Threat database

Maltrail IOC for 2026-05-26

Maltrail IOC for 2026-05-25

KRVTZ-NET IDS alerts for 2026-05-24

Maltrail IOC for 2026-05-24

The KRVTZ-NET IDS alerts for 2026-05-23 report observed network reconnaissance activity identified through OSINT sources. The alerts primarily indicate outbound traffic associated with Baidu Spider Crawler User-Agent IP addresses. No specific vulnerabilities or exploits are identified, and no affected product versions are noted. There is no patch or remediation required as this is an observation of network scanning or crawling activity. The severity is assessed as low given the nature of the activity and lack of confirmed exploitation.

This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-05-23, categorized as malware-related network activity. It is sourced from the CIRCL OSINT Feed and marked with a medium risk level. No specific affected versions or technical indicators are provided, and there are no known exploits in the wild. No patch or remediation is available or applicable.

The KRVTZ-NET IDS alerts from 2026-05-21 report network activity consistent with reconnaissance targeting Fortigate VPN devices. Specifically, multiple IP addresses were observed making repeated GET requests to the /remote/logincheck endpoint, which is associated with CVE-2023-27997, a known vulnerability in Fortigate VPN. Several other IPs exhibited suspicious or test user-agent strings, indicating scanning or probing behavior. No active exploitation or confirmed compromises are reported. The activity is categorized as low severity due to its reconnaissance nature without evidence of exploitation.

Maltrail IOC for 2026-05-21

Maltrail IOC for 2026-05-20

KRVTZ-NET IDS alerts for 2026-05-19

Maltrail IOC for 2026-05-19

This entry reports a medium-severity malware-related Indicator of Compromise (IOC) from the CIRCL OSINT Feed dated 2026-05-18. It is categorized as an external analysis of network activity but does not specify affected software versions or technical exploitation details. No known exploits in the wild or patches are available for this threat. The information is based on manual OSINT collection and is intended for ongoing observation rather than immediate remediation.

The KRVTZ-NET IDS alerts for 2026-05-17 report multiple network reconnaissance and scanning activities, including repeated exploit attempts against Fortigate VPN (CVE-2023-27997) and a React Server Components vulnerability (CVE-2025-55182). Several IP addresses were observed making suspicious requests such as repeated GET requests to /remote/logincheck and attempts to access hidden environment files. These activities are indicative of preliminary probing rather than confirmed exploitation. No known exploits in the wild or confirmed breaches have been reported. The overall severity is assessed as low due to the absence of confirmed successful attacks.

Maltrail IOC for 2026-05-17

KRVTZ-NET IDS alerts for 2026-05-16

Maltrail IOC for 2026-05-16

KRVTZ-NET IDS alerts for 2026-05-15

This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-05-15, sourced from the CIRCL OSINT Feed. It is categorized as malware-related network activity with a medium risk level. No specific affected product versions or technical exploitation details are provided. There is no known exploit in the wild and no patch is available or applicable. The information is based on open-source intelligence and manual collection methods.