IndicatorPublished 9 Nov 2025Updated 10 Nov 2025

ThreatFox IOCs for 2025-11-09

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 287

ubiloma.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
hlojonar.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
nubiloma.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
t3.sn0wmint.ruClearFake payload delivery domain (confidence level: 100%)
fx.sn0wmint.ruClearFake payload delivery domain (confidence level: 100%)
wolke.quillwinkel.ruClearFake payload delivery domain (confidence level: 100%)
fjord.quillwinkel.ruClearFake payload delivery domain (confidence level: 100%)
geist.quillwinkel.ruClearFake payload delivery domain (confidence level: 100%)
moos.swiftgasse.ruClearFake payload delivery domain (confidence level: 100%)
tau.swiftgasse.ruClearFake payload delivery domain (confidence level: 100%)

URLs 109

http://45.156.87.7/Hook botnet C2 (confidence level: 50%)
https://salator.es/sa1at/y/SalatStealer botnet C2 (confidence level: 50%)
https://salator.es/sa1at/l/SalatStealer botnet C2 (confidence level: 50%)
https://sysbirdrep.com/Unknown malware payload delivery URL (confidence level: 50%)
https://acebirdrep.com/Unknown malware payload delivery URL (confidence level: 50%)
https://birdrankopt.com/Unknown malware payload delivery URL (confidence level: 50%)
https://tapbirdrank.com/Unknown malware payload delivery URL (confidence level: 50%)
https://masazkielce.comUnknown malware payload delivery URL (confidence level: 50%)
https://desmflp.live/taigLumma Stealer botnet C2 (confidence level: 100%)
https://ns3177629.ip-51-195-60.eu/Unknown malware botnet C2 (confidence level: 50%)

IP addresses 136

111.229.148.93Cobalt Strike botnet C2 server (confidence level: 100%)
108.165.228.132Cobalt Strike botnet C2 server (confidence level: 100%)
23.249.20.52Ghost RAT botnet C2 server (confidence level: 75%)
93.144.224.162AsyncRAT botnet C2 server (confidence level: 100%)
45.156.87.7Hook botnet C2 server (confidence level: 100%)
188.68.168.150Unknown malware botnet C2 server (confidence level: 75%)
78.46.167.21Unknown malware botnet C2 server (confidence level: 100%)
72.60.113.48Unknown malware botnet C2 server (confidence level: 100%)
173.212.254.5Unknown malware botnet C2 server (confidence level: 100%)
13.38.46.18NetSupportManager RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-09

Impact

For European organizations, the impact of this threat is currently moderate. Since no active exploits or patches are reported, the immediate risk of compromise is low; however, the potential for network-based malware delivery could affect confidentiality, integrity, and availability if exploited. Organizations with extensive network exposure, such as financial institutions, telecommunications, and critical infrastructure operators, could face increased risk if the threat evolves or is leveraged in targeted attacks. The lack of specific affected versions or products complicates targeted defense but underscores the importance of robust network monitoring and incident response capabilities. The medium severity suggests that while the threat is not critical, it warrants attention to prevent escalation. Disruption could lead to data breaches, service interruptions, or foothold establishment by threat actors if payload delivery mechanisms are successful.

Defensive guidance

European organizations should enhance their network monitoring capabilities to detect unusual payload delivery activities and integrate ThreatFox IOCs into their threat intelligence platforms for proactive detection. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying suspicious network behaviors and payload execution patterns. Conduct regular threat hunting exercises focusing on network traffic anomalies and payload delivery attempts. Implement strict network segmentation to limit lateral movement in case of infection. Ensure that all systems are up to date with the latest security patches, even though no specific patches are available for this threat, to reduce overall attack surface. Educate security teams on interpreting OSINT feeds and integrating such intelligence into operational security workflows. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts. Finally, review and update incident response plans to address potential malware delivery scenarios.

Community reviews

Loading reviews…