IndicatorPublished 23 Dec 2025Updated 24 Dec 2025

ThreatFox IOCs for 2025-12-23

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 273

husnikmeat.comKongTuke payload delivery domain (confidence level: 100%)
ourasolid.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
positivelike.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
setup.digitalpointsec.orgUnknown malware botnet C2 domain (confidence level: 100%)
rentalsmcx.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
nyfqeg.f0undoutw2y.ruClearFake payload delivery domain (confidence level: 100%)
juzmat.f0undoutw2y.ruClearFake payload delivery domain (confidence level: 100%)
sorxep.f0undoutw2y.ruClearFake payload delivery domain (confidence level: 100%)
vaklid.f0undoutw2y.ruClearFake payload delivery domain (confidence level: 100%)
gipqen.f0undoutw2y.ruClearFake payload delivery domain (confidence level: 100%)

URLs 33

https://husnikmeat.com/1q1q.jsKongTuke payload delivery URL (confidence level: 100%)
https://husnikmeat.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://ourasolid.com/websockets/local-storage.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://ourasolid.com/websockets/service.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://ourasolid.com/websockets/session.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://positivelike.com/porscheNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://positivelike.com/documentNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://77.90.60.32/123.txtNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://77.90.60.32/y.greNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://ruzeda.com/blogs/drafts/publish/schedule/seosso/login/mfa/verify/token/refresh/ips/blocklist/whitelistHavoc botnet C2 (confidence level: 100%)

IP addresses 130

178.17.59.22Stealc botnet C2 server (confidence level: 100%)
37.221.66.166Stealc botnet C2 server (confidence level: 100%)
80.97.160.144Stealc botnet C2 server (confidence level: 100%)
77.110.123.23Stealc botnet C2 server (confidence level: 100%)
172.81.133.178Cobalt Strike botnet C2 server (confidence level: 100%)
187.112.166.26Venom RAT botnet C2 server (confidence level: 100%)
13.220.120.137Unknown malware botnet C2 server (confidence level: 100%)
47.236.96.178Unknown malware botnet C2 server (confidence level: 100%)
34.71.69.185Unknown malware botnet C2 server (confidence level: 100%)
196.188.250.153Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-23

Impact

For European organizations, the impact of this threat is currently limited due to the absence of active exploits and specific affected products or versions. However, the presence of payload delivery and network activity indicators implies potential risks of malware infiltration or data exfiltration if such IOCs are leveraged by threat actors. Organizations relying heavily on OSINT tools or with extensive network infrastructures might experience increased reconnaissance or targeted attacks if adversaries use these IOCs to refine their tactics. The medium severity rating suggests moderate risk, primarily from potential future exploitation or as part of broader attack campaigns. Without patches or direct exploits, the immediate operational impact is low, but failure to incorporate these IOCs into detection systems could delay identification of malicious activity. Additionally, the lack of detailed indicators means some attacks could evade detection if organizations do not maintain updated threat intelligence feeds and network monitoring capabilities.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. Regularly updating threat intelligence feeds and correlating them with internal logs will improve early warning capabilities. Network segmentation and strict egress filtering can limit the impact of potential payload delivery and data exfiltration. Conducting threat hunting exercises focused on OSINT-related indicators and unusual network behaviors can proactively identify suspicious activity. Since no patches are available, emphasis should be placed on behavioral detection and anomaly monitoring rather than signature-based defenses alone. Training security analysts to recognize patterns associated with OSINT-driven malware campaigns will also improve response times. Finally, maintaining robust incident response plans that incorporate intelligence feed updates ensures preparedness for emerging threats.

Community reviews

Loading reviews…