Loading story…
Analysis of the MITRE ATT&CK Evaluations APT29 dataset found an intrusion chain centered on the DMEVALS\pbeesly account, where cod.3aka3.scr executed from C:\ProgramData\victim and quickly spawned cmd.exe and powershell.exe, indicating automated malware launch. Investigators traced PowerShell loading monkey.png, extracting hidden payload data from image pixels, and compiling it in memory through Microsoft-signed binaries csc.exe and cvtres.exe, while the broader telemetry showed far heavier memory-access and registry activity than process-creation events, consistent with an effort to minimize obvious execution artifacts.
A second pivot from a timestomped .tmp file exposed a dense burst of implant behavior tied to a PowerShell-related ProcessGuid, including DLL loads, registry changes, named pipe creation, and rapid file creation and deletion. The same activity chain included an unsigned .pyd module loaded from a Temp directory, creation of rar.exe and sdelete.exe, and hundreds of outbound network connections; Sysmon Event ID 10 then showed PowerShell requesting full access (0x1fffff) to lsass.exe, a strong sign of credential theft, followed roughly 12 minutes later by PsExec connections to a second internal host, indicating lateral movement with stolen credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
About 12 minutes after the LSASS access, PsExec activity connected to a second internal machine, suggesting the operators used stolen credentials for lateral movement. This indicates the intrusion progressed beyond the initial host into another system in the DMEVALS environment.
Review of Sysmon Event ID 10 showed PowerShell requesting full access (0x1fffff) to lsass.exe, indicating credentials were likely harvested directly from memory. This represented a clear escalation from initial execution to credential theft on the compromised host.
A timestomped .tmp file tied to a PowerShell-related ProcessGuid led to a burst of activity consistent with implant setup, including DLL loads, registry changes, named pipe creation, and rapid file creation and deletion. The same process chain also involved an unsigned .pyd module from a Temp directory and spawned cmd.exe, powershell.exe, rar.exe, and sdelete.exe while generating heavy outbound network traffic.
In the MITRE ATT&CK Evaluations APT29 Day 1 dataset, the account DMEVALS\pbeesly appears to be the initial victim as cod.3aka3.scr executes from C:\ProgramData\victim and quickly spawns cmd.exe and powershell.exe. PowerShell then loads monkey.png, extracts hidden payload data from image pixels, and uses Microsoft-signed binaries csc.exe and cvtres.exe to compile and run the payload in memory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026