Maltrail IOCs Targeting Multiple Threat Actors

On March 13, 2026, Maltrail, an open-source malicious traffic detection system, identified a series of IOCs associated with various threat actors and campaigns. This intelligence brief focuses on several notable clusters of activity, including those linked to APT groups like UNC2465 and SideWinder, as well as malware families such as LummaC2, XWorm, and PowerShell Injector. The identified IOCs consist primarily of domains and IP addresses used for command and control (C2) or other malicious purposes. This broad spectrum of detected activity suggests a landscape where multiple threat actors are actively probing or exploiting vulnerabilities across different sectors, posing a risk of data theft, ransomware deployment, or persistent compromise. Defenders need to prioritize detections covering these diverse attack vectors.

Attack Chain

1. Initial Access: While the specific initial access vectors are not detailed in the provided source, several of the identified threat actors, such as SideWinder and 0ktapus, are known to utilize phishing campaigns.
2. Malware Delivery/Execution: The threat actors deliver their respective payloads via compromised websites or direct execution using techniques such as PowerShell injection.
3. Command and Control: The malware establishes a connection to a C2 server using domains such as rvtoolsup.com (UNC2465), geo-foundation.vg (LummaC2), or IP addresses like 172.245.82.123 (SuperShell_C2).
4. Persistence: Some malware families, like XWorm, might use persistence mechanisms to ensure continued access to the compromised system.
5. Data Exfiltration: LummaC2 is known for stealing sensitive information such as credentials and cookies from web browsers.
6. Lateral Movement: Depending on the attacker's objective, lateral movement may occur within the compromised network to reach valuable assets.
7. Final Objective: The ultimate goal varies depending on the threat actor. It may include data theft, espionage, or disruption of services. For LokiLocker the goal is ransomware deployment.
8. Impact: The final impact includes data encryption from ransomware, sensitive data exfiltration, or system compromise, depending on the threat actor's objectives.

Impact

The observed network activity associated with these threat actors indicates a potential for widespread compromise. While the exact number of victims remains unknown, the diversity of actors suggests that multiple sectors could be affected. Successful attacks could result in data breaches, financial losses, reputational damage, and disruption of services. Specifically, ransomware attacks (e.g., LokiLocker) could lead to significant operational downtime and financial demands for data recovery. Credential theft (e.g., LummaC2, 0ktapus) could enable further attacks and compromise sensitive systems.

Recommendation

• Monitor network traffic for connections to the IOCs listed in this brief, specifically the domains associated with LummaC2 (e.g., geo-foundation.vg, microservice.gl, ros-tele.com, rostov-uga.com, ug-network.com) to detect potential C2 communications.
• Implement the Sigma rule "Detect Connections to DuckDNS Domains" to identify potential XWorm infections using the domains sostener2025.duckdns.org and teste258588.duckdns.org.
• Deploy the Sigma rule "Detect Connections to Known Malicious IPs" and update it with the IP addresses 172.245.82.123 (SuperShell_C2), 186.169.43.64 (XWorm), 89.124.77.234 (PowerShell_Injector), and the CyberStrikeAI IPs (115.159.42.173, 117.72.74.158, 172.86.114.64, 43.130.44.204, 45.192.103.176, 51.195.25.206) to detect potential malicious network connections.