medium
advisory
SmartApeSG malware: New payload delivery infrastructure
ThreatFox identified three new indicators of compromise, including a domain and two URLs, utilized by the SmartApeSG malware family for payload delivery.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:32 UTC
- Detection
- 3 IOCs
- Source quality
- A1Likely
ThreatFox has reported three new indicators of compromise (IOCs) associated with the SmartApeSG malware family. These indicators were first observed on November 4, 2026, and are classified under the payload delivery category. The infrastructure consists of one domain and two specific file paths used for delivery.
Immediate actions
Block the domain medlarportcullis.org at the enterprise DNS resolver.
SOC
24h
Block access to the URLs on medlarportcullis.org via proxy or EDR web filtering.
SOC
24h
Threat Hunt
Search for recent outbound HTTP/HTTPS requests to the identified domain and URLs.
high
high confidence
hunt now
Data: Proxy logs, DNS logs
Indicators of compromise
1
domain
2
url
| Type | Value |
|---|---|
| domain | medlarportcullis.org |
| url | https://medlarportcullis.org/proxy/beta-schema |
| url | https://medlarportcullis.org/proxy/token-response.js |