MalwarePublished 12 Mar 2026

tlp clear · Maltrail IOC for 2026-03-12

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-03-12

Impact

The impact is assessed as medium risk based on the source classification. No direct exploitation or vulnerability is described, and no affected software versions are identified. There is no evidence of active exploitation in the wild.

Defensive guidance

Security teams should incorporate this IOC into their detection and monitoring tools as appropriate but no urgent action is mandated.

Summary

The report details a Maltrail IOC from March 12, 2026, indicating observed malware-related network activity. It is an OSINT observation without associated affected software versions or exploit details. The IOC is tagged with medium threat level and is intended for broad awareness rather than immediate incident response. No technical indicators or exploit mechanisms are included.

Indicators of compromise

Domains 714

huangchaodh.buzzfakeapp
empornium.sitefakeapp
rvtoolsai.comapt_unc2465
rvtoolsbox.comapt_unc2465
rvtoolsit.comapt_unc2465
rvtoolsrun.comapt_unc2465
cswift.helpandroid_joker
cyrebu.shopandroid_joker
account-kakao.dynv6.netapt_kimsuky
login.account-kakao.dynv6.netapt_kimsuky

URLs 74

https://api.github.com/repos/stamparm/maltrail/commits/d9bb2f4d09e548d600187533dc2941b94dc2c345fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/cc12eb9068ae6d23eb4a60975fefeec1ff17ad8bfakeapp
https://api.github.com/repos/stamparm/maltrail/commits/df5f3eb4437edbb248be18c3a4b9518338c764e6apt_unc2465
https://api.github.com/repos/stamparm/maltrail/commits/9f4c1a3e6c3723e553b4f1c82bc59a3689361142android_joker
https://api.github.com/repos/stamparm/maltrail/commits/91098f030d46e7d2555124dcace97b67492ba770apt_kimsuky
https://api.github.com/repos/stamparm/maltrail/commits/dc076787db00e6207af4de667ec2d7137ec1b763apt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/13af0511d6bbf918fe453e96f00a4172f53b93f1cyberstrikeai
https://api.github.com/repos/stamparm/maltrail/commits/48bf09f33d66ad849d9bb2b2cb52f3b8813d84340ktapus
https://api.github.com/repos/stamparm/maltrail/commits/872a00327c55d40d6b9babce40c7e778331afcd3
https://api.github.com/repos/stamparm/maltrail/commits/38d671a21ccdc601fbd42034f59aa4a6de1e34a7apt_kimsuky

IP addresses 18

43.99.37.69cyberstrikeai
149.33.22.222android_bankbot
149.56.205.237android_bankbot
192.99.226.117android_bankbot
206.0.29.58android_bankbot
212.69.5.12android_bankbot
212.69.5.84android_bankbot
34.227.229.85android_bankbot
51.222.75.248android_bankbot
51.222.75.250android_bankbot

Community reviews

Loading reviews…