Loading story…
Researchers reported an active cyberespionage campaign dubbed Operation HumanitarianBait that uses Russian-language humanitarian aid request themes to lure victims into opening a malicious .lnk file packaged inside a .rar archive. The shortcut launches PowerShell to decode obfuscated content, opens a decoy humanitarian aid PDF to distract the user, and silently installs a fileless, PE-less Python implant from GitHub Releases into a fake WindowsHelper directory under %APPDATA%. The payload is protected with PyArmor v9.2 Pro, helping it evade scrutiny while blending into legitimate developer traffic.
Once installed, the malware establishes persistence through VBScript launchers and a recurring Windows Scheduled Task, then conducts broad surveillance and theft. Reported capabilities include browser credential and cookie theft, keylogging, clipboard and screenshot capture, file theft, and Telegram session theft, with optional covert remote access through RustDesk or AnyDesk. Stolen data is exfiltrated to a live custom Flask-based command-and-control server at 159.198.41[.]140 on a Namecheap VPS, and researchers said the Russian-language lures suggest the operation is aimed at Russian-speaking individuals or organizations, including those tied to aid distribution, civil administration, or government functions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Cyble Research and Intelligence Labs reported an active cyberespionage campaign dubbed Operation HumanitarianBait that uses Russian-language humanitarian aid lures in phishing emails to deliver a malicious LNK file inside a RAR archive. The campaign installs a fileless, PE-less Python implant hosted on GitHub Releases, establishes persistence, steals credentials and other data, and communicates with a live C2 server at 159.198.41[.]140; attribution was not confirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcecybersecuritynews.com
Open sourcecyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Armored Likho, a previously undocumented APT group also linked by indirect indicators to **Eagle Werewolf**, has been running a spear-phishing campaign against government agencies and electric power organizations in **Russia, Kazakhstan, and Brazil**. The attackers deliver a newly identified Python-based infostealer, **BusySnake Stealer**, through archive attachments containing either NSIS-built executable droppers or malicious `.lnk` files, including samples that abuse `ZDI-CAN-25373` to conceal command-line arguments. Researchers said the malware is heavily obfuscated with **PyArmor** and that some first-stage loaders appear to be AI-generated, complicating attribution while preserving the group’s broader tradecraft. Once installed, BusySnake establishes persistence with **VBScript** and scheduled tasks, then steals browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware also supports reverse SSH tunneling and remote control, downloads Python runtimes and dependencies, and in newer variants fetches and executes Python payloads directly in memory while tracking task status through an updated C2 framework. Reported infrastructure includes `159.198.41[.]140` and `grked[.]online`, and researchers noted architectural overlap with **AquilaRAT** and functional similarities to **Go2Tunnel**, reinforcing the attribution to Armored Likho.
Jul 3, 2026
Multiple threat reports describe **social-engineering-driven malware delivery** leading to remote access and follow-on payload deployment. Fortinet observed a **multi-stage phishing campaign targeting users in Russia** that delivers **Amnesia RAT** and ransomware via business-themed decoy documents and a malicious `.lnk` shortcut using a double extension (e.g., `*.txt.lnk`). The infection chain uses public cloud services for staging—**GitHub** for scripts and **Dropbox** for binary payloads—and abuses **defendnot** to trick Windows into believing a third-party AV is installed, effectively disabling **Microsoft Defender** before later-stage execution. Separately, Huntress attributed activity to **KongTuke**, which uses **malicious browser extensions** to display fake “browser crash” security alerts (“**CrashFix**”) that pressure users into running attacker-provided commands, and also deploys a Python RAT dubbed **ModeloRAT**. ModeloRAT is described as heavily obfuscated, using **Windows Registry** persistence and **RC4**-encrypted communications, with the ability to deliver additional payloads (DLLs, executables, scripts). Red Canary’s January intelligence update highlights **Scarlet Goldfinch** activity using **paste-and-run** lures and a notable technique of using the Windows `finger` client to pull remote content (e.g., `finger user@IP | cmd`), followed by `curl` download of an archive masquerading as a PDF and extraction via `tar -xf`, culminating in **Remcos** (and sometimes **NetSupport**) delivered via **DLL sideloading**.
Jun 29, 2026
Attackers distributed malicious Windows shortcut (`.LNK`) files disguised as privacy consent forms and other work-related documents, tricking users into launching obfuscated PowerShell that fetched additional payloads from external infrastructure. Reporting indicates GitHub was used as a covert stage in the infection chain, helping operators blend malicious downloads and command retrieval into legitimate web traffic while keeping much of the activity fileless and in memory. Once executed, the malware created downloader and loader scripts, established persistence through Windows Task Scheduler, opened decoy documents to reduce suspicion, and deleted the original shortcut to limit forensic artifacts. Observed follow-on payloads included an information stealer and a backdoor loader that decrypted and loaded malware into memory; the theft activity gathered host, security product, network, IP, drive, file, and process data, with behavior resembling prior **Kimsuky**-linked operations.
Jun 29, 2026