MalwarePublished 17 May 2026Updated 18 May 2026

tlp clear · Maltrail IOC for 2026-05-18

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

This entry reports a medium-severity malware-related Indicator of Compromise (IOC) from the CIRCL OSINT Feed dated 2026-05-18. It is categorized as an external analysis of network activity but does not specify affected software versions or technical exploitation details. No known exploits in the wild or patches are available for this threat. The information is based on manual OSINT collection and is intended for ongoing observation rather than immediate remediation.

Impact

The impact is currently limited to detection and observation of potentially malicious network activity. There is no evidence of active exploitation or direct compromise reported. No affected software versions or systems are identified, and no known exploits in the wild have been confirmed.

Defensive guidance

Security teams should incorporate this IOC into their monitoring and detection tools as appropriate. Since this is an OSINT observation without active exploitation, no urgent action is mandated.

Summary

The report details a malware-related IOC identified on 2026-05-18 from the CIRCL OSINT Feed. It is classified as medium risk and involves network activity analysis. No specific affected product versions or vulnerabilities are listed, and no known active exploits have been reported. The threat intelligence is derived from manual collection and is intended to support situational awareness rather than indicate an active exploit requiring patching.

Indicators of compromise

Domains 32

1v.rvtootsad.comapt_unc2465
2a.rvtoolso.infoapt_unc2465
2j.rvtoolsup.comapt_unc2465
nexiqora.comapt_unc2465
pacs4less.comapt_unc2465
s.workbanch.comapt_unc2465
workbecn.comapt_unc2465
y0.workbecn.comapt_unc2465
yr.rvtoolc.infoapt_unc2465
15-93-33-89.07internet.rocyberstrikeai

URLs 20

https://api.github.com/repos/stamparm/maltrail/commits/887d6ed3812144cb654c58de5130a5bea81b3483apt_unc2465
https://api.github.com/repos/stamparm/maltrail/commits/063c7b18381113b77de37bf53a19ec50de70f5d9cyberstrikeai
https://api.github.com/repos/stamparm/maltrail/commits/2bd6f8199383ee1f10be9e7516f80862fc79db39hacked_npmrepos
https://www.ox.security/blog/new-actors-deploy-shai-hulud-clones-teampcp-copycats-are-herehacked_npmrepos
https://api.github.com/repos/stamparm/maltrail/commits/389c8dab462f3fd730d35a0194541c6d7049f3eelummac2
https://www.virustotal.com/gui/ip-address/2.26.74.89/relationslummac2
https://api.github.com/repos/stamparm/maltrail/commits/e98dc3b2a6c7684965dbf490fd656c8ffc48daccmicrostealer
https://api.github.com/repos/stamparm/maltrail/commits/0fc87d9cf3bb20bb9e6d9c4290e870e49b546a55discordgrabber
https://x.com/Fact_Finder03/status/2056203591447417249discordgrabber
https://www.virustotal.com/gui/file/ab2df544db70a9af9ae70572c5eab2ec213a0e03544dca643719729f55f518c4/detectiondiscordgrabber

IP addresses 18

139.224.14.4cyberstrikeai
154.193.246.65cyberstrikeai
2.27.7.195cyberstrikeai
38.76.198.132cyberstrikeai
8.135.46.127cyberstrikeai
91.92.243.190cyberstrikeai
80.200.28.28hacked_npmrepos
212.193.3.220discordgrabber
144.172.89.198apt_lazarus
195.201.104.53apt_lazarus

Community reviews

Loading reviews…