IndicatorPublished 27 Dec 2025Updated 28 Dec 2025

ThreatFox IOCs for 2025-12-27

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 144

koz7.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
koz9.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
koz3.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
koz4.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
koz6.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
koz8.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
teklynx.eu.comAsyncRAT botnet C2 domain (confidence level: 100%)
q.ciberseguridad-eia.xyzUnknown malware botnet C2 domain (confidence level: 100%)
x9ka4m3w.quartz-punch.ruClearFake payload delivery domain (confidence level: 100%)
d9o15ky4.quartz-punch.ruClearFake payload delivery domain (confidence level: 100%)

URLs 28

https://35.183.218.216/Unknown malware payload delivery URL (confidence level: 90%)
https://72.62.20.196/Unknown malware payload delivery URL (confidence level: 90%)
https://157.230.182.134/Unknown malware payload delivery URL (confidence level: 90%)
https://195.15.215.249/Unknown malware payload delivery URL (confidence level: 90%)
https://206.189.236.65/Unknown malware payload delivery URL (confidence level: 90%)
https://64.23.172.46/Unknown malware payload delivery URL (confidence level: 90%)
https://152.42.225.73/Unknown malware payload delivery URL (confidence level: 90%)
https://45.79.202.83/Unknown malware payload delivery URL (confidence level: 90%)
https://148.113.205.94/Unknown malware payload delivery URL (confidence level: 90%)
http://178.236.252.42Stealc botnet C2 (confidence level: 100%)

IP addresses 159

46.151.182.229Mirai botnet C2 server (confidence level: 80%)
217.156.122.82Stealc botnet C2 server (confidence level: 100%)
95.164.123.123Stealc botnet C2 server (confidence level: 100%)
62.164.177.35Stealc botnet C2 server (confidence level: 100%)
1.12.231.30Cobalt Strike botnet C2 server (confidence level: 100%)
43.201.53.65Cobalt Strike botnet C2 server (confidence level: 100%)
47.105.55.111Cobalt Strike botnet C2 server (confidence level: 100%)
8.217.97.238Unknown malware botnet C2 server (confidence level: 100%)
95.9.236.229AsyncRAT botnet C2 server (confidence level: 100%)
188.93.233.106AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-27

Impact

For European organizations, the impact of this threat could manifest as increased exposure to malware delivered through network-based vectors informed by OSINT techniques. Such payload delivery mechanisms can lead to unauthorized access, data exfiltration, or disruption of services depending on the malware's capabilities. The medium severity rating suggests a moderate risk level, with potential impacts on confidentiality and integrity if payloads successfully compromise systems. Given the lack of known exploits and patches, organizations may face challenges in preemptively defending against this threat without updated intelligence. The threat could particularly affect sectors relying heavily on open-source intelligence for operational purposes or those with extensive network exposure. Disruption or compromise could lead to reputational damage, regulatory penalties under GDPR if personal data is involved, and operational downtime. The absence of detailed indicators means that detection and response may rely heavily on heuristic and behavioral analysis rather than signature-based methods. European entities with critical infrastructure or high-value data assets could be targeted for reconnaissance and subsequent payload delivery, amplifying potential impacts.

Defensive guidance

1. Integrate ThreatFox and other OSINT threat intelligence feeds into Security Information and Event Management (SIEM) systems to enhance detection capabilities for emerging IOCs. 2. Employ advanced network monitoring tools capable of detecting anomalous payload delivery activity, including deep packet inspection and behavioral analytics. 3. Conduct regular threat hunting exercises focused on OSINT-driven attack vectors and payload delivery patterns. 4. Harden network perimeter defenses by implementing strict egress and ingress filtering, segmentation, and zero-trust principles to limit lateral movement. 5. Train security teams to recognize OSINT exploitation tactics and incorporate this knowledge into incident response playbooks. 6. Maintain up-to-date endpoint detection and response (EDR) solutions with heuristic and anomaly detection capabilities to identify novel malware behaviors. 7. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts on evolving threats. 8. Since no patches are available, emphasize proactive detection and containment rather than reliance on vulnerability remediation. 9. Regularly review and update OSINT usage policies to minimize exposure to adversary reconnaissance. 10. Implement multi-factor authentication and strict access controls to reduce the impact of potential payload delivery compromises.

Community reviews

Loading reviews…