MalwarePublished 22 May 2026Updated 23 May 2026

tlp clear · Maltrail IOC for 2026-05-23

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-05-23, categorized as malware-related network activity. It is sourced from the CIRCL OSINT Feed and marked with a medium risk level. No specific affected versions or technical indicators are provided, and there are no known exploits in the wild. No patch or remediation is available or applicable.

Impact

The impact is assessed as medium risk based on the source tagging, but no direct exploitation or damage details are provided. Without known exploits or affected software versions, the immediate risk to systems cannot be precisely determined from this data alone.

Defensive guidance

Security teams should consider this IOC in their threat detection and monitoring processes but no urgent remediation actions are indicated by the source.

Summary

The report details a malware-related IOC identified on 2026-05-23 via Maltrail, a network traffic detection system. It is an OSINT observation from CIRCL, tagged as medium risk, but lacks detailed technical indicators or affected product versions. No exploits or patches are documented, indicating this is an intelligence observation rather than a vulnerability or active exploit.

Indicators of compromise

Domains 151

saltminister.xyzoffloader
tubidycep.comtsundere
bootstrup-framework-js.beer
nshostvps.beer
acfcjsbi.gift-lattice.christmas
acxmquqg.winter-pulse.christmas
auhlsdki.frost-engine.christmas
badxqjge.gift-lattice.christmas
betnoise-unionour.cyou
brhwmjkk.frost-engine.christmas

URLs 21

https://api.github.com/repos/stamparm/maltrail/commits/5caaf15897ad961e837f571242b5481c6984b779offloader
https://api.github.com/repos/stamparm/maltrail/commits/a0d24c5450db0409cbb6c8818eb3656f37456a61tsundere
https://api.github.com/repos/stamparm/maltrail/commits/e30b651fc7513f8af22dbba5fbb716ea99736de3c2_panel
https://api.github.com/repos/stamparm/maltrail/commits/1c3d97e9fcbe5dfd0673cfb46778dff9965906b2peaklight
https://api.github.com/repos/stamparm/maltrail/commits/512a4cc90b07d2b35735c6511bb3f2331553f2ad
https://api.github.com/repos/stamparm/maltrail/commits/2fc04733ab5a4799c29a7efbaddbfdf9e90656caapt_unc2465
https://api.github.com/repos/stamparm/maltrail/commits/0c5b50995aeed95cd9888dadf4e314f613bbf816android_fvncbot
https://api.github.com/repos/stamparm/maltrail/commits/3ee6f511b6cbcb68b13bd408179b21abbd8cac37magentocore
https://api.github.com/repos/stamparm/maltrail/commits/37444af6a1e86eae83b86b89d48f456434771fafandroid_joker
https://api.github.com/repos/stamparm/maltrail/commits/922771885db706042e4409c4fc6e838cd4ae2439android_roamingmantis

IP addresses 4

158.94.210.164c2_panel
79.137.206.163c2_panel
198.144.149.133android_roamingmantis
107.173.13.251cyberstrikeai

Community reviews

Loading reviews…