MalwarePublished 16 May 2026Updated 17 May 2026

tlp clear · Maltrail IOC for 2026-05-17

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-05-17

Impact

The impact is currently limited to the identification of potential malware-related network activity. There is no evidence of active exploitation or direct compromise reported. Without specific affected versions or exploit details, the immediate risk to systems cannot be precisely determined.

Defensive guidance

Security teams should consider integrating this IOC into their detection and monitoring tools to identify potential related activity. Since no active exploits are known, no urgent remediation is required beyond standard monitoring.

Indicators of compromise

Domains 97

kelemet.shopdonut
rpcsecnoweb.prodonut
synapseops.infoosx_atomic
cloudsendhub.comosx_atomic
fastlinkstorage.comosx_atomic
fileconnectdata.comosx_atomic
filedropvault.comosx_atomic
filehubconnect.comosx_atomic
filemarbleplanet.sbsosx_atomic
filepixelstudio.comosx_atomic

URLs 17

https://api.github.com/repos/stamparm/maltrail/commits/f0dea21e80d782a39eefec8faa9aa4cf4324d930donut
https://www.virustotal.com/gui/file/ef146f97c8fbc10e9ad485dbbf2227fa5943f62243c7a703c3900efbe700f6d8/detectiondonut
https://api.github.com/repos/stamparm/maltrail/commits/75bb4db9c069c5e2d2a0a4de1c0545c0814c4021osx_atomic
https://api.github.com/repos/stamparm/maltrail/commits/d6227508c5499bc99bd61aea832764e8899872a2osx_atomic
https://x.com/brkalbyrk7/status/2055749987678486685osx_atomic
https://gist.github.com/brkalbyrk/c7989c3d00a85bcfe0f3feaf4bf39e53osx_atomic
https://api.github.com/repos/stamparm/maltrail/commits/539bc996ac870ae74444463c1d89f597b8749089apt_kimsuky
https://api.github.com/repos/stamparm/maltrail/commits/0942591c7d5d50a60f3ea92611e38f166e54105bpowershell_injector
https://x.com/smica83/status/2055759040647495787powershell_injector
https://www.virustotal.com/gui/file/efbbb83671301fa9e1fec081e4d943d8d180fa4e243ca16ba130099b2a158e88/detectionpowershell_injector

IP addresses 1

purelogs

15.235.149.6

Community reviews

Loading reviews…