MalwarePublished 4 May 2026Updated 5 May 2026

tlp clear · Maltrail IOC for 2026-05-05

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-05-05, sourced from the CIRCL OSINT Feed. It is categorized as malware-related network activity with a medium severity rating. No specific affected versions or technical exploit details are provided. There is no patch available, and no known exploits in the wild have been identified. The information is based on open-source intelligence and manual collection methods.

Impact

The impact is currently limited to the identification of suspicious or malicious network activity as indicated by the IOC. There are no confirmed exploits or direct attacks associated with this IOC at this time. The medium severity suggests a moderate level of concern but no immediate critical threat.

Defensive guidance

Security teams should consider integrating this IOC into their detection and monitoring systems to identify potential related network activity. Since this is an observational indicator from OSINT, no direct remediation actions are specified.

Summary

The report details a Maltrail IOC for 2026-05-05 indicating potential malware-related network activity. The data originates from CIRCL's OSINT feed and is classified as medium risk. No affected software versions or specific vulnerabilities are noted, and no exploits have been confirmed in the wild. The IOC serves as an observational indicator rather than a description of a specific vulnerability or active exploit.

Indicators of compromise

Domains 4

netsupport

anthodisk.com
expmle.ink
lipontrent.com
scrappd.ink

URLs 10

https://api.github.com/repos/stamparm/maltrail/commits/06b9fe434a13f7d8867bb3b41f3f672a71ec46d7netsupport
https://x.com/smica83/status/2051408261753053451netsupport
https://www.virustotal.com/gui/file/e28825d93ba61c9e7e1c7b2cc31b32c7be0482ec2edae0c3a54fc9f3cd483058/detectionnetsupport
https://api.github.com/repos/stamparm/maltrail/commits/17fafb8d130fe54b329fa58c900963cb8d3e0ddbasyncrat
https://x.com/smica83/status/2051402222458544341asyncrat
https://www.virustotal.com/gui/file/4e8bad3dd8b3805b02a96b79c3b109e9a0ffb3e6c2efbbce25bd0b71efaf7aed/detectionasyncrat
https://api.github.com/repos/stamparm/maltrail/commits/4a551fa39da4bfc139d6e486ffa2e04c0219ce4enexus_c2
https://blog.talosintelligence.com/uat-10608-inside-a-large-scale-automated-credential-harvesting-operation-targeting-web-applicationsnexus_c2
https://github.com/Cisco-Talos/IOCs/blob/main/2026/04/uat-10608.txtnexus_c2
https://x.com/malwrhunterteam/status/2051403187282685981nexus_c2

IP addresses 46

103.119.47.218netsupport
103.119.47.241netsupport
103.214.147.181netsupport
103.214.147.184netsupport
179.60.145.198netsupport
179.60.145.219netsupport
179.60.149.102netsupport
185.232.67.245netsupport
185.55.242.133netsupport
185.55.242.202netsupport

Community reviews

Loading reviews…