IndicatorPublished 1 Dec 2025Updated 2 Dec 2025

ThreatFox IOCs for 2025-12-01

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 413

ga.rt.threat.cityUnknown malware botnet C2 domain (confidence level: 100%)
clear.che7nt2rp.ruClearFake payload delivery domain (confidence level: 100%)
flame.f1nsh2ytan.ruClearFake payload delivery domain (confidence level: 100%)
silent.f1nsh2ytan.ruClearFake payload delivery domain (confidence level: 100%)
sunny.f1nsh2ytan.ruClearFake payload delivery domain (confidence level: 100%)
night.f1nsh2ytan.ruClearFake payload delivery domain (confidence level: 100%)
beta.5eertr1ad.ruClearFake payload delivery domain (confidence level: 100%)
ld8bd.5eertr1ad.ruClearFake payload delivery domain (confidence level: 100%)
century-see.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
stars-party.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 54

https://ilingering-verify-clouds.pages.dev/Unknown malware payload delivery URL (confidence level: 90%)
http://194.105.81.87/bins.shUnknown malware payload delivery URL (confidence level: 75%)
https://ttr.jyhsolucion.ar/Vidar botnet C2 (confidence level: 100%)
https://ttr.tokiejegedeinitiative.org/Vidar botnet C2 (confidence level: 100%)
https://uyu.jyhsolucion.ar/Vidar botnet C2 (confidence level: 100%)
https://uyu.wantedrelief.com/Vidar botnet C2 (confidence level: 100%)
https://185.196.11.26/Vidar botnet C2 (confidence level: 100%)
https://86.54.42.69/Vidar botnet C2 (confidence level: 100%)
https://185.196.11.32/Vidar botnet C2 (confidence level: 100%)
https://128.140.32.35/Vidar botnet C2 (confidence level: 100%)

IP addresses 1,540

159.75.201.5Cobalt Strike botnet C2 server (confidence level: 100%)
48.193.32.28Unknown malware botnet C2 server (confidence level: 100%)
46.173.214.16DCRat botnet C2 server (confidence level: 100%)
75.119.134.28Unknown malware botnet C2 server (confidence level: 100%)
45.76.83.185Unknown malware botnet C2 server (confidence level: 100%)
5.75.206.226Unknown malware botnet C2 server (confidence level: 100%)
108.72.230.9Bashlite botnet C2 server (confidence level: 90%)
45.156.87.48Mirai botnet C2 server (confidence level: 80%)
62.60.226.53Stealc botnet C2 server (confidence level: 50%)
138.226.236.104Stealc botnet C2 server (confidence level: 50%)

Hashes 5

NjRAT payload (confidence level: 100%)

cef141d894400bc2e0096d1ed0c8f95b
a73edb60b80a2dfa86735d821bea7b19
a93349ba5e621cfb7a46dc9f401fd998
11375fb0cee4c06b5cefa2031ee2ed6d
19967e886edcd2f22f8d4a58c8ea3773

Description

ThreatFox IOCs for 2025-12-01

Impact

For European organizations, the impact of this threat is primarily in the realm of detection and preparedness rather than immediate compromise. Since no specific vulnerabilities or exploits are identified, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, the presence of payload delivery and network activity indicators suggests potential attempts to infiltrate networks or deliver malicious code, which could lead to data breaches or operational disruptions if successful. Organizations relying heavily on OSINT tools or those with extensive network exposure may face increased reconnaissance or targeted payload delivery attempts. The medium severity rating implies moderate risk, necessitating vigilance but not immediate emergency response. The lack of patches or known exploits means that mitigation focuses on monitoring and response rather than patch management. European entities with critical infrastructure or sensitive data may experience indirect impacts if attackers use these IOCs to refine their attack strategies. Overall, the threat underscores the importance of integrating threat intelligence into security operations to reduce the window of opportunity for adversaries.

Defensive guidance

To effectively mitigate this threat, European organizations should: 1) Integrate the provided ThreatFox IOCs into their Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to enhance detection capabilities. 2) Conduct regular network traffic analysis to identify anomalous payload delivery attempts or suspicious network activity consistent with the threat profile. 3) Enhance OSINT monitoring processes to detect adversary reconnaissance activities early. 4) Update incident response playbooks to include scenarios involving payload delivery and network-based malware infections. 5) Train security teams to recognize and respond to indicators related to this threat, emphasizing proactive threat hunting. 6) Collaborate with national and European cybersecurity information sharing organizations to exchange updated IOCs and threat intelligence. 7) Maintain robust network segmentation and access controls to limit the impact of any successful payload delivery. 8) Perform regular security awareness training for employees to reduce the risk of social engineering vectors that could facilitate payload delivery. These measures go beyond generic advice by focusing on intelligence integration, proactive detection, and coordinated response tailored to the nature of the threat.

Community reviews

Loading reviews…