1 malware family

BoredFluff

Also known asBoredFluff

BoredFluff is a financially motivated cybercrime campaign associated with a Remcos RAT phishing operation targeting corporate networks. The activity has been linked to infrastructure and tradecraft tracked under the name BlackToad and assessed as behaviorally aligned with the SilverTerrier ecosystem of West African financially motivated threat activity. Observed operations used Thai-language financial lures masquerading as business payment slips to induce victims to execute a malicious payload disguised as a document. The infection chain relied on a self-extracting archive with deceptive double extensions, followed by a Visual Basic script that temporarily disrupted host internet connectivity to reduce the effectiveness of network-based detection during second-stage execution. Subsequent stages used a renamed AutoIt3 interpreter and RC4-decrypted configuration data to initialize Remcos RAT and maintain resilient command-and-control through redundant dynamic DNS-backed infrastructure. The campaign demonstrates capabilities spanning initial access, defense evasion, persistence, and post-exploitation, with a focus on commodity remote-access malware delivery in support of financially motivated intrusion activity.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Where they're from

Attributed origin per open-source reporting.

MITRE ATT&CK

Tradecraft

1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

1 of 15 tactics1 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566

Phishing

ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen

RemcosSecurity professionals recently discovered a highly dangerous malicious email operation targeting corporate networks. Specifically, threat actors initiated a sophisticated Remcos RAT phishing campaign... This structural evolution within the Remcos RAT phishing campaign allows the primary remote access trojan module to initialize smoothly.1Jun 2, 2026

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

security online infoNews

Jun 2, 2026

Remcos RAT Phishing Campaign Uses Network Blackout

An active campaign operationally connected to the same infrastructure used in the observed Remcos RAT phishing activity.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping1

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

BoredFluff

Also known asBoredFluff