MalwarePublished 11 Jun 2026Updated 12 Jun 2026

Maltrail IOC for 2026-06-12

Source CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Impact

The impact is limited to the detection of potential malware-related network activity. There is no indication of a specific vulnerability being exploited or software being compromised. The threat may assist defenders in identifying malicious traffic or infection indicators but does not describe direct exploitation or damage.

Defensive guidance

Defenders should use the IOC information to enhance detection and monitoring capabilities within their network security tools. No urgent remediation actions are indicated based on this report.

Indicators of compromise

Domains 15

easycopy-api.hirolab.spaceandroid_fvncbot
node.mboto.my.idandroid_fvncbot
strike.sirclab.comcyberstrikeai
ercmload15nd.dynv6.netapt_kimsuky
ipsedcis.dynu.orgapt_kimsuky
ipsedois.dynu.orgapt_kimsuky
mxot35us.dns.navyapt_kimsuky
nid-naverlvb.servepics.comapt_kimsuky
nid-navervmt.servemp3.comapt_kimsuky
nid-naverzlx.servegame.comapt_kimsuky

URLs 7

https://api.github.com/repos/stamparm/maltrail/commits/df9559fa45bedaa57b8575f79d85ebe255a40115android_fvncbot
https://api.github.com/repos/stamparm/maltrail/commits/4a007afb5b29aa636e8c2838514a68781f02dc96sectoprat
https://api.github.com/repos/stamparm/maltrail/commits/b3e62e2d923ca350dadf3a2f55bf247c1b10bf06cyberstrikeai
https://api.github.com/repos/stamparm/maltrail/commits/26c03ca08f337ffffcdec59d5a181a13fcfb0876apt_kimsuky
https://api.github.com/repos/stamparm/maltrail/commits/20873dd0475c86a773640886c6e3f71145f8efechacked_npmrepos
https://x.com/KirkDerpca/status/2065225499643654213hacked_npmrepos
https://api.github.com/repos/stamparm/maltrail/commits/7e4218427e0dc7caa6399d22447807ea162598e1offloader

IP addresses 6

212.43.159.144sectoprat
104.21.20.107cyberstrikeai
111.228.62.208cyberstrikeai
213.152.183.94cyberstrikeai
54.90.231.197cyberstrikeai
154.57.164.71hacked_npmrepos

Community reviews

Loading reviews…