IndicatorPublished 15 Dec 2025Updated 16 Dec 2025

ThreatFox IOCs for 2025-12-15

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 249

tvm-systems.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
api.livesquare.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
download.livesquare.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
img.livesquare.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
log.livesquare.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
mail.livesquare.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
trh.uk.comQuasar RAT botnet C2 domain (confidence level: 75%)
revounecses.runHook botnet C2 domain (confidence level: 100%)
fog.mistybr1dge.ruClearFake payload delivery domain (confidence level: 100%)
truss.mistybr1dge.ruClearFake payload delivery domain (confidence level: 100%)

URLs 123

http://94.156.119.187/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://45.148.8.121:5000/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://euob.youstarsbuilding.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://obseu.youstarsbuilding.com/ns/636f8b858f681acb7bfa6f583a96630a.html?ch=adsdeli%20-%20iframeFAKEUPDATES payload delivery URL (confidence level: 100%)
https://jewelryexchange.comFAKEUPDATES payload delivery URL (confidence level: 100%)
https://annietello.com/Unknown malware payload delivery URL (confidence level: 90%)
https://gaines-kg.jp/Unknown malware payload delivery URL (confidence level: 90%)
https://odeon-gongen.com/shopdetail/364/111299347Unknown malware payload delivery URL (confidence level: 90%)
https://knowledgemomentum-net.moneymaking-opportunities.com/Unknown malware payload delivery URL (confidence level: 90%)
https://shinsenkaku-osaka.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 135

45.148.8.121Unknown malware botnet C2 server (confidence level: 100%)
82.22.184.127Mirai botnet C2 server (confidence level: 80%)
23.235.174.8Cobalt Strike botnet C2 server (confidence level: 100%)
172.245.93.89Remcos botnet C2 server (confidence level: 100%)
176.117.107.202Remcos botnet C2 server (confidence level: 100%)
18.158.60.15Sliver botnet C2 server (confidence level: 100%)
179.95.160.102NetSupportManager RAT botnet C2 server (confidence level: 100%)
217.60.249.120AdaptixC2 botnet C2 server (confidence level: 100%)
23.105.252.167AdaptixC2 botnet C2 server (confidence level: 100%)
199.101.111.47Meterpreter botnet C2 server (confidence level: 100%)

Hashes 147

682ea50cbac6d4c47858bccf7baa7b356d85265eValleyRAT payload (confidence level: 95%)
d08c07e7a8a7ffeb5e3e1ee417ec7b292f00a72920768915bf964efce66d2482ValleyRAT payload (confidence level: 95%)
5c8bea324b7bb8a41976cc0e4b6c2dadValleyRAT payload (confidence level: 95%)
457abbfc3fbca0a3e22cf1be695c94dc089236e6Vidar payload (confidence level: 95%)
c0fea10495f260c2343db21e874b691b594204773b84d5f50f8083e53810adfbVidar payload (confidence level: 95%)
847d65e755ad8d1dacc351b2e2a66ebdVidar payload (confidence level: 95%)
11e80251f14902a18b9b0786fd82f293760afa52NimGrabber payload (confidence level: 95%)
639e0c6a4c6a4864c73ed5836bc9578cb5272d94d0b133d73b339cfcf8eced5fNimGrabber payload (confidence level: 95%)
22f04c393c9030f346c45ba75a73b6fcNimGrabber payload (confidence level: 95%)
0299e1f0b09a2f30212ee5c12961ae343a7b6e8bQuasar RAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-15

Impact

For European organizations, the primary impact of this threat lies in potential unauthorized network access and payload delivery that could compromise confidentiality and availability. Since the threat involves OSINT and network activity, attackers may leverage publicly available information to tailor attacks, increasing their success rate. Payload delivery could lead to malware infections, data exfiltration, or service disruptions. The absence of known exploits and patches suggests the threat is in reconnaissance or early delivery stages, but if successful, it could escalate to more severe impacts such as ransomware or data breaches. Organizations relying heavily on networked infrastructure and exposed services are at higher risk. The medium severity indicates moderate risk but warrants attention to prevent escalation. Disruption to critical infrastructure, financial institutions, and government agencies in Europe could have broader socio-economic consequences.

Defensive guidance

European organizations should implement advanced network monitoring and anomaly detection to identify unusual payload delivery attempts and reconnaissance activities. Integrating OSINT-based threat intelligence feeds like ThreatFox into security information and event management (SIEM) systems can improve detection capabilities. Employ strict network segmentation and enforce least privilege access to limit lateral movement if payload delivery succeeds. Deploy next-generation firewalls and intrusion prevention systems with updated signatures to block known malicious payloads. Conduct regular threat hunting exercises focusing on network activity patterns associated with OSINT-driven attacks. Enhance employee awareness about social engineering and spear-phishing tactics that may accompany payload delivery. Since no patches are available, focus on hardening network defenses and timely incident response planning. Collaborate with national cybersecurity centers to share intelligence and coordinate defenses against emerging threats.

Community reviews

Loading reviews…