Maltrail IOCs Report: Tracking Multiple Threat Actors

This threat brief is based on an IOC feed from Maltrail, dated February 27, 2026, which aggregates indicators related to various threat actors and malware campaigns. The tracked actors include APT_UNC2465, Lazarus Group, Gorat, APT_Bitter, Android_Joker, PowerShell Injector, SmokeLoader, and FakeApp. The IOCs primarily consist of domains and IP addresses associated with these groups’ network infrastructure and malware distribution. These campaigns are likely targeting a wide range of victims across multiple sectors, employing diverse techniques to achieve their objectives, including initial access, command and control, and potentially data exfiltration or deployment of malicious payloads. The data suggests ongoing malicious activity necessitating proactive monitoring and detection efforts.

Attack Chain

1. Initial Compromise: An unsuspecting user visits a compromised website or interacts with a malicious advertisement, potentially leading to the download of a malware loader such as those associated with SmokeLoader or FakeApp.
2. Malware Installation: The initial loader executes on the victim’s system, establishing persistence and preparing the environment for further malicious activities. This may involve creating scheduled tasks or modifying registry keys for auto-start.
3. Command and Control (C2) Communication: The malware establishes communication with a command-and-control server, using domains such as dax.estate (SmokeLoader) or resistantmusic.shop (PowerShell Injector) to receive instructions and transmit data.
4. PowerShell Injection: The PowerShell Injector, utilizes multiple techniques to inject malicious code into running processes, allowing it to evade detection and maintain persistence within the system. Domains such as apostile.zapto.org and googletranslate.zapto.org may resolve to infrastructure involved in command and control of compromised hosts.
5. Lateral Movement: The attackers leverage compromised systems to move laterally within the network, potentially using stolen credentials or exploiting vulnerabilities to gain access to additional systems.
6. Data Exfiltration: Sensitive data is collected from compromised systems and exfiltrated to attacker-controlled servers, potentially using domains such as ashersoftlib.com (APT_Bitter) for staging or exfiltration.
7. Android Exploitation: In the case of Android_Joker, malicious applications distributed through unofficial channels or app stores communicate with petitle.cloud for command and control, potentially leading to data theft or installation of further malware.
8. Final Objective: The final objective of the attack may vary depending on the actor and the target, ranging from data theft and espionage (APT_UNC2465, Lazarus Group, APT_Bitter) to financial gain (Android_Joker) or widespread malware distribution (SmokeLoader, FakeApp, PowerShell Injector).

Impact

Compromised systems can be used for a variety of malicious purposes, including data theft, financial fraud, and further propagation of malware. Victims may experience data breaches, financial losses, and reputational damage. The wide range of threat actors involved suggests that various sectors and organizations are at risk. If successful, these attacks can lead to significant financial losses and disruption of business operations.

Recommendation

• Block the identified malicious domains and IP addresses at the network perimeter to prevent communication with command-and-control servers (IOC table).
• Implement a web proxy filter to block access to URLs associated with malware downloads and phishing campaigns (IOC table).
• Monitor network traffic for connections to known malicious domains and IP addresses associated with APT_Bitter, PowerShell Injector, SmokeLoader, and FakeApp (IOC table).
• Deploy the Sigma rule to detect network connections to domains associated with PowerShell Injector infrastructure. Tune the rule for your environment (Sigma Rule).
• Deploy the Sigma rule to detect network connections to infrastructure associated with FakeApp campaigns, adjusting the rule as needed for your environment (Sigma Rule).
• Investigate and remediate any systems that exhibit suspicious network activity or have been identified as compromised based on the IOCs provided (IOC table).