IndicatorPublished 17 Dec 2025Updated 18 Dec 2025

ThreatFox IOCs for 2025-12-17

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 173

ctdrpu.za.comQuasar RAT botnet C2 domain (confidence level: 100%)
qq88one.us.comQuasar RAT botnet C2 domain (confidence level: 100%)
citystore.in.netQuasar RAT botnet C2 domain (confidence level: 100%)
trace.his5isappe2r.ruClearFake payload delivery domain (confidence level: 100%)
gloss.his5isappe2r.ruClearFake payload delivery domain (confidence level: 100%)
vapor6.his5isappe2r.ruClearFake payload delivery domain (confidence level: 100%)
axiom.go0dsc1ence.ruClearFake payload delivery domain (confidence level: 100%)
logic7.go0dsc1ence.ruClearFake payload delivery domain (confidence level: 100%)
proof.go0dsc1ence.ruClearFake payload delivery domain (confidence level: 100%)
lemma.go0dsc1ence.ruClearFake payload delivery domain (confidence level: 100%)

URLs 25

http://114.132.217.187:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://tenjin-central.com/Unknown malware payload delivery URL (confidence level: 90%)
http://198.46.216.206:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://usanovafoundation.org/Unknown malware payload delivery URL (confidence level: 90%)
https://lead-mc.jp/Unknown malware payload delivery URL (confidence level: 90%)
http://fedoramaginoracura.site:8080/updater?for=5120d3fedd36eac912db54c863ce59bbUnknown malware botnet C2 (confidence level: 100%)
https://www.vpnathan-partners.com.my/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.vanguartagency.com/Unknown malware payload delivery URL (confidence level: 90%)
https://xsw.chadamaite.com/Vidar botnet C2 (confidence level: 100%)
https://xsw.asrkala.top/Vidar botnet C2 (confidence level: 100%)

IP addresses 305

147.45.211.80Stealc botnet C2 server (confidence level: 100%)
198.46.216.206Unknown malware botnet C2 server (confidence level: 100%)
91.92.243.68Mirai botnet C2 server (confidence level: 80%)
154.64.255.46Ghost RAT botnet C2 server (confidence level: 100%)
45.88.186.144Remcos botnet C2 server (confidence level: 100%)
192.227.219.74Remcos botnet C2 server (confidence level: 100%)
159.89.16.145SectopRAT botnet C2 server (confidence level: 100%)
185.11.61.223SectopRAT botnet C2 server (confidence level: 100%)
185.11.61.146SectopRAT botnet C2 server (confidence level: 100%)
167.172.173.18Venom RAT botnet C2 server (confidence level: 100%)

Hashes 1

Lumma Stealer payload (confidence level: 50%)

aa906c2070071ecc2c906328ed0de890e5c955fef901ded3f9d314b9a9489bbf

Description

ThreatFox IOCs for 2025-12-17

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active campaigns. However, if these IOCs correspond to emerging malware campaigns, they could lead to network infiltration, data exfiltration, or service disruption. Organizations relying heavily on OSINT for threat detection or those with critical network infrastructure could face increased risk if attackers leverage these indicators to bypass defenses. The medium severity rating implies moderate risk to confidentiality and availability, particularly if payload delivery mechanisms are successful. Since no patches or fixes are available, organizations must rely on detection and prevention controls. The broad nature of the threat means that impact could vary widely depending on the sector and security posture of individual organizations. Proactive monitoring and integration of these IOCs into security tools can reduce potential damage.

Defensive guidance

1. Integrate the provided IOCs into existing SIEM, IDS/IPS, and endpoint detection and response (EDR) systems to enhance detection capabilities. 2. Increase network traffic monitoring for unusual or suspicious payload delivery patterns consistent with OSINT-derived malware campaigns. 3. Conduct regular threat hunting exercises focusing on the behaviors indicated by the ThreatFox feed. 4. Maintain updated threat intelligence feeds and collaborate with information sharing groups to receive timely updates. 5. Harden network perimeter defenses and apply strict egress filtering to limit potential data exfiltration. 6. Educate security teams on interpreting OSINT-based threat intelligence to improve response times. 7. Since no patches are available, emphasize layered security controls and rapid incident response procedures. 8. Validate and test detection rules regularly to ensure they effectively identify related malicious activity. 9. Employ network segmentation to contain potential infections and limit lateral movement. 10. Review and update incident response plans to incorporate scenarios involving OSINT-driven malware threats.

Community reviews

Loading reviews…