MalwarePublished 15 May 2026Updated 16 May 2026

tlp clear · Maltrail IOC for 2026-05-16

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-05-16

Impact

The impact involves potential detection of network activity or infrastructure related to Android malware and exploit kit campaigns. There is no direct evidence of exploitation or compromise detailed in the data. The medium severity rating suggests a moderate risk primarily for detection and monitoring rather than immediate critical threat. No known ransomware campaigns or threat actors are linked to this intelligence.

Defensive guidance

Security teams should use the provided indicators (IPs, domains, URLs) to enhance detection capabilities in their environments. Since no vendor advisory or official fix exists, monitoring and blocking identified malicious infrastructure is the primary recommended action. Patch status is not applicable. No further mitigation guidance is provided by the source.

Summary

This threat intelligence entry from the CIRCL OSINT Feed details multiple indicators of compromise linked to Android malware families (android_spysolrrat, android_fvncbot) and an exploit kit (ek_landupdate808). The indicators include URLs to GitHub commits, social media posts, IP addresses, and suspicious domains. The data serves as an external analysis of network activity related to these malware threats. The threat level is medium, reflecting the potential risk posed by these malware indicators but without confirmed active exploitation or direct vulnerability exploitation details.

Indicators of compromise

Domains 5

analyticsnode.appandroid_spysolrrat
deviceprotect.appandroid_spysolrrat
adadea.icuandroid_fvncbot
suikba.icuandroid_fvncbot
saewart.lolek_landupdate808

URLs 4

https://api.github.com/repos/stamparm/maltrail/commits/ee59e5795fa1e3baf43f91a3cfe9b3826b89a2fbandroid_spysolrrat
https://x.com/Fact_Finder03/status/2055547697864831203android_spysolrrat
https://api.github.com/repos/stamparm/maltrail/commits/18add3b4f1b8c7a468ff60ee0de017da9e2e412aandroid_fvncbot
https://api.github.com/repos/stamparm/maltrail/commits/f7dcf5aba30293f1af7dbbade756e5b7c21338d9ek_landupdate808

IP addresses 1

android_spysolrrat

31.7.61.61

Community reviews

Loading reviews…