Period: August 2026
Malware Families Detected
A malware family (a group of malware with similar origins and behaviour) is the standard way of classifying threats. The figures below show the number of threat types in each family, not the number of affected devices. Family names are kept in their original form so they can be looked up in any security knowledge base.
| Cryptojacking / mining virus |
|
5 |
| Tunneling / evasion |
|
2 |
| Threat indicator match |
|
1 |
| Worm |
|
1 |
| Phishing |
|
1 |
| Webshell |
|
1 |
| Malicious domain access |
|
1 |
| Exploitation (vulnerability exploitation) |
|
1 |
| Trojan |
|
1 |
| Hacktool |
|
1 |
| Malicious download |
|
1 |
Threat Types Observed
Technical names as reported by the monitoring system.
Threat indicator match
Accessed website with mining Trojan
Infected with worm virus (DGA)
Infected with a mining virus
Access to malicious domain name (phishing Phishing)
Memory Webshell communication
Accessed a large number of malicious domain names
Communication via ngrok
Communication via DNS tunnel
Vulnerability detection by EternalBlue
Access to malicious domain name (coinminer mining)
Access to malicious domain name (kryptik trojan)
Access to malicious domain name (minepool mining)
DNSlog data detected
Access to malicious domain name (xmrig mining)
Malicious file downloaded
Period over period
Period-over-Period Comparison
| Period | Family | Type | Findings |
|---|
| June 2026 |
11 |
24 |
70 |
| July 2026 |
11 |
24 |
99 |
| August 2026 |
11 |
16 |
82 |
What You Can Do
Prevention at Regional Government Agencies
- Make sure the endpoint monitoring agent is active on all workstations and servers, including rarely used devices.
- Update operating systems and applications regularly. Some of the threats above get in through old vulnerabilities for which patches have long been available.
- Be wary of attachments and links in emails and instant messages — the most common entry point for trojans and phishing.
- Do not install pirated software or software from unofficial sources. Cryptojacking malware and hacktools usually hitch a ride there.
- Limit administrator privileges on everyday workstations, so that an infection cannot immediately take over the whole system.
- Report suspicious devices — ones that slow down drastically, whose fans keep spinning, or that show unfamiliar processes — through the KUTIM-CSIRT reporting channel.
Data is sourced from the endpoint monitoring system operated by the East Kutai Regency Government. Device identities, internal addresses, and owning work units are not published; only the number and types of threats are presented. Per-period details are available in the Monthly Reports.