IndicatorPublished 31 Oct 2025Updated 1 Nov 2025

ThreatFox IOCs for 2025-10-31

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 278

prototype.tapmycard.workFAKEUPDATES botnet C2 domain (confidence level: 100%)
nn.w1um.ruClearFake payload delivery domain (confidence level: 100%)
pe5.ke9t.ruClearFake payload delivery domain (confidence level: 100%)
m9k.ey-l2q.ruClearFake payload delivery domain (confidence level: 100%)
9hm.se5m.ruClearFake payload delivery domain (confidence level: 100%)
w8.di5r.ruClearFake payload delivery domain (confidence level: 100%)
tq1.ey-l2q.ruClearFake payload delivery domain (confidence level: 100%)
m0k4.kat31o.ruClearFake payload delivery domain (confidence level: 100%)
pi1.xo3v.ruClearFake payload delivery domain (confidence level: 100%)
oct.j3ve.ruClearFake payload delivery domain (confidence level: 100%)

URLs 50

http://95.164.55.158:5506/izhhanxe.msiRhadamanthys payload delivery URL (confidence level: 100%)
http://95.164.55.158:5506/cq.vbsRhadamanthys payload delivery URL (confidence level: 100%)
http://119.29.4.226:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://119.91.52.117:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://117.72.107.55:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://snappis.lat/apiLumma Stealer botnet C2 (confidence level: 100%)
http://45.156.87.83/gtop.shUnknown malware payload delivery URL (confidence level: 75%)
https://193.233.232.54/e5f9db40aa1d5c5c.phpStealc botnet C2 (confidence level: 50%)
http://91.92.242.95/Hook botnet C2 (confidence level: 50%)
https://20.189.122.18:39999/Unknown malware botnet C2 (confidence level: 50%)

IP addresses 259

62.60.158.10Rhadamanthys botnet C2 server (confidence level: 100%)
45.132.50.107DCRat botnet C2 server (confidence level: 100%)
51.210.106.249Unknown malware botnet C2 server (confidence level: 100%)
35.185.181.125Unknown malware botnet C2 server (confidence level: 100%)
47.121.137.203Unknown malware botnet C2 server (confidence level: 100%)
185.200.243.207Sliver botnet C2 server (confidence level: 75%)
34.68.221.226Cobalt Strike botnet C2 server (confidence level: 50%)
193.112.92.122Cobalt Strike botnet C2 server (confidence level: 50%)
111.229.147.197Cobalt Strike botnet C2 server (confidence level: 50%)
195.133.198.77Cobalt Strike botnet C2 server (confidence level: 50%)

Hashes 4

Rhadamanthys payload (confidence level: 100%)

0bbc236b8d2ccaaff396055a5f228d33d6f676e4f9aeffbff739f81bfc84ece9
1078d9ac903d0cdb0cb02f3a15f23d2e6efd4694ffa34a923aae9724f92715cb
157a9c82e3f64c2748c80766fb1be4d3eeae24c311184722641d5a69ce11953b
9359a0e79e1bd0cd1878acf21707bccafc6a9eae68655a89e1e362067a8b95d2

Description

ThreatFox IOCs for 2025-10-31

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known active exploits or specific affected products. However, the focus on OSINT and network activity suggests potential risks related to reconnaissance and initial payload delivery stages of malware campaigns. Organizations relying heavily on OSINT tools or with extensive network infrastructures could face increased exposure if threat actors leverage these IOCs to craft targeted attacks. The medium severity rating indicates a moderate risk to confidentiality, integrity, and availability, primarily through potential malware infections that could disrupt operations or lead to data compromise. Since no patches or fixes are available, the impact depends largely on the effectiveness of existing detection and response capabilities. European entities with critical infrastructure or sensitive data may need to enhance monitoring to detect early signs of exploitation attempts. The lack of authentication or user interaction requirements implies that exploitation could be automated or opportunistic, increasing the potential attack surface. Overall, while immediate impact is low, the threat represents a persistent risk that could escalate if threat actors develop active exploits based on these IOCs.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating them with internal logs will help identify suspicious network activity or payload delivery attempts. Network segmentation and strict access controls can limit the lateral movement of malware if initial compromise occurs. Since no patches are available, emphasis should be placed on proactive monitoring, anomaly detection, and incident response preparedness. Conducting threat hunting exercises focused on OSINT-related indicators and payload delivery patterns can uncover early signs of compromise. Employee training on recognizing phishing or social engineering tactics that may facilitate payload delivery remains critical. Additionally, organizations should collaborate with national cybersecurity centers and share intelligence to stay informed about emerging threats. Implementing network traffic analysis tools that can detect unusual outbound connections or data exfiltration attempts will further reduce risk. Finally, maintaining up-to-date backups and disaster recovery plans ensures resilience against potential malware impacts.

Community reviews

Loading reviews…