Loading story…
Multiple malware campaigns delivered remote access trojans including NanoCore, NetWire, AsyncRAT, Quasar RAT, and PlugX through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from Microsoft Azure and Amazon Web Services, while DuckDNS domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed AsyncRAT and NetWire, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass Mark-of-the-Web protections and reduced security scrutiny.
Fortinet also linked a separate espionage operation attributed to APT10 to DLL side-loading with the legitimate Java component jjs.exe, loading a malicious jli.dll, decrypting svchost.bin, and injecting shellcode into svchost.exe to deploy PlugX and a modified Quasar RAT. That activity used persistence via a service or a Run key named "Windows Updata", and relied on typosquatted infrastructure such as update.microsofts.org, update.kaspresksy.com, and cahe.microsofts.org. CISA has also tracked Quasar as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Fortinet described a spearphishing attack against a military organization in Colombia using the subject line “Solicitud de Reserva para Mayo 2022” and an ISO attachment named RESERVA.ISO. When mounted and executed, the attachment delivered Quasar RAT communicating with opensea-user-reward[.]serveusers[.]com.
FortiGuard Labs observed another travel-themed AsyncRAT sample named Booking details.exe in early February 2022. The sample was part of a broader campaign using travel lures and connected to znets[.]ddns[.]net and dnets[.]ddns[.]net.
Cisco reported that Cisco Umbrella classified the malicious DuckDNS domains used in the NanoCore, NetWire, and AsyncRAT campaign as malicious on Oct. 26, 2021. The domains supported payload delivery and command-and-control.
Cisco Talos said NanoCore samples in the campaign used leaked version 1.2.2.0 and included a build date of Oct. 26, 2021. Talos also observed DuckDNS-based NanoCore command-and-control domains associated with the activity.
Cisco Talos discovered a phishing campaign around October 2021 delivering NanoCore, NetWire, and AsyncRAT through malicious ZIP attachments containing ISO images and script loaders. The campaign used Azure, AWS, and DuckDNS infrastructure to host payloads and command-and-control services.
Fortinet stated that the domain kingshakes1[.]linkpc[.]net appears to have been used by NetWire RAT since at least May 2021. In the travel-themed campaign, a JavaScript-delivered NetWire sample connected to this domain for command and control.
FortiGuard Labs reported suspected new activity by APT10 in April 2019 in Southeast Asia, with analyzed samples originating from the Philippines. The campaign used DLL side-loading via jjs.exe and malicious jli.dll to load and inject malware payloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourceblog.talosintelligence.com
Open sourcefortinet.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026