IndicatorPublished 20 Dec 2025Updated 21 Dec 2025

ThreatFox IOCs for 2025-12-20

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 159

cm88.gb.netAsyncRAT botnet C2 domain (confidence level: 75%)
mx1.sa.comAsyncRAT botnet C2 domain (confidence level: 100%)
giftingbuddy.in.netQuasar RAT botnet C2 domain (confidence level: 100%)
egestx.ru.comAsyncRAT botnet C2 domain (confidence level: 100%)
aref.co.comQuasar RAT botnet C2 domain (confidence level: 100%)
muk3av.cr1pptit2n.ruClearFake payload delivery domain (confidence level: 100%)
hirqat.cr1pptit2n.ruClearFake payload delivery domain (confidence level: 100%)
vesnug.cr1pptit2n.ruClearFake payload delivery domain (confidence level: 100%)
ryfkel.cl0udmist.ruClearFake payload delivery domain (confidence level: 100%)
vilqon.cl0udmist.ruClearFake payload delivery domain (confidence level: 100%)

URLs 3

http://107.172.75.201:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://45.131.184.34/botCpuminer payload delivery URL (confidence level: 50%)
http://taymurazwarclavow.space:8080/updater?for=81d1b730207b50bc16231686b723b33fUnknown malware botnet C2 (confidence level: 100%)

IP addresses 78

117.72.220.129Cobalt Strike botnet C2 server (confidence level: 100%)
38.55.99.179Cobalt Strike botnet C2 server (confidence level: 100%)
123.60.15.107Cobalt Strike botnet C2 server (confidence level: 100%)
163.5.149.126Remcos botnet C2 server (confidence level: 100%)
165.154.225.249Sliver botnet C2 server (confidence level: 100%)
106.15.124.100Sliver botnet C2 server (confidence level: 100%)
124.221.196.251Unknown malware botnet C2 server (confidence level: 100%)
103.158.37.31Unknown malware botnet C2 server (confidence level: 100%)
158.94.208.111AsyncRAT botnet C2 server (confidence level: 100%)
102.117.173.78Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-20

Impact

Given the limited technical details and absence of known exploits, the immediate impact on European organizations is likely low to medium. The threat's focus on OSINT and network activity suggests it may be used for reconnaissance or as a precursor to more targeted attacks, potentially enabling adversaries to gather intelligence or deliver payloads in later stages. If leveraged effectively, it could compromise confidentiality by exposing sensitive information or facilitate integrity and availability attacks through payload delivery. However, without specific exploitation data or affected systems, the direct operational impact remains uncertain. European organizations relying heavily on network monitoring, threat intelligence platforms, or OSINT tools may experience increased exposure or false positives. The medium severity rating indicates a moderate risk level, warranting vigilance but not immediate alarm. The lack of patches or exploits in the wild reduces urgency but underscores the importance of proactive threat intelligence integration and network defense readiness.

Defensive guidance

1. Enhance OSINT and network monitoring capabilities to detect unusual or suspicious activity related to payload delivery or reconnaissance. 2. Integrate ThreatFox and similar threat intelligence feeds into Security Information and Event Management (SIEM) systems to correlate and analyze emerging indicators once available. 3. Conduct regular threat hunting exercises focusing on network activity anomalies and potential early-stage malware indicators. 4. Maintain up-to-date endpoint detection and response (EDR) solutions capable of identifying unknown or emerging malware behaviors. 5. Train security teams on interpreting OSINT-related threat intelligence to improve contextual understanding and response prioritization. 6. Implement strict network segmentation and least privilege access controls to limit potential lateral movement if payload delivery occurs. 7. Prepare incident response plans that include scenarios involving OSINT-driven reconnaissance and payload delivery tactics. 8. Collaborate with information sharing communities to receive timely updates and share findings related to this threat. These measures go beyond generic advice by focusing on proactive intelligence integration, behavioral detection, and organizational preparedness tailored to OSINT and network activity threats.

Community reviews

Loading reviews…