MalwarePublished 31 Jul 2026Updated 1 Aug 2026

Maltrail IOC for 2026-08-01

Source CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Impact

The impact involves potential malware infections and credential theft facilitated by infrastructure linked to APT Duke. There is no direct software vulnerability or exploit described, so the impact is limited to detection and blocking of malicious network activity and domains to prevent compromise.

Defensive guidance

Defenders should use the provided IP addresses and domains to update detection and blocking rules in network security devices and endpoint protection systems. Monitoring for related activity and applying threat intelligence feeds is recommended.

Summary

The CIRCL OSINT Feed published a set of IOCs on 2026-08-01 linked to the APT group known as 'APT Duke'. These IOCs include a collection of IP addresses and domains used in malware delivery and credential theft campaigns targeting travelers worldwide, as referenced by a Microsoft security blog. There is no associated CVE or software vulnerability; rather, this is an intelligence report on malicious infrastructure and activity patterns. No exploits in the wild or patches are applicable.

Indicators of compromise

Domains 5

apt_duke

m365-owa.com
ms365-device.com
ms365-live.com
my-invite.org
owa-ms365.com

URLs 2

apt_duke

https://api.github.com/repos/stamparm/maltrail/commits/5d968a2223113177bdda4ec168dfd31f0f4f91f9
https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft

IP addresses 12

apt_duke

104.194.159.150
107.189.26.194
138.197.202.81
138.68.160.124
165.22.146.161
213.145.86.112
216.126.224.95
31.172.83.142
31.57.243.154
38.146.28.132

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Aug 2026, 19:09 UTC

Indicators of compromise

Domains 5

URLs 2

IP addresses 12

Community reviews

Related threats