Maltrail IOCs for APT Kimsuky, Lummac2, MagentoCore, and FakeApp Campaigns

This threat brief is based on a Maltrail feed update from 2026-05-20 which identifies network IOCs associated with multiple threat actors and campaigns. The identified actors include APT Kimsuky, a suspected North Korean threat group known for espionage and cybercrime, along with campaigns attributed to Lummac2, MagentoCore, and FakeApp. The IOCs consist primarily of domains that are likely used for command and control, phishing, or malware distribution. This information is relevant for defenders seeking to identify and block malicious network traffic related to these campaigns. The domains associated with FakeApp suggest potential phishing or social engineering campaigns.

Attack Chain

1. Initial Compromise: The attack chain likely starts with phishing emails or social engineering tactics to lure victims to visit malicious websites.
2. Domain Resolution: Victims click on links within phishing emails, resolving malicious domains (e.g., duolivecall-googel.com) associated with the campaigns.
3. Payload Delivery: Upon visiting the malicious domain, the victim may be prompted to download a malicious application or document containing malware.
4. Command and Control (C2) Communication: The malware establishes communication with command and control servers using domains such as 2u9f.2usrmmwwduz.dns.navy (for APT Kimsuky) or pantofr.cyou (for Lummac2) to receive instructions.
5. Data Exfiltration: The compromised system begins exfiltrating sensitive data to attacker-controlled infrastructure.
6. Lateral Movement: Depending on the malware and the actor's objectives, lateral movement may occur to compromise additional systems within the network.

Impact

Successful attacks leveraging these IOCs could result in data theft, system compromise, espionage, or financial loss. Victims may include individuals targeted by FakeApp scams, or organizations compromised by APT Kimsuky for espionage purposes. The MagentoCore campaign suggests potential targeting of e-commerce platforms for financial gain through skimming or data theft.

Recommendation

• Block the domains listed in the IOC table at the DNS resolver to prevent communication with malicious infrastructure.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
• Monitor network traffic for connections to the domains associated with APT Kimsuky, Lummac2, MagentoCore, and FakeApp.