← APTtrail activity.json

Recent activity

The newest batches of indicators across every tracked group. Each one is a set of indicators that appeared upstream on a single day, under the report it was filed with.

Batches
150
Indicators
22,777
Groups
21
Window
2026-07-04 → 2026-08-07

Dates are when an indicator entered Maltrail, not when the actor first used it. A batch appearing today can still describe old infrastructure. For additions and removals at this project's own level, see feeds/changes.

Lazarus Group G003210 ipv4
microsoft.com/en-us/security/blog/2026/02/24/c2-devel…
UNC2465 8 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
Sidewinder G01215 domain
x.com/joe4security/status/2085384961570349091 · joesandbox.com/joereverser/analysis/2e03ffcc-7c06-455e… · virustotal.com/gui/file/3b9432019a80a62fe6760a65f26777… · +1
Sidewinder G01213 domain
x.com/volrant136/status/2085410874051981755

UNC6691 7,221 domain, 5 ipv4
validin.com/blog/aye_coruna_ios_exploit_kit_c2
Kimsuky G009462 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
UNC2465 15 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
Lazarus Group G00323 ipv4
microsoft.com/en-us/security/blog/2026/02/24/c2-devel…
UNC6691 3 domain
cloud.google.com/blog/topics/threat-intelligence/coruna-… · iverify.io/blog/coruna-inside-the-nation-state-gra… · validin.com/blog/aye_coruna_ios_exploit_kit_c2

Inception G010014 domain
twitter.com/felixaime/status/1601257303080308739 · twitter.com/felixaime/status/1601257305294921728
Lazarus Group G00321 domain, 3 ipv4
x.com/ishivtripathi/status/2084907438243991883 · virustotal.com/gui/file/ab65cef60fc097c2a9fb03a7855c9c… · virustotal.com/gui/file/225d7482772a26e4236d91cae51197… · +1
Sidewinder G01214 domain
x.com/blackorbird/status/2084940847863509476 · mp.weixin.qq.com/s/PALBLusD4umh_52gy2wVAg
Lazarus Group G00321 domain
x.com/KseProso/status/2084984281785389166

MuddyWater G00691,932 domain
security.com/threat-intelligence/iran-seedworm-elect… · virustotal.com/gui/ip-address/192.124.216.133/relations · virustotal.com/gui/ip-address/217.71.204.197/relations · +1
Kimsuky G009442 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
UNC2465 5 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
UNC6691 1 domain
validin.com/blog/aye_coruna_ios_exploit_kit_c2

MuddyWater G00691,400 domain
security.com/threat-intelligence/iran-seedworm-elect… · virustotal.com/gui/ip-address/192.124.216.133/relations · virustotal.com/gui/ip-address/217.71.204.197/relations · +1
Transparent Tribe G0134264 domain
x.com/PrakkiSathwik/status/1979514409551819168
MuddyWater G0069122 domain
x.com/phatomcandle/status/2079989870622298451
Transparent Tribe G013415 domain
x.com/Malwarehunterr/status/20734652178882234…
Kimsuky G009414 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Transparent Tribe G013413 domain
x.com/skocherhan/status/2066130507427983633
Patchwork G004010 domain, 2 url_path
x.com/SinghSoodeep/status/2084220447487381592 · virustotal.com/gui/file/d1ae51e18644263c9fdf618b285c97… · virustotal.com/gui/file/6d142127e10dc9bd88e804d0f71278…
Lazarus Group G00321 domain
blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-fo… · blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-tha… · virustotal.com/gui/file/d8de31bcaf5b9ebb99bef36244b0ab…
MuddyWater G00691 url_path
virustotal.com/gui/file/8ab83a870b4015ecba44502697d5c0… · virustotal.com/gui/file/addc18597f18cd87b2b3e0e2cab2b9…
UNC2465 1 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1

Kimsuky G00949 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
PAPERWEREWOLF 9 domain
x.com/phatomcandle/status/2083976136669974980 · virustotal.com/gui/ip-address/130.49.213.54/relations · virustotal.com/gui/ip-address/213.165.61.50/relations · +1
APT29 G00161 domain
x.com/LloydLabs/status/2083594247547068883 · microsoft.com/en-us/security/blog/2026/07/31/captivec…
PAPERWEREWOLF 1 domain
bi.zone/eng/expertise/blog/kamen-nozhnitsy-buma… · virustotal.com/gui/ip-address/193.233.18.135/relations · virustotal.com/gui/ip-address/213.165.61.226/relations · +7

Kimsuky G009470 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
APT29 G00165 domain, 14 ipv4, 1 url_path
x.com/LloydLabs/status/2083594247547068883 · microsoft.com/en-us/security/blog/2026/07/31/captivec…
UNC2465 12 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
Sidewinder G01211 domain
x.com/phatomcandle/status/2077737009569808478 · x.com/volrant136/status/2083246886262313189 · virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5…

Patchwork G00401 domain
app.validin.com/detail?type=hash&find=caa62d2795e1d6656… · virustotal.com/gui/ip-address/206.188.197.82/relations · virustotal.com/gui/ip-address/45.61.139.141/relations · +2

Kimsuky G009438 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
UNC2465 5 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1

Kimsuky G009496 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Charming Kitten G005829 domain, 1 url_path
securelist.com/mirage-kitten-new-tools/120811
TRIANGULATION 3 domain, 12 url_path
x.com/blackorbird/status/2082028695909449873 · virustotal.com/gui/ip-address/185.151.31.6/relations · gendigital.com/blog/insights/research/chasing-an-angry… · +1
Lazarus Group G00325 domain, 6 ipv4, 2 url
x.com/tuckner/status/2065140621497561236 · gist.github.com/danslo/1778c3bf30d65967db2d680727cbc89d
UNC2465 3 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
Kimsuky G00942 domain
x.com/malwrhunterteam/status/2036158996554637…
Kimsuky G00941 ipv4
asec.ahnlab.com/en/94552

Kimsuky G0094117 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
UNC2465 34 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
Patchwork G00408 domain
x.com/ThreatBookLabs/status/19749881418546094…
Lazarus Group G00321 domain
x.com/malwrhunterteam/status/2064325045938274… · x.com/malwrhunterteam/status/2069411902774472… · virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e94… · +9
Lazarus Group G00321 ipv4
x.com/KirkDerpca/status/2065027462761787802 · panther.com/blog/tracking-an-ottercookie-infosteale…
Sidewinder G01211 domain
x.com/volrant136/status/1923061758643597787

Sidewinder G012112 domain
x.com/volrant136/status/2081805669175370115

Patchwork G00403 domain
cyderes.com/howler-cell/tracking-donot-apt-c-35-ban…

APT38 G0082320 domain, 2 ipv4, 1 url
jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfi…
APT32 G00501 domain
x.com/skocherhan/status/2080796885774680487 · virustotal.com/gui/file/d1cdeea8a081397632c0522476da21…

Transparent Tribe G01345 domain, 1 ipv4, 3 url_path
x.com/goldenjackel12/status/20805278484321486… · x.com/goldenjackel12/status/20805290139243890… · virustotal.com/gui/file/67bbed4c71f93013910a8443fd92f4…
Sidewinder G01211 domain
x.com/volrant136/status/2080669471878819889

MuddyWater G00694,406 domain
x.com/phatomcandle/status/2079989870622298451
MuddyWater G0069949 domain
security.com/threat-intelligence/iran-seedworm-elect… · virustotal.com/gui/ip-address/192.124.216.133/relations · virustotal.com/gui/ip-address/217.71.204.197/relations · +1
MuddyWater G0069783 domain
security.com/threat-intelligence/iran-seedworm-elect… · virustotal.com/gui/ip-address/192.124.216.133/relations · virustotal.com/gui/ip-address/217.71.204.197/relations · +2
Kimsuky G009425 domain, 2 ipv4
enki.co.kr/media-center/blog/analysis-of-kimsuky-s…
Kimsuky G009420 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Kimsuky G00945 domain, 2 ipv4, 1 url
asec.ahnlab.com/en/94552
APT32 G00504 domain
x.com/blackorbird/status/2079936188832723190 · mp.weixin.qq.com/s/FIDg23u6Peb_cR8N7ddzbA · virustotal.com/gui/ip-address/211.4.0.204/relations
Sidewinder G01213 domain
x.com/phatomcandle/status/2077737009569808478 · x.com/volrant136/status/2083246886262313189 · virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5…
Lazarus Group G00322 domain
x.com/2eroHunter/status/2059205570393997429 · virustotal.com/gui/file/163e4a72cbe392c073eddc60aee69d…
Patchwork G00401 domain
x.com/ThreatBookLabs/status/19749881418546094…

Kimsuky G009427 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
UNC2465 8 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
Transparent Tribe G01345 domain
x.com/Malwarehunterr/status/20734652178882234…
Lazarus Group G00321 domain, 2 ipv4
x.com/blackbigswan/status/2079687425757249884
Lazarus Group G00322 ipv4
x.com/zoomeye_team/status/1901822378348568825 · x.com/blackorbird/status/1993135605623218560 · socket.dev/blog/lazarus-strikes-npm-again-with-a-n… · +3
Lazarus Group G00322 domain
x.com/nextronresearch/status/2079454428038406… · virustotal.com/gui/file/1aadea997fc4eda5a8a04e68f6e182… · virustotal.com/gui/file/c107419b6b4c793c92289f00cbb229…
Lazarus Group G00321 domain
x.com/L0Psec/status/2020850377801781319 · virustotal.com/gui/ip-address/95.169.180.198/relations · virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0… · +2

UNC2465 96 domain
x.com/g0njxa/status/2010485906466394343 · x.com/g0njxa/status/2027082406847709524 · virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f… · +1
Kimsuky G009477 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Lazarus Group G003221 domain, 3 ipv4
socradar.io/blog/dprk-clickfake-pylangghost-golangg…
Transparent Tribe G013411 domain
x.com/Malwarehunterr/status/20734652178882234…
Lazarus Group G003210 ipv4
x.com/malwrhunterteam/status/1991488257708945… · x.com/banthisguy9349/status/20125522201017386… · research.jfrog.com/post/hijacked-npm-vscode-tasks-blockcha… · +2
Lazarus Group G00322 ipv4
app.validin.com/detail?find=Node.js%20upload%20multiple… · app.validin.com/detail?find=VScode&type=raw&ref_id=689d…
Lazarus Group G00321 domain
x.com/malwrhunterteam/status/2064325045938274… · x.com/malwrhunterteam/status/2069411902774472… · virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e94… · +9
Lazarus Group G00321 domain
virustotal.com/gui/ip-address/82.29.157.117/relations · app.validin.com/detail?find=%3A%3A%3A%22keywords%22%3A%…
Lazarus Group G00321 domain
virustotal.com/gui/ip-address/76.76.21.241/relations

Kimsuky G009432 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Lazarus Group G00325 domain
x.com/banthisguy9349/status/20790774051138603… · virustotal.com/gui/file/41ee7ddb2be173686dc3a73a49b4e9…
Lazarus Group G00321 domain
x.com/nextronresearch/status/2079118025236566…
Lazarus Group G00321 domain
x.com/L0Psec/status/2020850377801781319 · virustotal.com/gui/ip-address/95.169.180.198/relations · virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0… · +2
Lazarus Group G00321 ipv4
x.com/KfishNFT/status/2014379828787494923 · x.com/g0njxa/status/2014800328105894004 · radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-inter… · +4
Lazarus Group G00321 domain
virustotal.com/gui/ip-address/104.21.39.124/relations
UNCLASSIFIED 1 ipv4
x.com/malwrhunterteam/status/2079157644611223… · virustotal.com/gui/file/566cc087706f3d3a0e49b9a1d9c8e2… · virustotal.com/gui/file/6d0573a78716d51a5fa5282d99a956…

Kimsuky G00942 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921

Lazarus Group G00327 domain, 5 ipv4
elastic.co/security-labs/contagious-interview-malw…
Lazarus Group G00322 domain, 4 ipv4
x.com/L0Psec/status/2020850377801781319 · virustotal.com/gui/ip-address/95.169.180.198/relations · virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0… · +2
Transparent Tribe G01345 domain
x.com/Malwarehunterr/status/20734652178882234…
Kimsuky G00943 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Sidewinder G01211 domain
x.com/skocherhan/status/2027484078132379889

Charming Kitten G0058102 domain
x.com/nextronresearch/status/2078037561667142… · nextron-systems.com/2026/06/01/detecting-nimbus-manticore-a…
Charming Kitten G005835 domain
unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens · research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-…
Lazarus Group G003210 domain
x.com/L0Psec/status/2077401458505359828 · virustotal.com/gui/file/795034792aa705f730dd498c51cbd6…
Lazarus Group G00323 ipv4
kl4r10n.tech/blog/dprk-new-malware
Kimsuky G00943 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921

Kimsuky G009412 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Patchwork G00401 domain, 9 url_path
cyderes.com/howler-cell/tracking-donot-apt-c-35-ban…
APT38 G00822 ipv4
validin.com/blog/i_cant_hear_you_unc1069

Sandworm Team G0034179 domain
cert.gov.ua/article/6318437
APT38 G008240 domain, 12 ipv4, 1 url, 1 url_path
x.com/ramimacisabird/status/20388138501794491… · app.garnet.ai/public/detections/6c823543-6d82-5677-80… · stepsecurity.io/blog/axios-compromised-on-npm-malicious… · +6
Kimsuky G009413 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921

Kimsuky G0094110 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Transparent Tribe G01342 domain
x.com/Malwarehunterr/status/20734652178882234…

Kimsuky G009416 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Transparent Tribe G01344 domain
x.com/Malwarehunterr/status/20734652178882234…
Lazarus Group G00321 domain
x.com/L0Psec/status/2020850377801781319 · virustotal.com/gui/ip-address/95.169.180.198/relations · virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0… · +2

Kimsuky G009417 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Transparent Tribe G01345 domain
x.com/Malwarehunterr/status/20734652178882234…

Sidewinder G01219 domain
x.com/suyog41/status/2075572390315311333 · virustotal.com/gui/file/372226c831de35186e1c96ec28c9ca… · virustotal.com/gui/file/5ef25d162827195f2fbdc80fd5c6d1…
Sidewinder G01211 domain
x.com/volrant136/status/2076012175685287991

MuddyWater G00692,137 domain
security.com/threat-intelligence/iran-seedworm-elect… · virustotal.com/gui/ip-address/192.124.216.133/relations · virustotal.com/gui/ip-address/217.71.204.197/relations · +1
Kimsuky G009414 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
APT41 G00964 domain, 1 ipv4
sentinelone.com/labs/one-target-china-india-espionage-c… · virustotal.com/gui/ip-address/45.125.32.218/relations · virustotal.com/gui/file/4d7da83ed24320959b067e0ac9682f…
Lazarus Group G00321 domain
x.com/L0Psec/status/2020850377801781319 · virustotal.com/gui/ip-address/95.169.180.198/relations · virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0… · +2
Lazarus Group G00321 ipv4
x.com/KfishNFT/status/2014379828787494923 · x.com/g0njxa/status/2014800328105894004 · radar.securityalliance.org/vs-code-tasks-abuse-by-contagious-inter… · +4

MuddyWater G0069886 domain
security.com/threat-intelligence/iran-seedworm-elect… · virustotal.com/gui/ip-address/192.124.216.133/relations · virustotal.com/gui/ip-address/217.71.204.197/relations · +1
Kimsuky G009469 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Lazarus Group G00328 ipv4
microsoft.com/en-us/security/blog/2026/02/24/c2-devel…
Transparent Tribe G01342 domain
x.com/Malwarehunterr/status/20734652178882234…
KUN3 2 ipv4
virustotal.com/gui/file/0708f3595043f59f7651f0369942f0…
UNC6691 2 domain
validin.com/blog/aye_coruna_ios_exploit_kit_c2
APT41 G00961 domain
app.validin.com/detail?type=hash&find=e760bb9ce1e83e274…

Kimsuky G00943 domain
x.com/Ghostyak/status/2022116338874167552 · virustotal.com/gui/ip-address/118.193.68.242/relations
Lazarus Group G00321 domain
virustotal.com/gui/file/a1e96380809fa22b8ba0c9377e52b7…

Kimsuky G009442 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Mustang Panda G012915 ipv4
x.com/Cyberteam008/status/2074340012288844049
Lazarus Group G00325 domain, 1 ipv4
x.com/malwrhunterteam/status/2074106725951590… · virustotal.com/gui/ip-address/144.172.110.53/relations · tria.ge/260706-qky96abw2q/behavioral1
Lazarus Group G00325 domain
x.com/L0Psec/status/2020850377801781319 · virustotal.com/gui/ip-address/95.169.180.198/relations · virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0… · +2
Lazarus Group G00321 url
x.com/veryseriouseng/status/20741320071063597…

CAVERNMANTICORE 9 domain
research.checkpoint.com/2026/cavern-manticore-exposing-iran-lin… · virustotal.com/gui/file/ccf218189c3aadb1c761da14bfda3b… · virustotal.com/gui/file/cbc9485db715e1b8cc384fe94b4cce…
Kimsuky G00947 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Lazarus Group G00324 domain, 1 ipv4
x.com/L0Psec/status/2020850377801781319 · virustotal.com/gui/ip-address/95.169.180.198/relations · virustotal.com/gui/file/41c24510d95fcafc4cc3c31bebccc0… · +2
Lazarus Group G00322 ipv4
x.com/zoomeye_team/status/1901822378348568825 · x.com/blackorbird/status/1993135605623218560 · socket.dev/blog/lazarus-strikes-npm-again-with-a-n… · +3
Lazarus Group G00321 domain
x.com/skocherhan/status/2074059180256739719
Lazarus Group G00321 url
x.com/nextronresearch/status/2074031725764633…
Lazarus Group G00321 domain
x.com/banthisguy9349/status/20741297936926887…

Transparent Tribe G013431 domain
x.com/Malwarehunterr/status/20734652178882234…
Kimsuky G00946 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Sidewinder G01213 domain
x.com/volrant136/status/2073667741438103962 · x.com/volrant136/status/2073668614679650761
Patchwork G00401 domain
x.com/malwrhunterteam/status/1928036337292132… · virustotal.com/gui/ip-address/185.225.17.36/relations · app.validin.com/detail?find=b0a0f886d1efaa5802076ac2104… · +2

Transparent Tribe G0134320 domain
x.com/Malwarehunterr/status/20734652178882234…
Kimsuky G009435 domain
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
Sidewinder G01211 domain
x.com/volrant136/status/2073059201346408940
Transparent Tribe G01341 domain
x.com/skocherhan/status/2066130507427983633 · x.com/Malwarehunterr/status/20734652178882234…