{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/unc2465/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["maltrail","ioc","android_joker","apt_lazarus","unc2465","powershell_injector"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat brief summarizes indicators of compromise (IOCs) identified by Maltrail on February 25, 2026, linking to several distinct threat actors and campaigns. These include the Android Joker malware known for its malicious billing fraud, APT Lazarus group, APT UNC2465, and campaigns involving the use of PowerShell injectors. The IOCs consist of domains and URLs related to network activity and external analysis of these threats. Notably, a large number of domains were identified without specific attribution, potentially representing a broader infrastructure used across multiple campaigns. Defenders should utilize these IOCs to proactively identify and block malicious activity targeting their networks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003cp\u003eThe following attack chain represents a generalized view based on the observed indicators, as the specific methods vary between the threat actors:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Compromise:\u003c/strong\u003e (Observed for Android Joker): User unknowingly installs a malicious application containing the Joker malware from a third-party app store or via sideloading.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence (Android Joker):\u003c/strong\u003e The malware establishes persistence on the device, often by hiding itself or masquerading as a legitimate application.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control (Various):\u003c/strong\u003e The compromised system communicates with command-and-control (C2) servers using domains like \u003ccode\u003egenad.click\u003c/code\u003e, \u003ccode\u003einfkm.bond\u003c/code\u003e, \u003ccode\u003estmuis.help\u003c/code\u003e, \u003ccode\u003esuluk.cyou\u003c/code\u003e, or others listed in the IOCs.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePowerShell Injection (PowerShell Injector):\u003c/strong\u003e A PowerShell script is executed to inject malicious code into another process, often to evade detection. This may involve domains like \u003ccode\u003ecdn0x.store\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCredential Harvesting (APT Lazarus):\u003c/strong\u003e The Lazarus Group attempts to steal credentials and other sensitive information from the compromised system to facilitate lateral movement.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement (APT Lazarus, UNC2465):\u003c/strong\u003e Using stolen credentials or exploiting vulnerabilities, the attacker moves laterally to other systems within the network, potentially leveraging infrastructure related to \u003ccode\u003ehornetseculty.com\u003c/code\u003e, \u003ccode\u003eapp.breezyhr.us\u003c/code\u003e, and \u003ccode\u003ebreezyhr.us\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration (APT Lazarus, UNC2465):\u003c/strong\u003e Sensitive data is exfiltrated from the compromised network to attacker-controlled infrastructure.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonetary Gain/Espionage (Android Joker, APT Lazarus, UNC2465, PowerShell Injector):\u003c/strong\u003e The ultimate objective ranges from financial gain (Android Joker, PowerShell Injector) through fraudulent activities or data theft to espionage or disruption (APT Lazarus, UNC2465) targeting specific organizations or sectors.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to significant financial losses for victims of Android Joker through billing fraud. APT Lazarus and UNC2465 intrusions can result in the theft of sensitive data, intellectual property, and disruption of critical services. The large number of unattributed domains suggests a broad and potentially widespread malicious infrastructure, which could be leveraged in various campaigns impacting multiple sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor network traffic for connections to the domains listed in the IOC table and block them at the firewall or DNS resolver to disrupt communication with attacker infrastructure.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule for PowerShell injection to detect suspicious PowerShell activity and potential code injection attempts.\u003c/li\u003e\n\u003cli\u003eReview network connection logs for connections to the IP address \u003ccode\u003e147.124.214.235\u003c/code\u003e, associated with APT Lazarus.\u003c/li\u003e\n\u003cli\u003eInvestigate systems that have communicated with any of the unattributed domains in the IOCs to identify potential compromise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-02-25T22:01:17Z","date_published":"2026-02-25T22:01:17Z","id":"https://feed.craftedsignal.io/briefs/2026-02-25-maltrail-iocs/","summary":"This brief covers IOCs associated with Android Joker malware, APT Lazarus group, APT UNC2465 activity, and PowerShell Injector campaigns identified by Maltrail on February 25, 2026.","title":"Maltrail IOCs for Android Joker, APT Lazarus, UNC2465, and Powershell Injector","url":"https://feed.craftedsignal.io/briefs/2026-02-25-maltrail-iocs/"}],"language":"en","title":"CraftedSignal Threat Feed - Unc2465","version":"https://jsonfeed.org/version/1.1"}