MalwarePublished 27 Apr 2026Updated 28 Apr 2026

tlp clear · Maltrail IOC for 2026-04-28

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-04-28

Impact

The impact is currently limited to the identification of potential malicious network activity as indicated by the IOC. There is no evidence of active exploitation or direct vulnerability in software products. The threat intelligence serves as an alert for monitoring and detection rather than indicating an immediate exploitable vulnerability.

Defensive guidance

Security teams should incorporate this IOC into their detection and monitoring tools as appropriate. No urgent action is required beyond standard threat intelligence consumption and network monitoring.

Summary

The report describes a malware IOC published by CIRCL OSINT Feed for April 28, 2026. It is classified as a medium-risk observation related to network activity, but no specific malware family, attack vector, or exploitation details are provided.

Indicators of compromise

Domains 862

mysaltwaterhome.screenconnect.comconnectwise
server-ovh30010055-web.screenconnect.comconnectwise
glowmedaesthetics.comosx_atomic
cosmic-nebula.ccsanta
theater-reward.clickmintsloader
shadoworkz.infoapt_donot
screenly.camnightshadec2
fabolouspanels.xyznightshadec2
paysolutions.inknightshadec2
xtrafftrck.netnightshadec2

URLs 54

https://api.github.com/repos/stamparm/maltrail/commits/a27a43de0d00cfde69e0e686a6f69ba6c5d4de84connectwise
https://x.com/suyog41/status/2049003157532115232connectwise
https://www.virustotal.com/gui/file/8f91252d4ac62ce03680f9d945b453cc95934c5b5878c0022fc5e9f3e72530b2/detectionconnectwise
https://api.github.com/repos/stamparm/maltrail/commits/b152c89d0ef575d873a0b7239d454f3dc35ff70fosx_atomic
https://x.com/suyog41/status/2049098438089073128osx_atomic
https://www.virustotal.com/gui/file/2936ed377af3292ac35d98d433523002691ac1dd50151c93fc58c6a4161cee88/detectionosx_atomic
https://api.github.com/repos/stamparm/maltrail/commits/ffe46b842ab89ad4c7d3c975cfe4a370ba4dade6santa
https://api.github.com/repos/stamparm/maltrail/commits/5641153e2d334684a8fcfe37a5f2bc9dc931c72dmintsloader
https://api.github.com/repos/stamparm/maltrail/commits/5941c7d510b66bf7057671f53fd36407ec71fff5apt_donot
https://api.github.com/repos/stamparm/maltrail/commits/3ea37650033ec7bacedd88ca350ac83599c84753nightshadec2

IP addresses 18

70.34.205.43nightshadec2
43.139.81.96elf_mirai
148.251.11.208apt_lazarus
110.40.171.61cyberstrikeai
144.172.117.57cyberstrikeai
163.7.6.60cyberstrikeai
180.97.215.181cyberstrikeai
187.124.51.55cyberstrikeai
47.79.234.34cyberstrikeai
217.145.227.150qatar

Community reviews

Loading reviews…