{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/threat-actor/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["maltrail","ioc","threat-actor","network-traffic"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOn March 13, 2026, Maltrail, an open-source malicious traffic detection system, identified a series of IOCs associated with various threat actors and campaigns. This intelligence brief focuses on several notable clusters of activity, including those linked to APT groups like UNC2465 and SideWinder, as well as malware families such as LummaC2, XWorm, and PowerShell Injector. The identified IOCs consist primarily of domains and IP addresses used for command and control (C2) or other malicious purposes. This broad spectrum of detected activity suggests a landscape where multiple threat actors are actively probing or exploiting vulnerabilities across different sectors, posing a risk of data theft, ransomware deployment, or persistent compromise. Defenders need to prioritize detections covering these diverse attack vectors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access:\u003c/strong\u003e While the specific initial access vectors are not detailed in the provided source, several of the identified threat actors, such as SideWinder and 0ktapus, are known to utilize phishing campaigns.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalware Delivery/Execution:\u003c/strong\u003e The threat actors deliver their respective payloads via compromised websites or direct execution using techniques such as PowerShell injection.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control:\u003c/strong\u003e The malware establishes a connection to a C2 server using domains such as \u003ccode\u003ervtoolsup.com\u003c/code\u003e (UNC2465), \u003ccode\u003egeo-foundation.vg\u003c/code\u003e (LummaC2), or IP addresses like \u003ccode\u003e172.245.82.123\u003c/code\u003e (SuperShell_C2).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence:\u003c/strong\u003e Some malware families, like XWorm, might use persistence mechanisms to ensure continued access to the compromised system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration:\u003c/strong\u003e LummaC2 is known for stealing sensitive information such as credentials and cookies from web browsers.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement:\u003c/strong\u003e Depending on the attacker's objective, lateral movement may occur within the compromised network to reach valuable assets.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFinal Objective:\u003c/strong\u003e The ultimate goal varies depending on the threat actor. It may include data theft, espionage, or disruption of services. For LokiLocker the goal is ransomware deployment.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact:\u003c/strong\u003e The final impact includes data encryption from ransomware, sensitive data exfiltration, or system compromise, depending on the threat actor's objectives.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe observed network activity associated with these threat actors indicates a potential for widespread compromise. While the exact number of victims remains unknown, the diversity of actors suggests that multiple sectors could be affected. Successful attacks could result in data breaches, financial losses, reputational damage, and disruption of services. Specifically, ransomware attacks (e.g., LokiLocker) could lead to significant operational downtime and financial demands for data recovery. Credential theft (e.g., LummaC2, 0ktapus) could enable further attacks and compromise sensitive systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor network traffic for connections to the IOCs listed in this brief, specifically the domains associated with LummaC2 (e.g., \u003ccode\u003egeo-foundation.vg\u003c/code\u003e, \u003ccode\u003emicroservice.gl\u003c/code\u003e, \u003ccode\u003eros-tele.com\u003c/code\u003e, \u003ccode\u003erostov-uga.com\u003c/code\u003e, \u003ccode\u003eug-network.com\u003c/code\u003e) to detect potential C2 communications.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u0026quot;Detect Connections to DuckDNS Domains\u0026quot; to identify potential XWorm infections using the domains \u003ccode\u003esostener2025.duckdns.org\u003c/code\u003e and \u003ccode\u003eteste258588.duckdns.org\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Connections to Known Malicious IPs\u0026quot; and update it with the IP addresses \u003ccode\u003e172.245.82.123\u003c/code\u003e (SuperShell_C2), \u003ccode\u003e186.169.43.64\u003c/code\u003e (XWorm), \u003ccode\u003e89.124.77.234\u003c/code\u003e (PowerShell_Injector), and the CyberStrikeAI IPs (\u003ccode\u003e115.159.42.173\u003c/code\u003e, \u003ccode\u003e117.72.74.158\u003c/code\u003e, \u003ccode\u003e172.86.114.64\u003c/code\u003e, \u003ccode\u003e43.130.44.204\u003c/code\u003e, \u003ccode\u003e45.192.103.176\u003c/code\u003e, \u003ccode\u003e51.195.25.206\u003c/code\u003e) to detect potential malicious network connections.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-03-13T23:00:14Z","date_published":"2026-03-13T23:00:14Z","id":"https://feed.craftedsignal.io/briefs/2026-03-13-maltrail-iocs/","summary":"This brief analyzes IOCs aggregated by Maltrail on March 13, 2026, revealing network activity associated with multiple threat actors including UNC2465, SideWinder, 0ktapus, LummaC2, XWorm, PowerShell Injector, CyberStrikeAI, and others, indicating potential widespread targeting and diverse attack vectors.","title":"Maltrail IOCs Targeting Multiple Threat Actors","url":"https://feed.craftedsignal.io/briefs/2026-03-13-maltrail-iocs/"}],"language":"en","title":"CraftedSignal Threat Feed - Threat-Actor","version":"https://jsonfeed.org/version/1.1"}