IndicatorPublished 7 Dec 2025Updated 8 Dec 2025

ThreatFox IOCs for 2025-12-07

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 79

ritualex.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
g7cnfrcns.localto.netXWorm botnet C2 domain (confidence level: 100%)
yopaxif225-50693.portmap.hostAsyncRAT botnet C2 domain (confidence level: 100%)
bullstreetgourmetandmarket.lautrec.infoAsyncRAT botnet C2 domain (confidence level: 50%)
cagis.pandajogosgratis.comAsyncRAT botnet C2 domain (confidence level: 50%)
cakhiatv.videoAsyncRAT botnet C2 domain (confidence level: 50%)
cakhiatv.watchAsyncRAT botnet C2 domain (confidence level: 50%)
cakhiatvb.comAsyncRAT botnet C2 domain (confidence level: 50%)
cakhiatvd.comAsyncRAT botnet C2 domain (confidence level: 50%)
copenhagenclimatecouncil.comAsyncRAT botnet C2 domain (confidence level: 50%)

URLs 12

https://tizambia.org.zm/2025/03/civil-society-position-on-the-proposed-constitutional-amendment-process/Unknown malware payload delivery URL (confidence level: 90%)
https://www.1c-bitrix-perenos.adm-center.ru/Unknown malware payload delivery URL (confidence level: 90%)
https://1c-bitrix-perenos.adm-center.ru/Unknown malware payload delivery URL (confidence level: 90%)
https://sfmonte.com/accelerator/auth.token.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://sfmonte.com/accelerator/handler.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://ritualex.com/accelerator/auth.token.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://ritualex.com/accelerator/handler.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://62.60.179.219/Hook botnet C2 (confidence level: 50%)
https://shilohbn.ru.comDCRat botnet C2 (confidence level: 50%)
http://195.133.9.204/skare.oddUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 117

182.114.203.74Unknown malware botnet C2 server (confidence level: 100%)
122.10.52.27Unknown malware botnet C2 server (confidence level: 100%)
104.233.162.77AdaptixC2 botnet C2 server (confidence level: 100%)
168.245.200.96Meterpreter botnet C2 server (confidence level: 100%)
193.42.36.150Cobalt Strike botnet C2 server (confidence level: 100%)
154.12.16.29Unknown malware botnet C2 server (confidence level: 100%)
41.43.193.247AsyncRAT botnet C2 server (confidence level: 100%)
93.233.104.82AsyncRAT botnet C2 server (confidence level: 100%)
89.116.51.98Unknown malware botnet C2 server (confidence level: 100%)
194.156.89.81Quasar RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-07

Impact

For European organizations, the impact of this threat is currently moderate due to the absence of active exploitation or known widespread attacks. However, the presence of malware-related IOCs related to payload delivery and network activity suggests potential risks including unauthorized access, data exfiltration, or disruption of services if the malware is successfully deployed. Organizations with extensive network infrastructure or those in critical sectors such as finance, energy, and government could face increased risk if attackers leverage these indicators to craft targeted campaigns. The lack of specific affected software versions means the threat could be broad and opportunistic, affecting diverse environments. The medium severity rating implies that while immediate damage may be limited, failure to incorporate these IOCs into detection systems could allow malware to persist undetected, leading to longer-term confidentiality, integrity, or availability issues. European entities should remain vigilant, especially those with high-value data or critical infrastructure, as the threat could evolve or be combined with other attack vectors. The absence of patches or fixes means mitigation relies heavily on detection and response capabilities rather than vulnerability remediation.

Defensive guidance

European organizations should integrate the provided IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. Network monitoring should focus on unusual payload delivery patterns and anomalous network activity consistent with malware behavior. Employing threat hunting exercises using these IOCs can help identify early signs of compromise. Organizations should ensure that network segmentation and least privilege principles are enforced to limit malware propagation. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) to recognize behaviors associated with the indicators is critical. Since no patches are available, emphasis should be placed on user awareness training to reduce the risk of initial infection vectors such as phishing. Backup and recovery plans should be tested to mitigate potential impacts of payload execution. Collaboration with national Computer Security Incident Response Teams (CSIRTs) and sharing intelligence within European cybersecurity communities can improve collective defense. Finally, maintaining up-to-date asset inventories and conducting vulnerability assessments will help identify and protect critical systems that could be targeted.

Community reviews

Loading reviews…