Loading story…
Cisco Talos reported a targeted phishing campaign that impersonated U.S. Securities and Exchange Commission EDGAR notifications to deliver DNSMessenger, a multi-stage malware family that used malicious Microsoft Word documents for initial access. Instead of relying on macros, the lure documents abused Dynamic Data Exchange (DDE) to trigger obfuscated PowerShell, reflecting the broader macro-less code execution technique documented by SensePost for Microsoft Word. Talos said the campaign selectively targeted organizations and staged payload delivery through attacker-controlled infrastructure, including a compromised Louisiana state government server.
Once executed, DNSMessenger established persistence through multiple mechanisms, including registry Run keys, scheduled tasks, alternate data streams, and WMI event consumers, before shifting command-and-control traffic into DNS. Talos said the malware used DNS A and TXT record queries as a covert bidirectional channel to retrieve later-stage payloads, launch cmd.exe, and exchange commands and output using structured SYN, MSG, and FIN-style messages. Researchers linked the activity to earlier DNSMessenger operations seen in 2017 and highlighted its obfuscation, fileless PowerShell execution, and selective payloading as signs of a sophisticated intrusion set.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Talos reported that some DNSMessenger command-and-control domains had registration dates in February 2017, with some tied to the email address valeriy.pagosyan@yandex.com. This anchored infrastructure associated with the malware campaign before Talos published its analysis.
Cisco Talos later reported additional targeted attacks using DNSMessenger in a campaign that sent spear-phishing emails spoofed as U.S. SEC EDGAR messages to selected organizations. The malicious Word attachments abused DDE rather than macros and fetched PowerShell payloads from attacker-controlled infrastructure, including a compromised Louisiana state government server.
Cisco Talos published analysis of a multi-stage malware infection chain it dubbed DNSMessenger, describing its phishing-delivered Word document, PowerShell stages, persistence mechanisms, and DNS TXT-based bidirectional command-and-control. The report also included indicators of compromise and explained how the malware tunneled commands and output over DNS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourceblog.talosintelligence.com
Open sourcesensepost.com
Open sourcemsdn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks' Unit 42 reported a high-volume spam campaign delivering malicious Microsoft Word documents that used macros to launch hidden PowerShell and inject malware directly into memory, a fileless-style technique the researchers dubbed **PowerSniff**. The emails were socially engineered with victim-specific details and were sent about 1,500 times, primarily targeting organizations in the United States, with notable impact on the professional, hospitality, and manufacturing sectors. The macro abused WMI to spawn a concealed PowerShell process that fetched architecture-specific payloads from `rabbitons[.]pw`, decoded shellcode, and loaded an embedded payload. The malware then performed anti-analysis checks, host reconnaissance, and victim profiling to avoid healthcare and education targets while prioritizing systems linked to point-of-sale activity and financial transactions; if command-and-control communication succeeded, it decrypted a DLL, saved it under `AppData\LocalLow` as a randomly named `.db` file, and executed it through `rundll32.exe` using the `Register` export. Researchers said the infrastructure was inactive during analysis and noted behavioral similarities to the **Ursnif** malware family.
Aug 14, 2026
A large-scale phishing campaign targeted German companies across multiple industries with spoofed emails impersonating legitimate local businesses and carrying archive attachments that hid executables disguised as PDF or document files. Check Point said the payload installed **Remcos**, a commercially available remote access trojan that can give attackers full control of infected systems while operating silently in the background. Once executed, Remcos enabled capabilities including privilege escalation, persistence, process injection, keylogging, screen and audio capture, and password theft. The malware’s command-and-control infrastructure relied on **Dynamic DNS** services, including **No-IP**, aligning with MITRE ATT&CK technique `T1311`, a method that helps operators maintain flexible and evasive C2 endpoints as domains and IP addresses change.
Aug 15, 2026
Researchers traced a **SideWinder** spearphishing campaign to a malicious Word document named **"Briefing on Ongoing Projects.docx"** that fetched a remote RTF template from a spoofed domain and exploited Microsoft Equation Editor via `CVE-2017-11882`. The recovered RTF decrypted embedded JavaScript, launched an obfuscated script, and executed a .NET component that profiled installed antivirus products before attempting to download a further payload stage. Investigators found the originally malicious RTF had later been replaced with a nearly empty placeholder file, a tactic that obscured follow-on analysis while preserving infrastructure clues. Additional infrastructure and tradecraft links tied the activity to broader South Asian espionage patterns involving malicious RTF lures, Equation Editor exploitation, and multi-stage loaders. Fortinet separately documented a spearphishing attack against a telecommunications agency in South Asia using an RTF lure that exploited `CVE-2018-0798`, abused **Logitech** DLL search order hijacking with a signed executable and malicious `LBTServ.dll`, injected into `svchost.exe`, and contacted `instructor[.]giize[.]com` to retrieve a payload linked through OSINT to **PoisonIvy RAT**. Across the references, the campaigns show consistent use of document-based initial access, obfuscated intermediate stages, and reusable infrastructure and tooling associated with long-running regional espionage operations.
Aug 15, 2026