Loading story…
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy Cobalt Strike. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called IndigoDrop into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials.
A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP Host headers such as update.windows.microsoft.com, and in some variants injected an RSA-encrypted payload into notepad.exe; researchers also identified infrastructure including 47.240.73.77, 114.67.110.37, and 360doc.com-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By September 2019, the operators had productionized IndigoDrop-based samples and later shifted to Pastebin-hosted shellcode with additional anti-infection checks, indicating an evolution in delivery and staging tradecraft.
Cisco Talos traced the earliest observable variant of the campaign to April 2018, when malicious macros dropped a .crt file that was decoded with certutil into an SMB-based Cobalt Strike beacon.
Zscaler observed a related .NET payload variant that decrypted an RSA-encrypted payload and injected it into notepad.exe, while concluding it could not confidently attribute the campaign despite overlaps with OceanLotus and a watermark previously seen in Trickbot-related activity.
Zscaler ThreatLabZ analyzed a targeted attack using a malicious Word document themed around the India-China border dispute to launch a fileless infection chain that ultimately deployed a Cobalt Strike beacon over HTTPS.
Cisco Talos reported a targeted malware campaign using military-themed Office lures, likely aimed at military and government organizations in South Asia, to deliver IndigoDrop and customized Cobalt Strike beacons through a multistage infection chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcecobaltstrike.com
Open sourcecyber.wtf
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple spear-phishing campaigns targeting Indian government and military personnel with **COVID-19-themed** and investigation-themed decoy documents delivered through disk image files. In one operation attributed with moderate confidence to **Transparent Tribe**, victims received an `IMG` file containing a benign vaccination PDF, a malicious shortcut, and a `VBS` script that launched **PeppyRAT**, a Python-based Windows payload. The malware gathered host and process information, sent it to command-and-control servers over `HTTP`, and established persistence by placing a .NET loader in the Windows Startup folder to await a second-stage DLL, `mscontainer.dll`, which researchers said may be previously undocumented. A separate campaign aimed at Indian government and local institutions used `ISO` files with `LNK` shortcuts and malicious DLLs that were executed through `rundll32.exe` to load **Cobalt Strike** beacons directly in memory. Researchers said the lures referenced cyberattack investigations and COVID-19 precautions, while the infrastructure included the domain `instade.co.in` and compromised systems tied to `comesa.int`, including `covid.comesa.int`. Analysis of the loader showed XOR-encrypted strings, custom API hashing, PEB walking for API resolution, and `LZNT1`-compressed embedded payloads; the beacons also shared the same public key and watermark, suggesting linked operator infrastructure even though attribution remained unconfirmed.
Aug 15, 2026
Researchers and U.S. authorities reported multiple spearphishing campaigns linked with moderate confidence to **APT29/Nobelium/Cozy Bear** that targeted government agencies, NGOs, research institutions, embassies, and other high-value organizations. In one campaign, emails impersonating **USAID** used **Constant Contact** links to deliver malicious ISO files containing a decoy PDF, a weaponized **`.lnk`** shortcut, and a DLL loader that launched **Cobalt Strike Beacon** through `rundll32.exe`; CISA said the beacon used HTTP traffic disguised as requests for **`.woff2`** files and embedded metadata in a `_cfuid` cookie while contacting infrastructure including **theyardservice.com** subdomains and **worldhomeoutlet.com**. Volexity also identified a second-stage malware family, **FRESHFIRE**, which retrieved encrypted payloads from Firebase and decrypted them with host-specific logic before deleting the remote content. The activity fit a broader pattern seen in earlier and later operations attributed to the same cluster. FireEye documented a separate campaign in which attackers impersonated the **U.S. Department of State**, delivered ZIP archives with malicious shortcuts, used PowerShell to drop a decoy document, and installed Cobalt Strike Beacon communicating with **pandorasong.com** via a modified malleable C2 profile. Fortinet later described embassy-focused phishing that used **HTML smuggling** to build an ISO on the victim system, then relied on shortcut-triggered DLL execution to deploy another beacon, showing continued reuse of ISO-based delivery, decoy documents, and staged loaders across politically themed intrusion attempts.
Aug 15, 2026
Targeted intrusion campaigns used tampered **Microsoft-signed DLLs** to evade trust checks and launch malware through **DLL side-loading** and service hijacking. LAC researchers documented the **SigLoader** malware family modifying data in a file's certificate or overlay area while preserving Windows signature validation, allowing the DLL to still appear legitimately signed. The loader then decrypted and executed additional stages in memory using layered routines including **XOR**, custom **DES**, **AES**, and later **RC4**, with observed payloads including **DelfsCake**, **GreetCake**, and shellcode associated with **Metasploit Framework** or **Cobalt Strike**. In one case, the intrusion began with exploitation of an **SSL-VPN vulnerability** before the loader was deployed on a compromised endpoint. A related campaign assessed as likely tied to **APT41** used the same signed-DLL abuse technique to deliver **Cobalt Strike Beacon**, including a tampered `KBDTAM131.DLL` derived from `UXLibRes.dll` and malicious loading via the Windows **IKEEXT** service and `wlbsctrl.dll`. Researchers said the loader stored encrypted configuration data, API strings, offsets, and payload content with **ChaCha20**, then decrypted a Beacon linked to a leaked or cracked **Cobalt Strike 4.x** build using watermark `0x12345678` and C2 over **HTTPS**, with other samples using **HTTP** or **DNS**. The activity was also tied to a malicious shortcut file masquerading as a PDF, campaign infrastructure including `119.45.238[.]189` and `192.109.98[.]187`, and detection guidance using **Sigcheck**, **Autoruns**, Windows event logs, YARA rules, and stricter Authenticode verification.
Aug 15, 2026