MalwarePublished 22 Feb 2026

tlp clear · Maltrail IOC for 2026-02-22

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

This entry describes a Maltrail Indicator of Compromise (IOC) dated February 22, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium severity rating. The information is based on open-source intelligence (OSINT) and represents an observation rather than a confirmed exploit or active campaign. No specific affected versions, exploits in the wild, or patches are associated with this IOC. The lack of detailed technical indicators or exploit data limits actionable insights. Organizations should consider this as a medium-risk intelligence input for network monitoring and threat detection. The threat does not currently appear to target specific products or regions. Defenders should remain vigilant but note the absence of immediate exploit evidence.

Impact

Given the limited information and absence of known exploits or affected products, the immediate impact of this IOC is primarily in enhancing situational awareness rather than indicating an active widespread threat. Organizations worldwide could potentially observe network traffic patterns matching this IOC, which may indicate malware presence or reconnaissance activity. If detected, it could signal an early stage of compromise or malware infection, enabling defenders to investigate and respond before escalation. However, without specific exploit details or targeted vulnerabilities, the direct impact on confidentiality, integrity, or availability is uncertain. The medium severity rating suggests a moderate risk level, possibly due to the potential for malware-related network activity to lead to data exfiltration or lateral movement if left unmitigated. The lack of patches or exploits indicates this IOC is more of a detection tool than a vulnerability to be remediated. Organizations relying on network monitoring and threat intelligence feeds can use this IOC to improve detection capabilities and reduce dwell time of malware infections.

Defensive guidance

To effectively leverage this IOC, organizations should integrate the Maltrail IOC into their network monitoring and intrusion detection systems to identify suspicious traffic patterns. Deploy network traffic analysis tools capable of ingesting OSINT feeds and correlating alerts with other telemetry such as endpoint detection logs. Conduct regular network traffic baselining to distinguish normal from anomalous activity, improving detection accuracy. Enhance incident response procedures to investigate alerts triggered by this IOC promptly, including traffic capture and forensic analysis. Maintain updated threat intelligence feeds and cross-reference with other sources to enrich context around detected activity. Although no patches are available, ensure all systems are hardened, and malware defenses such as endpoint protection and network segmentation are in place to limit potential spread. Educate security teams on interpreting OSINT-based IOCs and the importance of early detection. Finally, collaborate with threat intelligence sharing communities to receive updates on any evolution of this IOC or related threats.

Summary

The provided data pertains to a Maltrail IOC dated 2026-02-22, sourced from the CIRCL OSINT feed, which is a repository of open-source threat intelligence. Maltrail is a network traffic detection system that identifies suspicious or malicious network activity by analyzing traffic patterns and known indicators. This IOC is classified under malware and network activity categories, indicating it relates to malicious software behavior observable in network traffic. The IOC is tagged with 'medium' severity and is marked as an observation event, suggesting it is a detection or alert rather than a confirmed active threat or exploit. No specific affected software versions or products are listed, and no patches or known exploits are associated, implying this IOC may represent a newly identified or generic malware-related network pattern rather than a targeted vulnerability. The technical details provided are minimal, with only a UUID and a timestamp, and no concrete indicators such as IP addresses, domains, or file hashes are included. The data is collected manually and is intended for perpetual use in threat intelligence. Overall, this IOC serves as a network-based detection signature or alert to assist organizations in identifying potential malware-related network activity, but lacks detailed context or actionable exploit information.

Indicators of compromise

Domains 2,383

kys.com.brosx_phexiabot
kys.momosx_phexiabot
kys.riposx_phexiabot
kys.wikiosx_phexiabot
kys.worksosx_phexiabot
9iu74a51.comandroid_promptspy
a-chase-ar.comandroid_promptspy
a-chase-arg.comandroid_promptspy
anonovo7.comandroid_promptspy
cgju832a.comandroid_promptspy

URLs 42

https://api.github.com/repos/stamparm/maltrail/commits/52bc89e828fc590d52da314551c8ad0818c5c3a9osx_phexiabot
https://github.com/hagezi/dns-blocklists/issues/9203#issuecomment-3940201642osx_phexiabot
https://api.github.com/repos/stamparm/maltrail/commits/76ca88e95f26f44d243e0be18c26291274321b40android_promptspy
https://www.virustotal.com/gui/file/11f5c91d24c9d1eee16dacacfb9160e299544c1a854af92f79daf88364cea0b6/detectionandroid_promptspy
https://api.github.com/repos/stamparm/maltrail/commits/5883cceca913bd1be14186956bfe210fe8d31361crypto_mining
https://www.virustotal.com/gui/file/a10431e4f4bd7db38916b4199ec5edc89aee72b67e866410d5e96622c476e355/detectioncrypto_mining
https://api.github.com/repos/stamparm/maltrail/commits/aaf2ed33d94d3b8cd24f89d92cb52974aa388e7dandroid_promptspy
https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genaiandroid_promptspy
https://github.com/eset/malware-ioc/tree/master/promptspyandroid_promptspy
https://api.github.com/repos/stamparm/maltrail/commits/1cc72fd3ec85b3f591c98cd4136ee7da5f3ff476valleyrat

IP addresses 4

54.67.2.84android_promptspy
66.23.199.44crypto_mining
23.132.164.46valleyrat
193.143.1.12sectoprat

Community reviews

Loading reviews…