MalwarePublished 14 May 2026Updated 15 May 2026

tlp clear · Maltrail IOC for 2026-05-15

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-05-15, sourced from the CIRCL OSINT Feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions or technical exploitation details are provided. There is no known exploit in the wild and no patch is available or applicable. The information is based on open-source intelligence and manual collection methods.

Impact

The impact is assessed as medium risk based on the threat-level tag, indicating potential malware-related network activity that could affect monitoring or detection systems. However, no direct exploitation or damage details are provided, and no active exploits are known.

Defensive guidance

Since this is an intelligence observation rather than a vulnerability, standard network monitoring and threat detection practices aligned with Maltrail and CIRCL recommendations should be maintained. No urgent remediation actions are indicated by the source.

Summary

The report details a Maltrail IOC identified on 2026-05-15, indicating suspicious or malicious network activity associated with malware. The source is the CIRCL OSINT Feed, and the threat is classified with medium severity. No affected software versions or specific vulnerabilities are listed, and no exploits are known to be active. This is an observational threat intelligence entry rather than a vulnerability with a direct patch or fix.

Indicators of compromise

Domains 1,129

mhjwsf.reverifyblogmid19s.dns.armyapt_kimsuky
naveblogedit33s.dns.armyapt_kimsuky
qxnhdalc.naveblogedit33s.dns.armyapt_kimsuky
reverifyblogmid0s.dns.armyapt_kimsuky
reverifyblogmid19s.dns.armyapt_kimsuky
uhmymkd.reverifyblogmid0s.dns.armyapt_kimsuky
mixcar.storeandroid_joker
titchell.lolek_landupdate808
5q.reports-cdn.commagentocore
5v.east-report.commagentocore

URLs 69

https://api.github.com/repos/stamparm/maltrail/commits/b7cf24d5696efc82affb75f5e4093d316db8caa8apt_kimsuky
https://api.github.com/repos/stamparm/maltrail/commits/425493bcf541d6ddc3aa257accf29b5474227c6dcyberstrikeai
https://api.github.com/repos/stamparm/maltrail/commits/3561cc7ff2bf2fade01d79905ad0435f3708f7e9android_joker
https://api.github.com/repos/stamparm/maltrail/commits/6e2924c45ecb373aca5d50ff8a068f55f71b43a6sectoprat
https://api.github.com/repos/stamparm/maltrail/commits/89891505ba39c926febf4707e1f35afed681332bek_landupdate808
https://api.github.com/repos/stamparm/maltrail/commits/c3eb79792e3e259d1d47c7b233fe87e0b81c8eafmagentocore
https://api.github.com/repos/stamparm/maltrail/commits/9baa4673ad2ca11713e206666f8debe1b085be0amagentocore
https://api.github.com/repos/stamparm/maltrail/commits/7c21eab4467babe4685d9cb2601eb6eede6f61damagentocore
https://x.com/sansecio/status/2055020890467787123magentocore
https://sansec.io/research/funnelkit-woocommerce-vulnerability-exploitedmagentocore

IP addresses 38

111.231.63.109cyberstrikeai
118.126.95.156cyberstrikeai
118.145.227.8cyberstrikeai
134.122.153.78cyberstrikeai
138.249.133.120cyberstrikeai
192.248.172.82cyberstrikeai
203.83.10.114cyberstrikeai
80.96.109.59cyberstrikeai
103.246.144.201sectoprat
191.101.80.211sectoprat

Community reviews

Loading reviews…