MalwarePublished 2 Apr 2026

tlp clear · Maltrail IOC for 2026-04-02

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-04-02

Impact

The impact is limited to the potential detection of malware-related network activity. There is no direct vulnerability or exploit associated with this IOC, and no known active exploitation is reported. The information supports defensive monitoring but does not indicate an immediate threat requiring patching.

Defensive guidance

Security teams should incorporate this IOC into their detection and monitoring tools as appropriate. No urgent action is mandated based on this report alone.

Summary

The report describes a malware-related IOC collected manually and shared as open-source intelligence by CIRCL. It is classified as medium risk and relates to network activity observations. No specific malware family, attack vector, or exploit details are included. The IOC is intended for threat detection and monitoring rather than describing a software vulnerability or exploit.

Indicators of compromise

Domains 169

ntpd.casacam.netelf_bpfdoor
ntpupdate.ddnsgeek.comelf_bpfdoor
ntpupdate.ygto.comelf_bpfdoor
ntpussl.instanthq.comelf_bpfdoor
c2.bluec2ops.comhak5cloud_c2
c2.gue-tech.comhak5cloud_c2
c2.gue-tech.orghak5cloud_c2
c2.jacobriggs.iohak5cloud_c2
c2.shemaria.techhak5cloud_c2
johnjenkins.servebeer.comhak5cloud_c2

URLs 48

https://api.github.com/repos/stamparm/maltrail/commits/a532117627e05b167cfbf0faf0a87d258d93eb1aelf_bpfdoor
https://www.rapid7.com/blog/post/new-whitepaper-stealthy-bpfdoor-variants-are-a-needle-that-looks-like-hayelf_bpfdoor
https://www.virustotal.com/gui/file/195b98211d1ce968669a0740ca08d0ddcf03a2df03a47e2e70550f6c002b49e8/detectionelf_bpfdoor
https://www.virustotal.com/gui/file/9ee77ed38e5bc69f841bdaba7c5e6c3bf30fd9ae94cd2e69f39834e9cec76e82/detectionelf_bpfdoor
https://api.github.com/repos/stamparm/maltrail/commits/003ea32aa17fcadeae04529f4bce9699e9054f6fhak5cloud_c2
https://api.github.com/repos/stamparm/maltrail/commits/b3982c2ff0e06b1ac390376789b6a001b022f2c2glassworm
https://x.com/malwrhunterteam/status/2039439398383583584glassworm
https://www.virustotal.com/gui/file/92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f/detectionglassworm
https://www.virustotal.com/gui/file/eb2db389d64987855fa5db905bbcb7b100f9d6c1699eaf5d846a98680feae1df/detectionglassworm
https://api.github.com/repos/stamparm/maltrail/commits/38b6794b5ac1fb60f4c1a66d22eb5b5b6065a2750ktapus

IP addresses 20

103.79.79.21glassworm
157.245.154.189glassworm
175.198.83.251glassworm
207.244.230.254glassworm
34.44.36.81glassworm
45.32.114.213glassworm
60.208.108.50glassworm
82.112.220.6glassworm
166.70.207.2metasploit
79.137.206.33metasploit

Community reviews

Loading reviews…