IndicatorPublished 12 Dec 2025Updated 13 Dec 2025

ThreatFox IOCs for 2025-12-12

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 219

gov.hanel.workVidar botnet C2 domain (confidence level: 100%)
microservice-update-s1-bucket.ccAmatera payload delivery domain (confidence level: 100%)
microservice-update-s2-bucket.ccAmatera payload delivery domain (confidence level: 100%)
api-w11c.onrender.comUnknown Stealer botnet C2 domain (confidence level: 100%)
qwg6.orbshackle.ruClearFake payload delivery domain (confidence level: 100%)
shackle.twig-mantle.ruClearFake payload delivery domain (confidence level: 100%)
dlnd.twig-mantle.ruClearFake payload delivery domain (confidence level: 100%)
bf1.twig-mantle.ruClearFake payload delivery domain (confidence level: 100%)
i4o3.twig-mantle.ruClearFake payload delivery domain (confidence level: 100%)
qmolq.saffrondent.ruClearFake payload delivery domain (confidence level: 100%)

URLs 95

https://lingering-my-verify-clouds-1.pages.dev/Unknown malware payload delivery URL (confidence level: 90%)
https://microservice-update-s1-bucket.cc/hollypriest.docxAmatera payload delivery URL (confidence level: 100%)
https://api-w11c.onrender.com/api/sendUnknown Stealer botnet C2 (confidence level: 50%)
http://47.243.211.91:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://154.61.77.105:8082/Unknown malware botnet C2 (confidence level: 50%)
http://damysa10.top/download.php?file=lv.exeCryptBot payload delivery URL (confidence level: 50%)
http://sarefy07.top/download.php?file=lv.exeCryptBot payload delivery URL (confidence level: 50%)
http://sarjeb09.top/download.php?file=lv.exeCryptBot payload delivery URL (confidence level: 50%)
http://knumfl68.top/index.phpCryptBot botnet C2 (confidence level: 50%)
http://knuywu58.top/index.phpCryptBot botnet C2 (confidence level: 50%)

IP addresses 222

157.180.22.193Vidar botnet C2 server (confidence level: 100%)
158.94.210.44Mirai botnet C2 server (confidence level: 80%)
95.182.101.109Stealc botnet C2 server (confidence level: 100%)
213.176.16.165Amatera botnet C2 server (confidence level: 100%)
94.183.183.52Amatera botnet C2 server (confidence level: 100%)
206.206.127.137Unknown RAT botnet C2 server (confidence level: 100%)
172.111.150.202Remcos botnet C2 server (confidence level: 100%)
23.17.234.198Unknown malware botnet C2 server (confidence level: 100%)
80.69.88.61Unknown malware botnet C2 server (confidence level: 100%)
193.233.87.70Mirai botnet C2 server (confidence level: 75%)

Hashes 3

22804099ed114502613561e19c39b08d85532366de6aa7dc7b648da51d4a7515Quasar RAT payload (confidence level: 100%)
ca49f69a007de870c0ae4c9cabaa4707ad73c9735d643c7bfcdc2a4cf2ba9765Quasar RAT payload (confidence level: 100%)
de5fcb3128ab96a7c5e45d93ed01498102aacde90552b9bffc581fa94d5c8e6aCoinminer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-12

Impact

For European organizations, the impact of this threat is currently limited due to the lack of active exploits and specific affected products or versions. However, the presence of IOCs related to network activity and payload delivery means that organizations could face risks from malware infections if these indicators correspond to emerging or ongoing campaigns. The medium severity suggests a moderate potential for disruption, data compromise, or network intrusion if the threat evolves. Organizations relying heavily on OSINT tools or those with extensive network exposure might be more susceptible to related attacks. Since no patches or direct mitigations are available, the impact is primarily on detection and response capabilities. Failure to incorporate these IOCs into monitoring systems could delay identification of malicious activity, increasing the risk of successful intrusions or data breaches.

Defensive guidance

European organizations should integrate the provided IOCs into their existing security monitoring and threat intelligence platforms to enhance detection of related malware activity. Network traffic should be closely monitored for anomalies matching the threat indicators, and endpoint detection and response (EDR) tools should be updated with the latest intelligence feeds. Organizations should conduct regular threat hunting exercises focusing on payload delivery mechanisms and suspicious network behaviors. Since no patches are available, emphasis should be placed on proactive detection, segmentation of critical networks, and strict access controls to limit lateral movement in case of compromise. Collaboration with national and European cybersecurity centers to share and receive updated intelligence is recommended. Additionally, organizations should review and update incident response plans to address potential malware infections indicated by these IOCs.

Community reviews

Loading reviews…