IndicatorPublished 30 Nov 2025Updated 1 Dec 2025

ThreatFox IOCs for 2025-11-30

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 216

poisonmantr.onlineNetSupportManager RAT payload delivery domain (confidence level: 100%)
kolmina.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
sprng9.fr0gtime.ruClearFake payload delivery domain (confidence level: 100%)
quak3r.fr0gtime.ruClearFake payload delivery domain (confidence level: 100%)
key7hp.keyhope.ruClearFake payload delivery domain (confidence level: 100%)
hope9r.keyhope.ruClearFake payload delivery domain (confidence level: 100%)
l0ckey.keyhope.ruClearFake payload delivery domain (confidence level: 100%)
trez5r.keyhope.ruClearFake payload delivery domain (confidence level: 100%)
optn4k.keyhope.ruClearFake payload delivery domain (confidence level: 100%)
gold7y.g0ldfish.ruClearFake payload delivery domain (confidence level: 100%)

URLs 27

https://poisonmantr.online/cgi/vcc.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://poisonmantr.online/cgi/lkk.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://poisonmantr.online/cgi/pwd.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://renewids.com/queueNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://kolmina.com/ppllkk.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://156.225.29.18:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://atxsa.com/Unknown malware payload delivery URL (confidence level: 90%)
https://taukr.lt/Unknown malware payload delivery URL (confidence level: 90%)
https://lingering-verify-cloud.pages.dev/Unknown malware payload delivery URL (confidence level: 90%)
http://198.46.221.26:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 112

154.84.56.55Cobalt Strike botnet C2 server (confidence level: 100%)
47.95.196.146GobRAT botnet C2 server (confidence level: 100%)
195.162.69.227Remcos botnet C2 server (confidence level: 100%)
43.245.226.249Stealc botnet C2 server (confidence level: 100%)
103.130.215.101Bashlite botnet C2 server (confidence level: 100%)
43.153.40.135AdaptixC2 botnet C2 server (confidence level: 100%)
46.17.40.191AdaptixC2 botnet C2 server (confidence level: 100%)
27.124.45.66ValleyRAT botnet C2 server (confidence level: 100%)
78.186.115.49Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
91.92.241.59Mirai botnet C2 server (confidence level: 80%)

Hashes 182

310ade16a531c195a1db4a84968fb935f7ba5bd1Cobalt Strike payload (confidence level: 95%)
46196f889bde8f7d74dab2eda145215ac33eb4451aab8705d71bd6ea3c20988cCobalt Strike payload (confidence level: 95%)
dfccd2b074d6380a61e70fa743f64d9dCobalt Strike payload (confidence level: 95%)
8ab5506ffb55b501d0aa88a52e9ae81f2f9568efCobalt Strike payload (confidence level: 95%)
64db468d9c3d860ef9f014b1b7020a1089249eb169220cc3bd3018f232b992aaCobalt Strike payload (confidence level: 95%)
7b4fe3fe0fad480f104c1ad19adbe22aCobalt Strike payload (confidence level: 95%)
c67b61b2b092ec26503f3b4869e2ccf9f2f6fa94Cobalt Strike payload (confidence level: 95%)
5bcef00c270c39cbe34fab65226ca6e442e99dc4e0d42e6a5c1039c105ffa95fCobalt Strike payload (confidence level: 95%)
a07d7d0d82743d75afbe69c2dacfd61dCobalt Strike payload (confidence level: 95%)
52a704748baf3d1c13e5ded1c814bab4a4df645fAsyncRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-11-30

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits and specific affected systems. However, the presence of malware-related IOCs in the OSINT domain suggests potential risks related to payload delivery and network activity that could lead to unauthorized access, data exfiltration, or disruption if leveraged by threat actors. Organizations relying heavily on open-source intelligence or those with extensive networked environments may face increased exposure to such threats. The medium severity rating indicates a moderate risk that could escalate if the malware evolves or gains wider distribution. Potential impacts include compromise of network integrity, exposure of sensitive information, and operational disruptions. Since no patches or direct mitigations are available, the threat primarily challenges detection and response capabilities. European entities in critical infrastructure, finance, and government sectors should be particularly vigilant, as these sectors are frequent targets for malware campaigns. Overall, while immediate impact is low, the threat underscores the need for continuous monitoring and threat intelligence assimilation to preempt escalation.

Defensive guidance

1. Integrate ThreatFox and other reputable OSINT threat intelligence feeds into existing Security Information and Event Management (SIEM) and endpoint detection platforms to enhance detection capabilities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns and network activity that could indicate malware presence. 3. Employ advanced endpoint protection solutions capable of behavioral analysis to detect unknown or emerging malware variants. 4. Maintain strict network segmentation and access controls to limit lateral movement in case of compromise. 5. Train security teams to interpret and act upon OSINT-derived IOCs, emphasizing correlation with internal logs and alerts. 6. Implement proactive threat hunting exercises targeting indicators related to payload delivery and network anomalies. 7. Ensure timely application of security updates and patches for all software, even though no specific patches are currently available for this threat. 8. Establish incident response plans that incorporate OSINT threat intelligence to accelerate containment and remediation. 9. Collaborate with national and European cybersecurity centers to share intelligence and receive guidance on emerging threats. 10. Regularly review and update firewall and intrusion detection/prevention system (IDS/IPS) rules to block known malicious network activity patterns.

Community reviews

Loading reviews…