MalwarePublished 7 Apr 2026Updated 8 Apr 2026

tlp clear · Maltrail IOC for 2026-04-08

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

This entry reports a medium-severity malware indicator of compromise (IOC) from the CIRCL OSINT Feed dated April 8, 2026. It is categorized as an external network activity observation with no specific affected product versions or known exploits in the wild. No patch or remediation is available or applicable. The information is based on manual OSINT collection and is intended for situational awareness rather than immediate incident response.

Impact

The impact is limited to the presence of a malware IOC indicating potential malicious network activity. There is no evidence of active exploitation or vulnerability in specific products. This information primarily supports threat detection and situational awareness rather than indicating an immediate threat requiring patching or mitigation.

Defensive guidance

Security teams should incorporate this IOC into their threat detection systems as appropriate. Since no active exploit or vulnerability is identified, no urgent action is necessary beyond monitoring and standard detection practices.

Summary

The report details a malware-related IOC identified on April 8, 2026, sourced from the CIRCL OSINT Feed. It is classified as medium risk and relates to network activity observed externally. There are no affected software versions or products specified, no known exploits, and no available patches. The data serves as an open-source intelligence observation without direct actionable remediation steps.

Indicators of compromise

Domains 955

mail.cypher9ja.comfakeapp
051516xx.vectorprospera.digitalek_clearfake
1on7q5g5.nexuspatronage.digitalek_clearfake
51ojrcjj.intellectnail.in.netek_clearfake
5x0raip5.vectorprospera.digitalek_clearfake
6qhzzl.estonianscree.in.netek_clearfake
7fsjtcf.bolettreatise.in.netek_clearfake
abstract-io.theorematicsphere.in.netek_clearfake
abstract-io.theoreticvector.in.netek_clearfake
abstract-io.theoriconhub.in.netek_clearfake

URLs 56

https://api.github.com/repos/stamparm/maltrail/commits/b08a5cd1feee7c782c8b4eef2ee2794d813ef686fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/d28b4a848c1a6a1db1e7e8c06b155b452fce06e9ek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/b7f5a23b252c9f2f3162df0215a0456d16638196ek_clearfake
https://x.com/JAMESWT_WT/status/2041800369307545780ek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/4a40aa33115ebbf046b609566d97966fdf0c3251worst_asns
https://ipinfo.io/AS209274worst_asns
https://api.github.com/repos/stamparm/maltrail/commits/4029a32717e2b0cf94ac2f786dffebcb4c0f4e74supershell_c2
https://api.github.com/repos/stamparm/maltrail/commits/0524e01fc91c47abebf42ccc1ee375d2ddb487d0ek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/80963bb0907a6bf2da3b360978782ead6c3597f5ek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/35d60eb53faaed6e82be67f962633266ca1daf0capt_kimsuky

IP addresses 198

163.5.102.0worst_asns
169.40.135.0worst_asns
217.60.199.0worst_asns
80.71.224.0worst_asns
206.82.6.110supershell_c2
155.2.192.215c2_panel
158.94.209.188c2_panel
178.16.55.242c2_panel
185.93.89.154c2_panel
190.211.252.42c2_panel

Community reviews

Loading reviews…