Loading story…
Researchers tied multiple malware families used in espionage campaigns to the TA428 cluster, linking the previously undocumented TManger RAT, Smanager/PhantomNet loaders, and the later Mail-O implant through shared code, export names, configuration structures, and command handling. NTT Security reported that TA428 used Poison Ivy, Cotx RAT, and EternalBlue during Operation LagTime IT before deploying TManger, a modular toolset made up of SetUp, MloadDll, and Client components that supports persistence, host reconnaissance, file operations, process execution, keylogging, and screen capture over RC4-encrypted command-and-control traffic.
Separate analysis found Smanager to be closely related to TManger and Albaniiutas, with droppers such as VVSup.exe and SACEventLog.exe unpacking Smanager_ssl.dll, modifying embedded configuration data, and establishing persistence either as a service or through rundll32 using the misspelled exported function Entery. SentinelLabs later assessed that Mail-O, used in a 2021 campaign against the FSB and other Russian government organizations while masquerading as Mail.ru Disk-O software, was a variant of PhantomNet/SManager rather than a Western intelligence tool, reinforcing links to TA428. Across the reporting, the actor was associated with intrusions affecting government and regional targets in East Asia, Southeast Asia, and Russia, showing continued development of a shared malware arsenal for intelligence collection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
SentinelOne assessed that the Mail-O malware used against Russian government organizations was a PhantomNet/SManager variant and that tooling overlaps with TManger supported attribution to the ThunderCats/TA428 umbrella rather than a Western intelligence service.
A Mail-O sample associated with the Russian government targeting campaign was first submitted to VirusTotal on 2021-06-05, enabling further analysis.
In May 2021, NKTsKI and Rostelecom announced that several Russian government institutions, including the FSB, were victims of an APT campaign involving Mail-O malware.
NTT Security Japan published analysis of Smanager, describing it as a malware family closely related to Tmanger and likely used in attacks against Vietnam-related organizations. The report detailed VVSup.exe and SACEventLog.exe droppers, Smanager_ssl.dll behavior, and overlaps with PhantomNet-related tooling.
Avast published reporting on an APT group targeting governmental agencies in East Asia.
In February 2020, NTT Security researchers investigated Operation LagTime IT, an intrusion campaign attributed to TA428. During the compromise, the actor used Poison Ivy and Cotx RAT for control, moved laterally with EternalBlue, and deployed the previously unseen Tmanger RAT on one host.
The Mail-O sample later analyzed by SentinelOne carried a compilation timestamp of 2019-12-20 02:13:01.
Palo Alto Networks Unit 42 reported BBSRAT attacks targeting Russian organizations and linked the activity to the Roaming Tiger cluster.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourceinsight-jp.nttsecurity.com
Open sourcedecoded.avast.io
Open sourceinsight-jp.nttsecurity.com
Open sourceunit42.paloaltonetworks.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TA428 conducted **Operation LagTime IT**, a cyber-espionage campaign targeting government organizations in East Asia and defense- and aviation-related entities in Russia and Mongolia. The intrusions used Royal Road-generated malicious RTF documents exploiting **`CVE-2018-0798`** in Microsoft Word, including lures themed around **Qasem Soleimani** and **COVID-19**, to deliver **Poison Ivy**, **Cotx RAT**, and the malware later identified as **nccTrojan** or **MsmRAT**. Researchers said the activity was observed from at least March 2019 through 2020 and showed overlap with Chinese intrusion clusters including **Tick**, **Tonto**, and possibly **DragonOK/Danti**. After initial compromise, the operators stole credentials from Outlook and **`lsass.exe`**, scanned victim networks, and moved laterally using **`MS17-010`** tooling including EternalBlue-related exploitation. TA428 also used **NBTScan**, DLL side-loading with legitimate Intel and PotPlayer binaries, malicious **`.wll`** files for persistence, and follow-on malware such as **Tmanger**, **Poison Ivy-B**, and multiple **nccTrojan** variants. Researchers found that **nccTrojan** had at least two major branches: an initial-access version with standard RAT functions and XOR-obfuscated traffic, and a later-stage version installed as a Windows service that used a custom TCP protocol with **AES-encrypted** payloads and an activation code for command handling.
Aug 15, 2026
Researchers tied multiple government-focused espionage campaigns to a shared malware development and logistics ecosystem built around **CMSTAR** and related tooling. FireEye’s analysis of 11 APT campaigns found common malware families, overlapping command-and-control infrastructure, reused code-signing certificates, clustered compile times, and distinctive NSIS manifest artifacts, leading to its assessment that a centralized **“Sunshop Digital Quartermaster”** supplied malware and operational support to otherwise separate intrusion groups. The report linked 110 malware binaries and 54 domains across campaigns that used families such as `Trojan.APT.9002`, **PoisonIvy**, and **Gh0st**, and described a Chinese-language **9002 Builder** that further suggested centralized tooling rather than fully independent operators. Palo Alto Networks later documented how that model appeared in real-world government targeting. In Mongolia, spear-phishing attacks used politically themed Word documents exploiting `CVE-2012-0158` and later `CVE-2014-1761` to deploy the **Cmstar** loader and **BBSRAT**, with some lures sent from compromised or likely compromised government-associated email accounts and one sample aimed at nearly 2,000 recipients. A separate campaign against Belarusian government entities used Zapad-2017-themed phishing emails, malicious RTF and macro-enabled Word files exploiting `CVE-2015-1641`, and a disguised SCR file to deliver updated **CMSTAR** variants alongside newly identified backdoors **PYLOT** and **BYEBY**. Across both cases, researchers highlighted shared infrastructure, malware lineage, and tooling overlaps that support the view that multiple espionage operators were drawing from a common malware supply chain.
Aug 15, 2026
Palestinian-aligned threat group **TA402** (also tracked as **Molerats**) ran a spear-phishing campaign against Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline, delivering a newly identified C# implant called **NimbleMamba**. Researchers said the malware appears designed to replace the group’s older **LastConn** backdoor and was used alongside a secondary trojan, **BrittleBush**, in parts of the operation. The activity was tied to late-2021 and early-2022 intelligence collection efforts focused on carefully selected regional targets. The attackers used evolving delivery chains to limit exposure and evade detection, including geofenced links, actor-controlled domains, Dropbox-hosted payloads, and WordPress-based redirects to legitimate Arabic news sites before serving malicious RAR archives. **NimbleMamba** reportedly includes regional guardrails, anti-analysis checks, and configuration hosted on **JustPasteIt**, while using the **Dropbox API** for command-and-control and data exfiltration. Proofpoint linked the campaign to TA402 through technical overlaps, victim targeting, lure themes, and infrastructure connections between **LastConn** and **NimbleMamba**.
Aug 15, 2026