MalwarePublished 3 May 2026Updated 19 May 2026

tlp clear · Maltrail IOC for 2026-05-04

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-05-04

Impact

The impact is assessed as medium risk due to the nature of the IOC indicating potential malware activity on networks. However, no specific exploitation or damage details are provided, and no known active exploits have been reported. The lack of affected versions or patch information suggests this is an observational threat intelligence entry rather than a vulnerability with direct remediation.

Defensive guidance

Security teams should consider this IOC as part of their threat detection and monitoring processes but no urgent action or patching is required based on the current information.

Indicators of compromise

Domains 32

incomeeewt.comzeus
incomeet.comzeus
their-income.comzeus
32.yateo.restapt_kimsuky
acme-challenge.ms.cdn.dnscloud.contactapt_kimsuky
asoiwxoin.storeapt_kimsuky
avsoinesoi.siteapt_kimsuky
cagoo.cyouapt_kimsuky
cisiuowin.siteapt_kimsuky
danwo.cyouapt_kimsuky

URLs 18

https://api.github.com/repos/stamparm/maltrail/commits/4d31dc925ec1c65022733d717651dcabfd301dd9zeus
https://x.com/dancho_danchev/status/2050933337540243948zeus
https://ddanchev.blogspot.com/2019/07/exposing-evgeniy-mikhaylovich-bogachev.htmlzeus
https://ddanchev.blogspot.com/2022/01/exposing-currently-active-jabber-zeus.htmlzeus
https://www.virustotal.com/gui/file/26b0f7ab723bfb2d10c06b992234e29d7c0bdc406f2e370600863258cdafc19c/detectionzeus
https://www.virustotal.com/gui/file/a86031aa4f0ab128c6982154c43fe2ab46881cab0cc3e0494f381d33283619ee/detectionzeus
https://www.virustotal.com/gui/file/8cbd55a66dc60c6cf28e2508f40330286187b26b50024e819b227b646bc1e145/detectionzeus
https://api.github.com/repos/stamparm/maltrail/commits/62436f24b6139aa0ba46db71ee6a4565d6d43e46apt_kimsuky
https://x.com/skocherhan/status/2050934068489949471apt_kimsuky
https://api.github.com/repos/stamparm/maltrail/commits/6997ea5d25781f64bb895c1f352d36329765d399apt_kimsuky

Community reviews

Loading reviews…