Tag

Ioc

8 briefs RSS

Kimsuky APT Domains and URLs from Maltrail Feed

This brief summarizes newly published IOCs consisting of domains and URLs associated with the Kimsuky APT group as of June 2nd, 2026, sourced from a Maltrail feed.

Kimsuky +4 apt ioc malware

2r 2t 50i Jun 2, 2026

medium threat

Maltrail IOC List Analysis - June 1, 2026

2 rules 1 TTP 50 IOCs

This brief analyzes a Maltrail IOC list from June 1, 2026, identifying domains and IP addresses associated with various malware and threat actors, including android_fvncbot, lummac2, magentocore, sectoprat, apt_lazarus, offloader, android_joker, cyberstrikeai, and nightshadec2, potentially used for command and control, malware distribution, or phishing campaigns.

maltrail ioc malware command-and-control

2r 1t 50i Jun 1, 2026

medium threat

Maltrail IOCs for APT Kimsuky, Lummac2, MagentoCore, and FakeApp Campaigns

3 rules 1 TTP 50 IOCs

This brief summarizes indicators of compromise (IOCs) from a Maltrail feed update on 2026-05-20, detailing network activity associated with APT Kimsuky, Lummac2, MagentoCore, and FakeApp campaigns, providing actionable intelligence for detection and response.

APT Kimsuky ioc apt network_activity kimsuky lummac2 magentocore fakeapp

3r 1t 50i May 20, 2026

medium threat

Maltrail IOC Feed Update - 2026-05-15

3 rules 2 TTPs 50 IOCs

This brief summarizes a Maltrail IOC feed update on 2026-05-15, containing indicators associated with APT_Kimsuky, CyberstrikeAI, Android_Joker, Sectoprat, EK_Landupdate808, and MagentoCore campaigns involving suspicious domains and IP addresses.

github.com APT_Kimsuky maltrail ioc threat-intelligence

3r 2t 50i May 15, 2026

medium advisory

Maltrail IOC Feed Update for Multiple Threats

3 rules 6 TTPs 50 IOCs

This brief summarizes IOCs extracted from the Maltrail feed on March 15, 2026, covering domains and URLs associated with threats targeting macOS and Android platforms, including OSX_Atomic, FakeApp, Android_Joker, Lummack2, APT_Sidewinder, APT_Kimsuky, and Hak5Cloud_C2.

maltrail ioc osx android apt

3r 6t 50i Mar 15, 2026

medium advisory

Maltrail IOCs Targeting Multiple Threat Actors

2 rules 4 TTPs 32 IOCs

This brief analyzes IOCs aggregated by Maltrail on March 13, 2026, revealing network activity associated with multiple threat actors including UNC2465, SideWinder, 0ktapus, LummaC2, XWorm, PowerShell Injector, CyberStrikeAI, and others, indicating potential widespread targeting and diverse attack vectors.

maltrail ioc threat-actor network-traffic

2r 4t 32i Mar 13, 2026

medium advisory

Maltrail IOCs for Android Joker, APT Lazarus, UNC2465, and Powershell Injector

3 rules 3 TTPs 49 IOCs

This brief covers IOCs associated with Android Joker malware, APT Lazarus group, APT UNC2465 activity, and PowerShell Injector campaigns identified by Maltrail on February 25, 2026.

maltrail ioc android_joker apt_lazarus unc2465 powershell_injector

3r 3t 49i Feb 25, 2026

high advisory

Maltrail Feed IOCs Targeting Multiple Verticals

2 rules 2 TTPs 42 IOCs

This brief covers newly identified malicious domains and IPs from the Maltrail feed on 2026-02-19, which are actively being used in various campaigns to deliver malware and facilitate command and control.

maltrail ioc domain ip

2r 2t 42i Feb 19, 2026