IndicatorPublished 2 Dec 2025Updated 3 Dec 2025

ThreatFox IOCs for 2025-12-02

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 229

soft-dns.sejilod7488888.workers.devSMOKEDHAM botnet C2 domain (confidence level: 100%)
alexiac.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
ascetin.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
boflijo.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
entraiz.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
extirpo.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
leonhat.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
rotfqxu.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
truxaqn.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
simonts.cyouLumma Stealer botnet C2 domain (confidence level: 75%)

URLs 20

https://echo-pr.co.uk/Unknown malware payload delivery URL (confidence level: 90%)
http://www.tsq-hk.com/rollers/rokow3/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://77.221.154.164/unamwebpanel/unamwebpanel/pages/login.phpUnknown RAT botnet C2 (confidence level: 100%)
http://167.88.165.253Stealc botnet C2 (confidence level: 100%)
http://23.132.228.234/panel.htmlUnknown malware botnet C2 (confidence level: 50%)
https://butege075.xyz/SpyNote botnet C2 (confidence level: 50%)
https://serv-in.fr/Unknown malware payload delivery URL (confidence level: 90%)
https://exodus-wallets.io/exodus.exeUnknown RAT payload delivery URL (confidence level: 100%)
https://www.vanda.edu.kh/Unknown malware payload delivery URL (confidence level: 90%)
https://www.cymage-media.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 121

51.255.81.133Socks5 Systemz botnet C2 server (confidence level: 99%)
74.91.19.130Socks5 Systemz botnet C2 server (confidence level: 99%)
104.131.23.252Mirai botnet C2 server (confidence level: 100%)
119.29.112.57Cobalt Strike botnet C2 server (confidence level: 100%)
54.255.195.252Quasar RAT botnet C2 server (confidence level: 100%)
109.230.231.29MimiKatz botnet C2 server (confidence level: 100%)
194.14.217.125Cobalt Strike botnet C2 server (confidence level: 75%)
194.14.217.125Cobalt Strike botnet C2 server (confidence level: 75%)
38.182.168.169Cobalt Strike botnet C2 server (confidence level: 75%)
156.234.121.175Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-02

Impact

For European organizations, the impact of this threat intelligence feed depends on how effectively it is integrated into security operations. If these IOCs correspond to emerging malware campaigns, failure to incorporate them into detection systems could result in delayed identification of payload delivery attempts or network intrusions. Potential impacts include unauthorized access, data exfiltration, or disruption of network services if malware payloads are successfully delivered. The lack of specific affected products or versions means the threat could be broad, affecting multiple sectors relying on network infrastructure and OSINT tools. Organizations with mature security monitoring and incident response capabilities can leverage this intelligence to reduce dwell time and mitigate attacks early. Conversely, entities lacking such capabilities may face increased risk of compromise. The medium severity suggests moderate risk, with potential confidentiality and availability impacts if exploited. The absence of known exploits in the wild currently limits immediate risk but does not preclude future escalation.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Regularly update threat intelligence feeds and correlate with internal logs to identify suspicious network activity or payload delivery attempts. 3. Conduct network segmentation to limit lateral movement in case of malware infection. 4. Implement strict egress filtering and monitor outbound traffic for anomalies that may indicate data exfiltration. 5. Train security teams to analyze OSINT-based threat intelligence and adapt detection rules accordingly. 6. Perform regular threat hunting exercises using the latest IOCs to proactively identify potential compromises. 7. Maintain up-to-date backups and incident response plans to reduce impact in case of successful payload delivery. 8. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about emerging threats. 9. Employ multi-factor authentication and least privilege principles to reduce attack surface, even though this threat does not specify authentication requirements. 10. Monitor vendor advisories and update defenses promptly if new patches or mitigations become available.

Community reviews

Loading reviews…