MalwarePublished 29 May 2026Updated 2 Jun 2026

Maltrail IOC for 2026-05-30

Source CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Impact

The impact is currently limited to awareness of potential malicious network activity as indicated by the IOC. There are no confirmed active exploits or vulnerabilities tied to this IOC, and no direct patch or remediation is applicable. Organizations should consider this information as part of their threat intelligence to enhance detection capabilities.

Defensive guidance

Organizations should integrate this IOC into their detection and monitoring systems as appropriate. Since no active exploitation is reported, no urgent action is necessary beyond standard threat intelligence consumption.

Summary

The provided data describes a malware-related IOC published by CIRCL OSINT Feed on 2026-05-30. It is classified as medium risk and relates to network activity observations. There are no specific affected software versions, no known active exploits, and no patches available or required. The IOC is part of ongoing external threat intelligence collection without detailed technical indicators included in this report.

Indicators of compromise

Domains 178

access.edoc.korea-app.dns.armyapt_kimsuky
coupang.dns.navyapt_kimsuky
cp10523.epost-kr.dns.armyapt_kimsuky
dmf.ips-cert.dns.armyapt_kimsuky
edoc.korea-app.dns.armyapt_kimsuky
ips-nifty.dns.armyapt_kimsuky
jfzb.coupang.dns.navyapt_kimsuky
korea-app.dns.armyapt_kimsuky
kr-edoc.xubi.orgapt_kimsuky
nid.kr-edoc.xubi.orgapt_kimsuky

URLs 45

https://api.github.com/repos/stamparm/maltrail/commits/c43514eefbc716fbe3df188aea293983c11a1acaapt_kimsuky
https://x.com/skocherhan/status/2060432300375150977apt_kimsuky
https://api.github.com/repos/stamparm/maltrail/commits/25aeb6cb02c74edfd7a115d8dbc4ac9432fe3f56powershell_injector
https://x.com/smica83/status/2060341816415649951powershell_injector
https://www.virustotal.com/gui/file/1df1a23a24dff84ba55dadcfa90cc3df7f7ace6dde69987d125c07474c8a1388/detectionpowershell_injector
https://api.github.com/repos/stamparm/maltrail/commits/f999f220a3621c54b60fde28eda54e567b09d7c7fakeapp
https://x.com/patialavii/status/2060416552948887895fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/5a0ad2cbd9c39f5df9d6f338527211b5315d9178wp_inject
https://api.github.com/repos/stamparm/maltrail/commits/fff6b5f2267badcd27204de4990879f5af7d44a8wp_inject
https://x.com/riper81/status/2060164428876951828wp_inject

IP addresses 5

82.39.109.211vacbot
82.39.109.218vacbot
2.27.59.167purelogs
108.62.161.53connectwise
161.248.14.93valleyrat

Community reviews

Loading reviews…