MalwarePublished 19 May 2026Updated 20 May 2026

tlp clear · Maltrail IOC for 2026-05-20

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-05-20

Impact

The impact is medium risk based on the source classification, indicating potential malware activity detected in network traffic. However, no known exploits or direct vulnerabilities are identified, and no specific affected products or versions are listed. This suggests a general threat awareness rather than an immediate exploitable condition.

Defensive guidance

Security teams should incorporate this IOC into their threat detection and monitoring systems as part of ongoing OSINT-based situational awareness. No urgent action is required beyond standard monitoring aligned with this intelligence.

Summary

The report details a malware-related IOC published by CIRCL OSINT Feed on 2026-05-20. It is categorized under OSINT and network activity with medium risk but lacks specific technical indicators, affected versions, or exploit details.

Indicators of compromise

Domains 212

2u9f.2usrmmwwduz.dns.navyapt_kimsuky
2usrmmwwduz.dns.navyapt_kimsuky
6td4w.mj9tqlj86sz.dns.navyapt_kimsuky
923h5qvvzq2.v6.navyapt_kimsuky
flbsbn.zsf31ayvobt.dns.navyapt_kimsuky
guidetx.suredoc.netapt_kimsuky
mareqsutxn.v6.navyapt_kimsuky
mj9tqlj86sz.dns.navyapt_kimsuky
ncloud.casacam.netapt_kimsuky
ndoc.ncloud.casacam.netapt_kimsuky

URLs 55

https://api.github.com/repos/stamparm/maltrail/commits/f9324a40cdba2fc8c6e71245aa98be2c0d17f04capt_kimsuky
https://x.com/skocherhan/status/2057172575889789202apt_kimsuky
https://api.github.com/repos/stamparm/maltrail/commits/f20c6823363a1cd1b330b4b4a9891beec7f27aeclummac2
https://api.github.com/repos/stamparm/maltrail/commits/e202683c7f0d46980803d6b05a038f2b819a43b2magentocore
https://api.github.com/repos/stamparm/maltrail/commits/581025fa091e6a2594d7a849980caa94b438a982fakeapp
https://x.com/Malwarehunterr/status/2057196561172689389fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/7f01ccd57edb32d4cbdc3b82f75dd5daccaa1d64apt_unc6691
https://safedep.io/art-template-npm-supply-chain-compromiseapt_unc6691
https://api.github.com/repos/stamparm/maltrail/commits/5fa2e456bfb5bd5aa84578ec621fd5d52a593d04osx_atomic
https://www.virustotal.com/gui/file/759b99a5241122a5ae61dca204f7ec5659f2a7ca4b3201928dd9b95aa97d38ca/detectionosx_atomic

IP addresses 9

195.201.194.107apt_lazarus
23.254.203.244hacked_npmrepos
23.254.164.61hacked_npmrepos
23.254.164.92hacked_npmrepos
151.243.109.130powershell_injector
38.47.227.212fakeapp
43.165.179.173fakeapp
157.173.113.151vacbot
103.45.66.52quasarrat

Community reviews

Loading reviews…