Loading story…
Security researchers reported multiple malware campaigns emphasizing stealth and automation. K7 Lab analyzed a Python-based RAT packaged inside an apparently benign ELF executable, effectively embedding a Python runtime and scripts to evade simple file-type controls and complicate static inspection; the RAT also uses adaptive beaconing to reduce network noise by polling C2 rapidly when active (e.g., sub-second intervals) and sleeping longer when idle (e.g., config.HELLO_INTERVAL), lowering the chance of detection by behavior-based monitoring.
Separately, threat reporting described a Vietnamese actor (“Huna”) targeting job seekers with phishing lures (often via Dropbox-hosted archives/links) to deliver PureRAT and related payloads, with tooling that shows strong indicators of generative-AI-assisted development (unusually detailed comments, numbered steps, and even operator instructions embedded in scripts). An Iran-aligned espionage operation attributed to RedKitten targeted Iranian human-rights NGOs and activists using malicious Microsoft Excel lures and multi-stage malware, including AI-generated/obfuscated macros, cloud and messaging platforms for C2 (e.g., GitHub, Google Drive, Telegram), and TTP overlap with known Iranian groups (e.g., Charming Kitten/Nemesis Kitten patterns), indicating continued evolution toward AI-enabled tradecraft and resilient infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
K7 Labs analyzed a Python-based RAT after discovering a suspicious sample on VirusTotal and unpacking its embedded Python runtime. The malware was designed to masquerade as a benign ELF binary, using adaptive beaconing and anti-forensics cleanup features to evade detection and reduce traces on infected systems.
Researchers reported a financially motivated campaign targeting job seekers worldwide with fake employment lures that delivered PureRAT and related malware. The Vietnam-linked actor used trusted cloud services such as Dropbox, DLL sideloading, and Python-based payload retrieval, with artifacts repeatedly referencing "Huna" and the password string "huna@dev.vn."
During the campaign, RedKitten used spearphishing with Farsi-labeled 7-Zip archives containing macro-enabled Excel decoys about protester deaths. Opening the lure triggered an AI-obfuscated VBA dropper that installed the modular SloppyMIO implant, which used AppDomainManager injection, scheduled-task persistence, and a GitHub-to-Google-Drive-to-Telegram cloud C2 chain.
An Iran-linked, Farsi-speaking threat actor dubbed RedKitten began a targeted cyber-espionage campaign in late 2025 against Iranian human rights NGOs, activists, academics, journalists, officials, and business leaders. The operation particularly emphasized Kurdish community targets and reportedly directly impacted at least 50 individuals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityonline.info
Open sourcerescana.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Multiple reports detailed **state-linked intrusion activity** relying on social engineering and trusted delivery mechanisms to gain initial access and establish remote control. Researchers reported a suspected state-affiliated espionage operation targeting government and financial organizations in **Kazakhstan and Afghanistan**, built around a previously unreported Windows DLL implant dubbed **KazakRAT** delivered via malicious `MSI` installers and decoy documents (e.g., a fake Kazakh presidential letter and an Afghan provincial memo). The malware was described as relatively unsophisticated—unencrypted HTTP beaconing and minimal obfuscation—yet capable of host reconnaissance, file search/exfiltration, and downloading/executing additional payloads, enabling long-running access since at least 2022. Separately, Insikt Group described **North Korean** operators (tracked as **PurpleBravo**) running the “**Contagious Interview**” campaign, using fake recruiter personas and weaponized “coding tests” hosted on platforms like GitHub to trick software developers into executing malware on corporate devices, supporting software supply-chain targeting. The toolset reportedly includes **BeaverTail** (JavaScript infostealer) and newly identified RATs **PylangGhost** and **GolangGhost**. In another supply-chain style incident, Trend research and an Emurasoft advisory reported the **official EmEditor download** being tampered with to serve a trojanized `MSI` whose `CustomAction` launched PowerShell to fetch staged payloads from lookalike domains (e.g., `EmEditorjp[.]com`, `EmEditorgb[.]com`, `EmEditorde[.]com`), followed by environment fingerprinting and geofencing checks—highlighting ongoing risk from compromised public software distribution channels.
Jun 29, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026