IndicatorPublished 8 Dec 2025Updated 9 Dec 2025

ThreatFox IOCs for 2025-12-08

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 989

f8beta-2.comAsyncRAT botnet C2 domain (confidence level: 100%)
vek.equisphire.comUnknown malware payload delivery domain (confidence level: 100%)
veeki.orgUnknown malware payload delivery domain (confidence level: 100%)
city-therapy.testingweblink.comHavoc botnet C2 domain (confidence level: 100%)
sueweb.testingweblink.comHavoc botnet C2 domain (confidence level: 100%)
api.grabtrust.icuUnknown malware payload delivery domain (confidence level: 75%)
api.gigaversecentiliumai.cloudUnknown malware payload delivery domain (confidence level: 75%)
aytac7771-43366.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
aqua.mircosoftonliine.ruRemcos botnet C2 domain (confidence level: 100%)
mainmenuflo.ydns.euQuasar RAT botnet C2 domain (confidence level: 75%)

URLs 204

https://g-terrace.net/Unknown malware payload delivery URL (confidence level: 90%)
http://62.60.226.159/zbuyowgn/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://196.251.107.61/xvzpjyddlu/login.phpTinyLoader botnet C2 (confidence level: 100%)
https://vek.equisphire.comUnknown malware payload delivery URL (confidence level: 100%)
https://www.veeki.orgUnknown malware payload delivery URL (confidence level: 100%)
https://brownmountainangus.com.au/Unknown malware payload delivery URL (confidence level: 90%)
http://202.61.139.18:808/download.shKaiji botnet C2 (confidence level: 100%)
http://196.251.107.61/diamo/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://hillpaduampm.com.au/Unknown malware payload delivery URL (confidence level: 90%)
https://8050.jp/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 328

154.6.197.39Mirai botnet C2 server (confidence level: 80%)
208.87.204.57Cobalt Strike botnet C2 server (confidence level: 100%)
208.87.205.27Cobalt Strike botnet C2 server (confidence level: 100%)
208.87.205.34Cobalt Strike botnet C2 server (confidence level: 100%)
149.30.248.27Cobalt Strike botnet C2 server (confidence level: 100%)
208.87.204.62Cobalt Strike botnet C2 server (confidence level: 100%)
149.30.248.10Cobalt Strike botnet C2 server (confidence level: 100%)
149.30.248.57Cobalt Strike botnet C2 server (confidence level: 100%)
208.87.205.11Cobalt Strike botnet C2 server (confidence level: 100%)
208.87.203.36Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 213

fa1cfbe073cf31452fafedcd354962ed14106745NjRAT payload (confidence level: 95%)
c5518a2c94d6f6f1d38d6a55d5cb93e2e4d0a82f09088f0e1f583e46ff28ded9NjRAT payload (confidence level: 95%)
8f23c142ec3a311dbed1983e7288d6fcNjRAT payload (confidence level: 95%)
307792f23ef49447f4b577ef32adcbb2d9f54f1dXWorm payload (confidence level: 95%)
e79dc3b0fd951a447480671094efbc5fbc9a03cfcd222563c9883eb587f9ef73XWorm payload (confidence level: 95%)
a8a13734712adfb8af30ca8219e4a655XWorm payload (confidence level: 95%)
8c11e37c1c5d4da288d11d0418bad10360804943Remcos payload (confidence level: 95%)
ccf557e54f0f8f02baf682d87c50815e89cc0c8ed10438496fc1cc285664c9bbRemcos payload (confidence level: 95%)
cc4d99645fcda75fe95a5e6c59739da3Remcos payload (confidence level: 95%)
6b4fdd41c2b9ffe90d17d5b2d333cfcc6777b4f6XWorm payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-08

Impact

For European organizations, the primary impact of this threat lies in the potential for network intrusion and payload delivery attempts that could lead to unauthorized access, data exfiltration, or further malware deployment. Organizations heavily reliant on OSINT tools or with exposed network services may be more vulnerable to reconnaissance and subsequent attacks. While no direct exploit or patch is identified, the presence of these IOCs indicates active or emerging threat actor activity that could precede more targeted attacks. Disruption to confidentiality and integrity is possible if payloads succeed in compromising systems. Availability impact appears limited at this stage due to the lack of known exploits causing widespread damage. The medium severity suggests that while immediate critical damage is unlikely, the threat should not be ignored, especially in sectors with sensitive data or critical infrastructure. Proactive detection and response can mitigate escalation to more severe incidents.

Defensive guidance

1. Integrate the provided IOCs from ThreatFox into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enable early detection of related network activity. 2. Enhance network monitoring with a focus on unusual payload delivery patterns, including anomalous outbound connections and suspicious inbound traffic. 3. Conduct regular threat hunting exercises using OSINT-derived indicators to identify potential reconnaissance or intrusion attempts. 4. Harden network perimeter defenses, including firewalls and intrusion prevention systems, to block known malicious IPs and domains associated with the IOCs. 5. Educate security teams on the nature of OSINT-related threats and the importance of correlating threat intelligence feeds with internal logs. 6. Maintain up-to-date asset inventories to quickly identify and isolate affected systems if indicators are detected. 7. Collaborate with national and European cybersecurity centers to share intelligence and receive updates on evolving threats. 8. Since no patches are available, focus on detection and containment rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…