IndicatorPublished 14 Dec 2025Updated 15 Dec 2025

ThreatFox IOCs for 2025-12-14

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 174

crum.ripplecask.ruClearFake payload delivery domain (confidence level: 100%)
omega.ripplecask.ruClearFake payload delivery domain (confidence level: 100%)
bmz0.ripplecask.ruClearFake payload delivery domain (confidence level: 100%)
vx7.snareplum.ruClearFake payload delivery domain (confidence level: 100%)
patch.snareplum.ruClearFake payload delivery domain (confidence level: 100%)
hth.snareplum.ruClearFake payload delivery domain (confidence level: 100%)
rfz.snareplum.ruClearFake payload delivery domain (confidence level: 100%)
pkxq.gl1tchloam.ruClearFake payload delivery domain (confidence level: 100%)
xc2i.gl1tchloam.ruClearFake payload delivery domain (confidence level: 100%)
sp5.gl1tchloam.ruClearFake payload delivery domain (confidence level: 100%)

URLs 16

https://exoduwallet.io/exodus.exeUnknown RAT payload delivery URL (confidence level: 100%)
https://sotavpn.shop/Unknown malware payload delivery URL (confidence level: 90%)
http://towerbingobongoboom.com:8080/updater?for=72cfa65519c25a05c2556fcc010387fcUnknown malware botnet C2 (confidence level: 100%)
https://smtp.xn--80adx0bza.xn--80aphgvco4b.xn--p1ai/Unknown malware payload delivery URL (confidence level: 90%)
https://theinvestworthy.com/Unknown malware payload delivery URL (confidence level: 90%)
https://romeroaktorpalimpsest.com/16836-near-war-veteran-memorial-parkUnknown Stealer botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561199877608270/Unknown Stealer botnet C2 (confidence level: 100%)
http://w2li.xyz/healthUnknown malware botnet C2 (confidence level: 100%)
http://w2li.xyz/connUnknown malware botnet C2 (confidence level: 100%)
http://w2li.xyz/8f42fdde60222ec1.nodeUnknown malware botnet C2 (confidence level: 100%)

IP addresses 87

109.123.227.146Remcos botnet C2 server (confidence level: 100%)
31.56.27.19SectopRAT botnet C2 server (confidence level: 100%)
3.85.108.239Meterpreter botnet C2 server (confidence level: 100%)
199.101.111.88Meterpreter botnet C2 server (confidence level: 100%)
89.111.149.164Unknown malware botnet C2 server (confidence level: 100%)
13.213.128.58Unknown malware botnet C2 server (confidence level: 100%)
45.13.225.72Mirai botnet C2 server (confidence level: 80%)
156.234.145.52Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.101.168Cobalt Strike botnet C2 server (confidence level: 100%)
149.104.30.242Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 1

Unknown RAT payload (confidence level: 100%)

01dc573ef5281f437fc225ccb0b47e2b5a54802b6f43798137be90ca5ef3ca52

Description

ThreatFox IOCs for 2025-12-14

Impact

Given the lack of specific affected systems, exploits, or vulnerabilities, the direct impact on European organizations is likely minimal. The information may assist security teams in enhancing their threat intelligence capabilities by updating IOC databases and improving detection of malware-related network activity. However, without actionable indicators or known exploits, the threat does not currently pose a significant risk to confidentiality, integrity, or availability of systems. European organizations relying on OSINT feeds like ThreatFox can benefit from this data to maintain situational awareness but should not expect immediate operational impact. The medium severity rating suggests a need for vigilance but not urgent remediation.

Defensive guidance

Organizations should integrate ThreatFox IOCs into their existing threat intelligence platforms and security information and event management (SIEM) systems to enhance detection capabilities. Regularly updating IOC feeds and correlating them with internal logs can improve early warning of potential malware activity. Network monitoring should focus on unusual payload delivery patterns and suspicious network activity consistent with the categories described. Since no patches or specific vulnerabilities are identified, emphasis should be placed on maintaining robust endpoint protection, network segmentation, and anomaly detection. Security teams should also engage in continuous OSINT gathering and analysis to contextualize these IOCs within broader threat landscapes. Collaboration with national and European cybersecurity centers can provide additional insights and validation.

Community reviews

Loading reviews…