MalwarePublished 21 Feb 2026

tlp clear · Maltrail IOC for 2026-02-21

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

The Maltrail IOC for 2026-02-21 is an open-source intelligence (OSINT) observation related to malware network activity, published by CIRCL. It is classified as a medium-risk threat with no specific affected versions or known exploits in the wild. The information is derived from manual collection and is intended for broad, unsupervised automation use. No patches or direct remediation links are available, indicating this is primarily an intelligence feed rather than a vulnerability or active exploit. The threat relates to network activity patterns detected by Maltrail, a network traffic detection system. Due to the lack of detailed technical indicators or exploit data, the threat's impact is assessed as medium, with potential risks to network monitoring and detection capabilities. Organizations relying on Maltrail or similar network monitoring tools should remain vigilant and integrate this IOC into their threat detection processes. Countries with significant internet infrastructure and cybersecurity monitoring deployments are more likely to be affected. The threat does not require authentication or user interaction for detection but also lacks evidence of active exploitation, leading to a medium severity rating.

Impact

The impact of this threat is primarily on the detection and monitoring capabilities of organizations rather than direct compromise or disruption. If integrated effectively, the IOC can improve the identification of malware-related network activity, enabling faster incident response and mitigation. However, without specific exploit details or active attack campaigns, the immediate risk to confidentiality, integrity, or availability is limited. Organizations that do not incorporate such threat intelligence may experience delayed detection of malware infections or network intrusions. The medium severity suggests a moderate risk level, where the threat intelligence can contribute to enhanced situational awareness but does not represent an urgent or critical vulnerability. The lack of patches or exploits means the threat is informational and preventative rather than reactive to an active attack vector.

Defensive guidance

Organizations should incorporate this IOC into their existing network monitoring and intrusion detection systems, such as Maltrail or other traffic analysis tools, to enhance detection of suspicious network behavior. Regularly update threat intelligence feeds and automate the ingestion of such IOCs to maintain current situational awareness. Conduct network traffic baselining to identify anomalies that may correlate with the IOC indicators. Employ network segmentation and strict egress filtering to limit potential malware communication channels. Train security operations teams to recognize and respond to alerts generated by these IOCs promptly. Since no patches are available, focus on proactive detection and incident response capabilities. Additionally, collaborate with threat intelligence sharing communities to receive updates and context on evolving threats related to this IOC. Finally, ensure logging and monitoring infrastructure is robust and capable of correlating network events with threat intelligence data.

Summary

The provided information describes a Maltrail Indicator of Compromise (IOC) dated 2026-02-21, sourced from the CIRCL OSINT feed. Maltrail is a network traffic detection system that identifies suspicious or malicious network activity by analyzing traffic patterns and known threat indicators. This IOC is categorized as malware-related network activity but lacks detailed technical indicators such as IP addresses, domain names, or file hashes. No specific affected software versions are listed, and there are no known exploits in the wild associated with this IOC. The data is collected manually and intended for unsupervised automation, suggesting it is part of ongoing threat intelligence gathering rather than a direct vulnerability or exploit. The absence of patch information and CWE identifiers further indicates this is an observational threat intelligence entry rather than a software flaw. The medium severity classification reflects the potential for this IOC to assist in detecting malicious network behavior but also highlights the limited immediate risk due to the lack of active exploitation evidence. This IOC can be integrated into network security monitoring tools to enhance detection capabilities against malware-related traffic anomalies.

Indicators of compromise

Domains 2,214

ejklljkemcbkhjj.topmintsloader
ifgmljcdlgamdkb.topmintsloader
ndyz73aw.topmintsloader
nufyrize3214.topmintsloader
vzzwehy3.topmintsloader
br01.brgovt.nethak5cloud_c2
alpha-centavr.cclummac2
hewwbkp.cyoulummac2
ingraiv.cyoulummac2
app.weboardtals.comapt_lazarus

URLs 28

https://api.github.com/repos/stamparm/maltrail/commits/f616385947f229420a2911feee38785b6b4b6eefmintsloader
https://api.github.com/repos/stamparm/maltrail/commits/9ffaaf5903a71f5a4b26507546da3cdcd4a1d9f2hak5cloud_c2
https://api.github.com/repos/stamparm/maltrail/commits/5a3f2bd823b103a287cfab9ad4614a0827d2e1f9lummac2
https://api.github.com/repos/stamparm/maltrail/commits/6cab5ecf6e29fa5d31e17354e472fd2a21d4e032apt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/c93c9cda8433224d0df06a9be56a287f9b9a8a85apt_lazarus
https://www.virustotal.com/gui/ip-address/104.21.15.224/relationsapt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/3c9ffa259882b40a136eceeeb06204b831416a0eek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/d5053c978e6d08fab9b8c8d61aee67ce7b8e3952apt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/bae0c41fff993e8076718fd70edbd8836e557103osx_atomic
https://api.github.com/repos/stamparm/maltrail/commits/e078fb442c735fccfc14aace3f369c72c8cff4a5osx_atomic

IP addresses 1

asyncrat

213.152.161.162

Community reviews

Loading reviews…