Maltrail IOCs for Android Joker, APT Lazarus, UNC2465, and Powershell Injector

This threat brief summarizes indicators of compromise (IOCs) identified by Maltrail on February 25, 2026, linking to several distinct threat actors and campaigns. These include the Android Joker malware known for its malicious billing fraud, APT Lazarus group, APT UNC2465, and campaigns involving the use of PowerShell injectors. The IOCs consist of domains and URLs related to network activity and external analysis of these threats. Notably, a large number of domains were identified without specific attribution, potentially representing a broader infrastructure used across multiple campaigns. Defenders should utilize these IOCs to proactively identify and block malicious activity targeting their networks.

Attack Chain

The following attack chain represents a generalized view based on the observed indicators, as the specific methods vary between the threat actors:

1. Initial Compromise: (Observed for Android Joker): User unknowingly installs a malicious application containing the Joker malware from a third-party app store or via sideloading.
2. Persistence (Android Joker): The malware establishes persistence on the device, often by hiding itself or masquerading as a legitimate application.
3. Command and Control (Various): The compromised system communicates with command-and-control (C2) servers using domains like genad.click, infkm.bond, stmuis.help, suluk.cyou, or others listed in the IOCs.
4. PowerShell Injection (PowerShell Injector): A PowerShell script is executed to inject malicious code into another process, often to evade detection. This may involve domains like cdn0x.store.
5. Credential Harvesting (APT Lazarus): The Lazarus Group attempts to steal credentials and other sensitive information from the compromised system to facilitate lateral movement.
6. Lateral Movement (APT Lazarus, UNC2465): Using stolen credentials or exploiting vulnerabilities, the attacker moves laterally to other systems within the network, potentially leveraging infrastructure related to hornetseculty.com, app.breezyhr.us, and breezyhr.us.
7. Data Exfiltration (APT Lazarus, UNC2465): Sensitive data is exfiltrated from the compromised network to attacker-controlled infrastructure.
8. Monetary Gain/Espionage (Android Joker, APT Lazarus, UNC2465, PowerShell Injector): The ultimate objective ranges from financial gain (Android Joker, PowerShell Injector) through fraudulent activities or data theft to espionage or disruption (APT Lazarus, UNC2465) targeting specific organizations or sectors.

Impact

Successful exploitation can lead to significant financial losses for victims of Android Joker through billing fraud. APT Lazarus and UNC2465 intrusions can result in the theft of sensitive data, intellectual property, and disruption of critical services. The large number of unattributed domains suggests a broad and potentially widespread malicious infrastructure, which could be leveraged in various campaigns impacting multiple sectors.

Recommendation

• Monitor network traffic for connections to the domains listed in the IOC table and block them at the firewall or DNS resolver to disrupt communication with attacker infrastructure.
• Implement the Sigma rule for PowerShell injection to detect suspicious PowerShell activity and potential code injection attempts.
• Review network connection logs for connections to the IP address 147.124.214.235, associated with APT Lazarus.
• Investigate systems that have communicated with any of the unattributed domains in the IOCs to identify potential compromise.