IndicatorPublished 6 Dec 2025Updated 7 Dec 2025

ThreatFox IOCs for 2025-12-06

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 121

alza7f.localto.netQuasar RAT botnet C2 domain (confidence level: 100%)
fi.derayat.comVidar botnet C2 domain (confidence level: 100%)
content-distribution-v2.proStealc botnet C2 domain (confidence level: 100%)
h1.f2rcegro0m.ruClearFake payload delivery domain (confidence level: 100%)
mist.f2rcegro0m.ruClearFake payload delivery domain (confidence level: 100%)
dmh.f2rcegro0m.ruClearFake payload delivery domain (confidence level: 100%)
dll32s.latAmadey botnet C2 domain (confidence level: 50%)
6uyj.ind1sset5.ruClearFake payload delivery domain (confidence level: 100%)
crystal.ind1sset5.ruClearFake payload delivery domain (confidence level: 100%)
a8.ind1sset5.ruClearFake payload delivery domain (confidence level: 100%)

URLs 32

https://185.208.159.236/Vidar botnet C2 (confidence level: 100%)
https://46.62.240.203/Vidar botnet C2 (confidence level: 100%)
https://nuzzyservices.com/stb/pokerface/init.php?id=wnwze2mwrxps9djdvnuwfxbUnknown malware botnet C2 (confidence level: 100%)
http://202.182.102.83:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://fi.derayat.com/Vidar botnet C2 (confidence level: 100%)
http://dll32s.lat/ms/login.phpAmadey botnet C2 (confidence level: 100%)
http://154.36.175.48:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://karma0.xyz/LockBit botnet C2 (confidence level: 50%)
http://205.185.116.233/LockBit botnet C2 (confidence level: 50%)
https://jakeislame.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 181

154.6.197.35Mirai botnet C2 server (confidence level: 80%)
103.75.183.222Mirai botnet C2 server (confidence level: 80%)
121.127.34.100Mirai botnet C2 server (confidence level: 80%)
185.208.159.236Vidar botnet C2 server (confidence level: 100%)
46.62.240.203Vidar botnet C2 server (confidence level: 100%)
212.64.215.198Quasar RAT botnet C2 server (confidence level: 100%)
202.182.102.83Unknown malware botnet C2 server (confidence level: 100%)
38.19.198.245DarkComet botnet C2 server (confidence level: 100%)
45.144.53.58Stealc botnet C2 server (confidence level: 100%)
86.54.24.139Stealc botnet C2 server (confidence level: 100%)

Hashes 1

SmokeLoader payload (confidence level: 50%)

e818a9afd55693d556a47002a7b7ef31

Description

ThreatFox IOCs for 2025-12-06

Impact

For European organizations, this threat could result in unauthorized network access, data exfiltration, or the delivery of malicious payloads that compromise system integrity or availability. Organizations heavily reliant on OSINT tools or those with significant network exposure may face increased risk of reconnaissance and subsequent targeted attacks. The medium severity suggests that while the threat is not currently exploited widely, it could serve as a vector for more damaging attacks if leveraged effectively. Potential impacts include disruption of services, leakage of sensitive information, and increased exposure to follow-on attacks. The absence of patches and known exploits indicates a need for proactive defense rather than reactive remediation. European critical infrastructure, government agencies, and private sector entities involved in intelligence or sensitive data processing could be particularly vulnerable. The threat's network-based nature underscores the importance of robust perimeter defenses and continuous monitoring to detect anomalous payload delivery attempts.

Defensive guidance

European organizations should enhance their network monitoring capabilities to detect unusual payload delivery and OSINT-related reconnaissance activities. Deploy advanced intrusion detection and prevention systems (IDS/IPS) with updated threat intelligence feeds, including ThreatFox data, to identify emerging indicators once available. Implement strict network segmentation to limit lateral movement and reduce the attack surface. Employ behavioral analytics to detect deviations from normal network traffic patterns that may indicate payload delivery or reconnaissance. Regularly update and audit OSINT tools and their configurations to minimize exposure to exploitation. Conduct threat hunting exercises focusing on network payload delivery vectors and OSINT activity patterns. Strengthen endpoint security with application whitelisting and exploit mitigation techniques to prevent payload execution. Foster information sharing with European cybersecurity communities to stay informed about evolving threats and indicators. Finally, develop incident response plans tailored to network-based payload delivery scenarios to ensure rapid containment and remediation.

Community reviews

Loading reviews…