IndicatorPublished 18 Dec 2025Updated 19 Dec 2025

ThreatFox IOCs for 2025-12-18

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 190

pepgauge.comUnknown malware botnet C2 domain (confidence level: 100%)
pegasustour.ruUnknown malware botnet C2 domain (confidence level: 100%)
egepefr.ruUnknown malware botnet C2 domain (confidence level: 100%)
14emeliaterracewestroxburyma02132.suUnknown malware botnet C2 domain (confidence level: 100%)
1ay20.lightst0rm.ruClearFake payload delivery domain (confidence level: 100%)
vg.lightst0rm.ruClearFake payload delivery domain (confidence level: 100%)
delta.lightst0rm.ruClearFake payload delivery domain (confidence level: 100%)
e97hx.stormf0rm.ruClearFake payload delivery domain (confidence level: 100%)
2887k.stormf0rm.ruClearFake payload delivery domain (confidence level: 100%)
xx.stormf0rm.ruClearFake payload delivery domain (confidence level: 100%)

URLs 27

https://138.226.237.34/Vidar botnet C2 (confidence level: 100%)
http://196.251.107.4/h8jfdmdws/login.phpAmadey botnet C2 (confidence level: 100%)
https://138.226.236.31/Vidar botnet C2 (confidence level: 100%)
https://fortwaynejubileebrontide.com/category%3aamerican_schoolteachersUnknown Stealer botnet C2 (confidence level: 100%)
https://mail.physioxrsize.nl/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.avomawealth.com/Unknown malware payload delivery URL (confidence level: 90%)
https://steamcommunity.com/profiles/76561198759765485Vidar botnet C2 (confidence level: 100%)
https://telegram.me/gal17dVidar botnet C2 (confidence level: 100%)
https://ala.marcialongman.com.br/Vidar botnet C2 (confidence level: 100%)
https://ala.cimansazan.top/Vidar botnet C2 (confidence level: 100%)

IP addresses 203

138.226.237.34Vidar botnet C2 server (confidence level: 100%)
5.59.248.136Mirai botnet C2 server (confidence level: 80%)
138.226.236.31Vidar botnet C2 server (confidence level: 100%)
107.189.20.32SectopRAT botnet C2 server (confidence level: 100%)
62.60.135.76SectopRAT botnet C2 server (confidence level: 100%)
185.39.19.89SectopRAT botnet C2 server (confidence level: 100%)
62.204.41.230SectopRAT botnet C2 server (confidence level: 100%)
62.164.177.110SectopRAT botnet C2 server (confidence level: 100%)
62.234.98.218Quasar RAT botnet C2 server (confidence level: 100%)
144.86.4.160NetSupportManager RAT botnet C2 server (confidence level: 100%)

Hashes 32

887747dc1687953902488489b805d965Mirai payload (confidence level: 100%)
b688c22aabcd83138bba4afb9b3ef4fcMirai payload (confidence level: 100%)
2fd5481e9d20dad6d27e320d5464f71eMirai payload (confidence level: 100%)
5f4ed952e69abb337f9405352cb5cc05Mirai payload (confidence level: 100%)
4cd750f32ee5d4f9e335751ae992ce64Mirai payload (confidence level: 100%)
8011ed1d1851c6ae31274c2ac8edfc06Mirai payload (confidence level: 100%)
95efbc9fdc5c7bcbf469de3a0cc35699Mirai payload (confidence level: 100%)
bda398fcd6da2ddd4c756e7e7c47f8d8Mirai payload (confidence level: 100%)
ea7e4930b7506c1a5ca7fee10547ef6bMirai payload (confidence level: 100%)
dfe8d1f591d53259e573b98acb178e84Mirai payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-18

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of specific exploit details or confirmed active campaigns. However, organizations that utilize OSINT tools or rely heavily on network-based payload delivery mechanisms could be at risk of targeted malware infections if threat actors successfully leverage these IOCs. Potential impacts include unauthorized access, data exfiltration, or disruption of network services if payload delivery leads to successful compromise. The absence of patches or known exploits suggests that mitigation relies on detection and prevention rather than remediation. European critical infrastructure, government agencies, and enterprises with significant network exposure or OSINT operations should consider this threat as a cautionary indicator to enhance monitoring and incident response capabilities. The medium severity reflects the potential for impact without current evidence of widespread exploitation.

Defensive guidance

1. Integrate ThreatFox and other threat intelligence feeds into Security Information and Event Management (SIEM) systems to improve detection of related IOCs. 2. Enhance network traffic monitoring and anomaly detection to identify unusual payload delivery attempts, especially those leveraging OSINT-derived targeting. 3. Conduct regular threat hunting exercises focusing on network activity and payload delivery vectors. 4. Implement strict network segmentation and access controls to limit the spread of potential malware infections. 5. Train security teams on emerging OSINT-related threats and encourage sharing of intelligence within trusted communities. 6. Maintain up-to-date endpoint detection and response (EDR) solutions capable of identifying suspicious payload execution. 7. Develop and test incident response plans that include scenarios involving OSINT-driven malware delivery. 8. Collaborate with national cybersecurity centers and CERTs to receive timely updates and guidance on evolving threats.

Community reviews

Loading reviews…