MalwarePublished 20 Feb 2026

tlp clear · Maltrail IOC for 2026-02-20

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

This entry describes a Maltrail Indicator of Compromise (IOC) dated February 20, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions, exploits in the wild, or patches are identified. The information is derived from open-source intelligence and manual collection methods, indicating ongoing monitoring rather than a newly discovered vulnerability or active exploit. The lack of technical details and indicators limits actionable insights. Organizations should consider this as a medium-risk observation that may reflect suspicious network behavior but does not currently represent an active or widespread threat. Vigilance in network monitoring and threat intelligence correlation is advised. Given the absence of exploit details and patch availability, the suggested severity is medium.

Impact

The potential impact of this IOC is moderate, as it indicates the presence or detection of malware-related network activity that could compromise organizational networks. If the underlying malware or suspicious activity is part of a broader campaign, it could lead to unauthorized data access, disruption of services, or lateral movement within networks. However, the lack of specific exploit details, affected products, or active exploitation reduces the immediate risk. Organizations worldwide could experience increased alert volumes and the need for enhanced network monitoring to identify related activity. The impact is primarily on network security operations and incident response teams, who must analyze and correlate this IOC with other intelligence to determine relevance. Without actionable indicators, the direct operational impact is limited, but ignoring such intelligence could allow stealthy malware activity to persist undetected, potentially leading to data breaches or service interruptions over time.

Defensive guidance

Organizations should integrate this IOC into their existing network monitoring and threat intelligence platforms to enhance detection capabilities. Specific mitigation steps include: 1) Updating Maltrail and other network detection systems with the latest threat intelligence feeds to identify related suspicious traffic. 2) Conducting thorough network traffic analysis to detect anomalies or patterns consistent with malware activity. 3) Correlating this IOC with internal logs, endpoint detection systems, and other threat intelligence to identify potential compromises. 4) Implementing strict network segmentation and access controls to limit malware propagation. 5) Enhancing incident response readiness to investigate and contain any detected malicious activity promptly. 6) Maintaining up-to-date security awareness training to reduce risk from malware infection vectors. Since no patches or direct exploits are associated, focus should be on detection, monitoring, and response rather than remediation of a specific vulnerability. Regular review and tuning of detection rules based on evolving intelligence will improve resilience against such threats.

Summary

The provided data represents an IOC related to malware activity detected and reported via the Maltrail system on February 20, 2026. Maltrail is a network traffic detection system that identifies suspicious or malicious network activity by analyzing traffic patterns and known threat indicators. This IOC is sourced from the CIRCL OSINT feed, which aggregates open-source intelligence for threat detection and analysis. The entry is tagged with 'medium' severity and classified under malware and network activity categories, suggesting the detection of potentially malicious network behavior rather than a specific vulnerability or exploit. No affected software versions or patches are listed, indicating that this IOC is likely related to observed network traffic patterns or signatures rather than a software flaw. The absence of known exploits in the wild further implies that this is an intelligence observation rather than an active attack campaign. The technical details provided are minimal, with only a UUID and a timestamp, and no concrete indicators such as IP addresses, domains, or file hashes are included. This limits the ability to perform direct detection or mitigation actions based solely on this IOC. The medium severity rating reflects a moderate level of concern, likely due to the potential for malware-related network activity to impact confidentiality or availability if exploited. The data is intended for use in threat intelligence correlation and network monitoring to detect and respond to suspicious activity proactively.

Indicators of compromise

Domains 2,068

cloudaxis.ccvidar
khantym.cyoulummac2
salivae.cyoulummac2
swederq.cyoulummac2
transpd.cyoulummac2
cry-volt-razvdv.comfakeapp
linkfort-razvdkk.comfakeapp
wexmri.ccastarionrat
d15mawx0xveem1.cloudfront.netastarionrat
backupdailyawss.s3.us-east-1.amazonaws.comastarionrat

URLs 41

https://api.github.com/repos/stamparm/maltrail/commits/3b4953b8fb70b622ea1a4f51ce29a17879374e18vidar
https://x.com/smica83/status/2023443500390645805vidar
https://x.com/Cyber0verload/status/2024480279591612532vidar
https://www.virustotal.com/gui/file/82e5a4dc50e843bf58e57c4e89f25123ef3a25f39e990a855fd5718e248b2d91/detectionvidar
https://api.github.com/repos/stamparm/maltrail/commits/33af5cab699e194c6a81aba5104696ef9fa2e008sliver
https://x.com/skocherhan/status/2024493246823424442sliver
https://api.github.com/repos/stamparm/maltrail/commits/29dc50e897df1b77e699519910d66ee2260d3d09xworm
https://x.com/K_N1kolenko/status/2024447659717562445xworm
https://api.github.com/repos/stamparm/maltrail/commits/dc24d6ccec43639baba5b60add75ca765d2c58fesliver
https://x.com/skocherhan/status/2024495342985584777sliver

IP addresses 81

94.242.52.115sliver
103.163.219.252xworm
103.83.87.178xworm
134.122.140.89xworm
134.122.152.135xworm
134.122.154.171xworm
141.11.213.91xworm
147.45.45.110xworm
193.233.113.137xworm
198.23.177.219xworm

Community reviews

Loading reviews…