Loading story…
Multiple reporting described phishing-led intrusions that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters APT36/Transparent Tribe and SideCopy, using malicious attachments/links to deliver Windows and Linux payloads including Geta RAT, Ares RAT, and DeskRAT. One documented Windows chain used a malicious LNK that invoked mshta.exe to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms.
Separately, a newly reported CrashFix campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary Python implant plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and Active Directory targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new XWorm variant via a malicious Excel attachment exploiting CVE-2018-0802 to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into Msbuild.exe, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Multiple espionage campaigns targeting Indian defense-sector and government-aligned organizations were reported as using phishing to deliver cross-platform RATs for Windows and Linux, with activity attributed to Pakistan-aligned SideCopy and APT36.
Prior public reporting by CYFIRMA, Seqrite Labs, Sekoia, and QiAnXin XLab documented phishing-led Windows and Linux infection chains tied to SideCopy/APT36, including delivery of Geta RAT, Ares RAT, and DeskRAT against Indian targets.
Fortinet said protections were available across AntiSPAM, Web Filtering, IPS, and AntiVirus services and published campaign URLs, hashes, and the command-and-control endpoint associated with the XWorm activity.
The campaign was found to download an HTA and PowerShell stages, retrieve a hidden .NET loader from a Cloudinary-hosted JPEG, and inject XWorm v7.2 into a suspended Msbuild.exe process using process hollowing before connecting to an AES-encrypted C2 server.
FortiGuard Labs reported a phishing campaign targeting Windows users with business-themed emails carrying malicious Excel add-ins (.XLAM) that exploit Microsoft Equation Editor flaw CVE-2018-0802 to begin a multi-stage infection chain.
Binary Defense ARC Labs assessed that CrashFix deploys a Python implant, additional Python scripts, and a reflectively loaded DLL backdoor, then moves into network mapping and Active Directory targeting, resembling interactive intrusion or access-broker operations.
A newly reported 'CrashFix' intrusion campaign tricked Windows users into executing a command through the Windows Run dialog, after which attackers used built-in tools and in-memory scripts to deploy several backdoors for persistent access.
Reporting cited in the references assesses Pakistan-aligned SideCopy as a subdivision of Transparent Tribe (APT36) and notes it has been active since at least 2019.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcefeeds.fortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026