ruClearFake payload delivery domain (confidence level: 100%)
a7.7si-s.ruClearFake payload delivery domain (confidence level: 100%)
d5.2s84d.ruClearFake payload delivery domain (confidence level: 100%)
6i4.ze9y.ruClearFake payload delivery domain (confidence level: 100%)
v31.7si-s.ruClearFake payload delivery domain (confidence level: 100%)
rh6.gl8r.ruClearFake payload delivery domain (confidence level: 100%)

URLs 21

http://144.31.90.17/approveNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://ndtv.plus/delta.htmlClearFake payload delivery URL (confidence level: 100%)
https://api.telegram.org/bot7404299573:aafjqbpn2tzwryugvo-nrdmjy9cxdmy-g40Unknown malware botnet C2 (confidence level: 75%)
http://e4hwk3w4ztqfkyo6l36ss3tfj4bw2jw4ytkmomkx2ugwjgrs4w3lriid.onionLockBit botnet C2 (confidence level: 50%)
https://nv5.tweethost.com/Vidar botnet C2 (confidence level: 100%)
https://nv5.united-gs.net/Vidar botnet C2 (confidence level: 100%)
http://178.16.54.109/4Phorpiex payload delivery URL (confidence level: 100%)
http://178.16.54.109/lk.exePhorpiex payload delivery URL (confidence level: 100%)
http://217.154.0.7Unknown RAT botnet C2 (confidence level: 100%)
https://fellsminjs.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)

IP addresses 158

144.31.90.17ClearFake botnet C2 server (confidence level: 100%)
113.44.76.47Cobalt Strike botnet C2 server (confidence level: 100%)
217.182.253.119Cobalt Strike botnet C2 server (confidence level: 100%)
20.189.122.18Unknown malware botnet C2 server (confidence level: 100%)
154.8.156.39Unknown malware botnet C2 server (confidence level: 100%)
202.10.36.170Unknown malware botnet C2 server (confidence level: 100%)
188.245.112.73Unknown malware botnet C2 server (confidence level: 100%)
35.156.114.184Unknown malware botnet C2 server (confidence level: 100%)
13.233.199.110Unknown malware botnet C2 server (confidence level: 100%)
34.57.30.61Unknown malware botnet C2 server (confidence level: 100%)

Hashes 333

fa69c67f22406b4d28fbcc34fe025d9cd9628d6aValleyRAT payload (confidence level: 95%)
536f30dac4f694ff4cf0ab9352c019363d6260ab00ea67bc45c2b89d0280b165ValleyRAT payload (confidence level: 95%)
0e3c8bf141170c39b3c2ad289b426310ValleyRAT payload (confidence level: 95%)
d028a5cfc1c1e4d2e9b924691b21ba3dc66d281cNanocore RAT payload (confidence level: 95%)
a22cff1b630771a330a605a71829ad0a113446b40a38044b5b5ce55df6cc2fc8Nanocore RAT payload (confidence level: 95%)
eac8b8c88719d4dd85e8bd882e9cdba7Nanocore RAT payload (confidence level: 95%)
8efd6573401b17ce577d8090fee366262d6734dbRhadamanthys payload (confidence level: 95%)
eb0ffbe87d22f818139c99cdff2802f780bc236ba6ba79a1cee2cfdbb96734faRhadamanthys payload (confidence level: 95%)
28845da6796eab0178be956e9ec8fd73Rhadamanthys payload (confidence level: 95%)
0fa8344d6c0147e5e1a11c34f5af88e9c52c8433MASS Logger payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-30

Impact

For European organizations, this threat poses a moderate risk primarily through potential network-based payload delivery mechanisms. The lack of specific affected products or versions reduces the immediate risk of widespread compromise. However, organizations relying heavily on OSINT tools or those with extensive network infrastructures could be targeted for reconnaissance or as vectors for malware delivery. The medium severity suggests possible impacts on confidentiality and integrity if payloads are successfully delivered and executed, potentially leading to data breaches or system compromise. Availability impacts appear limited given the absence of known exploits or destructive payloads. The threat's distribution score indicates moderate dissemination, which could translate to targeted or opportunistic attacks rather than mass exploitation. European entities involved in intelligence, defense, or critical infrastructure sectors may face higher risks due to the strategic value of OSINT data and network access. Overall, the impact is currently contained but could escalate if exploitation techniques evolve or if the malware payloads become more sophisticated.

Defensive guidance

1. Enhance network monitoring and anomaly detection capabilities to identify unusual payload delivery attempts or suspicious OSINT-related network activity. 2. Implement strict network segmentation and access controls to limit the spread of potential malware delivered via network vectors. 3. Regularly update and audit OSINT tools and related software to ensure they are not vulnerable to exploitation, even if no specific patches exist for this threat. 4. Employ threat intelligence sharing platforms to stay updated on emerging IOCs and adapt defenses accordingly. 5. Conduct employee training focused on recognizing signs of network-based attacks and the importance of reporting anomalies. 6. Utilize endpoint detection and response (EDR) solutions capable of detecting payload execution and lateral movement. 7. Develop incident response plans that include scenarios involving OSINT-related malware delivery. 8. Collaborate with national cybersecurity centers to receive timely alerts and guidance tailored to regional threat landscapes.

Community reviews

Loading reviews…