IndicatorPublished 30 Dec 2025Updated 31 Dec 2025

ThreatFox IOCs for 2025-12-30

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 282

u888.br.comAsyncRAT botnet C2 domain (confidence level: 100%)
hybrid.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
cst.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
incep.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
perfectfoodcompany.uk.comDCRat botnet C2 domain (confidence level: 100%)
sc88mobi.comAsyncRAT botnet C2 domain (confidence level: 100%)
cd35785969d4cfc6d6b1a6c8a3ae1e92.7c3ba162fb57b914c08ba8a4a3b310a7.traefik.defaultCobalt Strike botnet C2 domain (confidence level: 50%)
clawless-42349.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
wealthandolaedo.ddns.netRemcos botnet C2 domain (confidence level: 100%)
wealthandolaedo1.ddns.netRemcos botnet C2 domain (confidence level: 100%)

URLs 42

https://34.94.210.64/Unknown malware payload delivery URL (confidence level: 90%)
https://85.235.145.247/Unknown malware payload delivery URL (confidence level: 90%)
https://159.89.93.96/Unknown malware payload delivery URL (confidence level: 90%)
http://45.221.97.89:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://34.60.93.120/Unknown malware payload delivery URL (confidence level: 90%)
https://67.205.182.255/Unknown malware payload delivery URL (confidence level: 90%)
https://143.110.235.189/Unknown malware payload delivery URL (confidence level: 90%)
https://www.pulse-my-account.com/Unknown malware payload delivery URL (confidence level: 90%)
https://www.account-update-pulse.com/Unknown malware payload delivery URL (confidence level: 90%)
https://accountpulseupdate.com/sign-in/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 317

209.146.113.15Cobalt Strike botnet C2 server (confidence level: 100%)
144.172.112.247Cobalt Strike botnet C2 server (confidence level: 100%)
102.117.171.195Unknown malware botnet C2 server (confidence level: 100%)
94.183.168.33Hook botnet C2 server (confidence level: 100%)
13.61.141.98Unknown malware botnet C2 server (confidence level: 100%)
154.64.255.46Ghost RAT botnet C2 server (confidence level: 100%)
178.16.54.81Remcos botnet C2 server (confidence level: 100%)
195.24.237.124Remcos botnet C2 server (confidence level: 100%)
124.198.132.87Remcos botnet C2 server (confidence level: 100%)
45.143.167.7Sliver botnet C2 server (confidence level: 100%)

Hashes 111

cb549fdc56281787368c23543736f485769a4bd2Remcos payload (confidence level: 95%)
7788726275b4d212ddaa19c37432474ad929827fcb04f42088c6d459733bbb63Remcos payload (confidence level: 95%)
ff46f36343e56268a12e9c412a7b0692Remcos payload (confidence level: 95%)
1cafc0085cac9402d57c381f067bd5ec4d3a94deValleyRAT payload (confidence level: 95%)
144de74f4c10b312aeeb4a8569a68982a02106a3640364261189dd1390f912b5ValleyRAT payload (confidence level: 95%)
7fa4d0b6f5c5fce5f9986754b9729b0bValleyRAT payload (confidence level: 95%)
67b1cb98a90c3aa5a07edbb2b296672dd8b7b972Remcos payload (confidence level: 95%)
17ca4af085fa1e845509a2e7d0bc6f155fff8b1215e001002e3d7704d04e0903Remcos payload (confidence level: 95%)
5c7bab2ded159841142ae243ccd6736eRemcos payload (confidence level: 95%)
47951c262d981384150027b1f7a103aec687cbc9Cobalt Strike payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-30

Impact

For European organizations, this threat could result in unauthorized network activity and potential delivery of malicious payloads, which may lead to data exfiltration, system compromise, or disruption of services. The absence of specific affected products or versions implies a broad or generic threat vector, possibly targeting network infrastructure or endpoints through OSINT-driven campaigns. Organizations relying heavily on OSINT tools or those with extensive network exposure might face increased risk. The medium severity suggests that while the threat is not immediately critical, it could facilitate lateral movement or initial access in multi-stage attacks. Potential impacts include confidentiality breaches if payloads enable data theft, integrity issues if malware modifies data or system configurations, and availability concerns if payloads disrupt network services. The lack of known exploits in the wild reduces immediate risk but does not preclude future exploitation. European entities with critical infrastructure or sensitive data may experience operational and reputational harm if targeted successfully.

Defensive guidance

European organizations should implement enhanced network monitoring to detect unusual payload delivery attempts and network activity consistent with OSINT-driven malware campaigns. Integration of ThreatFox and other threat intelligence feeds into Security Information and Event Management (SIEM) systems can improve detection capabilities. Employing network segmentation and strict access controls can limit the spread of any delivered payloads. Regularly updating and hardening endpoint protection solutions to detect and block malware payloads is essential. Conducting threat hunting exercises focused on network traffic anomalies and potential OSINT exploitation tactics can preempt attacks. Since no patches are available, emphasis should be on detection, containment, and response strategies. Training security teams to recognize OSINT-based reconnaissance and payload delivery patterns will enhance preparedness. Additionally, organizations should review and restrict the use of OSINT tools to trusted sources and monitor for any suspicious activity related to their use.

Community reviews

Loading reviews…