Loading story…
Proofpoint reported that TA402/Molerats targeted government entities in the Middle East with a new malware family called LastConn, a .NET backdoor that appears to be an updated version of SharpStage. The malware shares several traits with earlier Molerats tooling, including Dropbox API-based command-and-control and checks associated with Arabic-language environments, reinforcing attribution to the long-running espionage group.
Independent reverse engineering showed the sample was heavily obfuscated with .NET Reactor, requiring analysts to recover encrypted strings manually after standard deobfuscation failed. Researchers extracted resource data, identified a 32-byte key-like array, reproduced the string decryption routine in Python, and recovered indicators from calls to the decryption function; the sample also contained a date-based execution check linked to an unregistered .NET Reactor trial message that prevented execution after 2021-06-30.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
One analyzed LastConn sample contained a date-based execution check that refused to continue after June 30, 2021. When run after that date, it threw an exception stating the assembly was protected by an unregistered version of .NET Reactor and would not work further.
Cybereason previously discovered the SharpStage backdoor, a .NET malware family that used the Dropbox API for exfiltration and checked for Arabic on infected machines. LastConn is described as an updated version of this backdoor.
Cybereason released an indicator-of-compromise dataset for Molerats activity covering malware families including SharpStage, DropBook, Spark Backdoor, Quasar RAT, MoleNet Downloader, and a new Pierogi variant, along with hashes, lure files, and attacker-linked infrastructure. The disclosure also listed domains, URLs, IP addresses, and cloud-hosted staging links used for payload delivery, command and control, or exfiltration.
A researcher published analysis of a LastConn sample obfuscated with .NET Reactor, documenting how de4dot failed, how encrypted strings were recovered from resources, and how the decryption logic was replicated in Python. The write-up also detailed indicators and similarities between LastConn and SharpStage.
Proofpoint discovered a recent MOLERATS/TA402 spear-phishing campaign targeting Middle Eastern government organizations and entities with diplomatic relationships in the region. The campaign aimed to exfiltrate sensitive information for intelligence gathering and used the LastConn malware payload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open source0ffset.net
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palestinian-aligned threat group **TA402** (also tracked as **Molerats**) ran a spear-phishing campaign against Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline, delivering a newly identified C# implant called **NimbleMamba**. Researchers said the malware appears designed to replace the group’s older **LastConn** backdoor and was used alongside a secondary trojan, **BrittleBush**, in parts of the operation. The activity was tied to late-2021 and early-2022 intelligence collection efforts focused on carefully selected regional targets. The attackers used evolving delivery chains to limit exposure and evade detection, including geofenced links, actor-controlled domains, Dropbox-hosted payloads, and WordPress-based redirects to legitimate Arabic news sites before serving malicious RAR archives. **NimbleMamba** reportedly includes regional guardrails, anti-analysis checks, and configuration hosted on **JustPasteIt**, while using the **Dropbox API** for command-and-control and data exfiltration. Proofpoint linked the campaign to TA402 through technical overlaps, victim targeting, lure themes, and infrastructure connections between **LastConn** and **NimbleMamba**.
Aug 15, 2026
Researchers described **TA410** as a distinct cyber-espionage umbrella cluster, separate from **APT10**, operating through at least three subgroups: **FlowingFrog**, **LookingFrog**, and **JollyFrog**. The group has targeted victims through spearphishing with **Royal Road** lure documents and by exploiting public-facing **Microsoft SharePoint** and **Exchange** servers, then deploying a broad malware arsenal that includes **FlowCloud**, **LookBack**, **Tendyron**, **X4**, **QuasarRAT**, and **Korplug** to maintain access and conduct intelligence collection. Proofpoint’s analysis of **FlowCloud RAT v4.1.3** showed the malware remained active with a live command-and-control server and provided extensive remote access features, including filesystem and service control, screenshots, shell access, keylogging, plugin support, port mapping, and **Nmap**-assisted lateral movement. The sample used **Protocol Buffers** for configuration and C2 messaging, stored encrypted settings in `winver.dat`, and downloaded components such as **SQLite** and **Nmap** from attacker infrastructure; researchers also highlighted detection opportunities tied to `certutil`-based payload delivery, suspicious `w3wp.exe` process trees, and **LookBack** network signatures.
Aug 15, 2026
TA428 conducted **Operation LagTime IT**, a cyber-espionage campaign targeting government organizations in East Asia and defense- and aviation-related entities in Russia and Mongolia. The intrusions used Royal Road-generated malicious RTF documents exploiting **`CVE-2018-0798`** in Microsoft Word, including lures themed around **Qasem Soleimani** and **COVID-19**, to deliver **Poison Ivy**, **Cotx RAT**, and the malware later identified as **nccTrojan** or **MsmRAT**. Researchers said the activity was observed from at least March 2019 through 2020 and showed overlap with Chinese intrusion clusters including **Tick**, **Tonto**, and possibly **DragonOK/Danti**. After initial compromise, the operators stole credentials from Outlook and **`lsass.exe`**, scanned victim networks, and moved laterally using **`MS17-010`** tooling including EternalBlue-related exploitation. TA428 also used **NBTScan**, DLL side-loading with legitimate Intel and PotPlayer binaries, malicious **`.wll`** files for persistence, and follow-on malware such as **Tmanger**, **Poison Ivy-B**, and multiple **nccTrojan** variants. Researchers found that **nccTrojan** had at least two major branches: an initial-access version with standard RAT functions and XOR-obfuscated traffic, and a later-stage version installed as a Windows service that used a custom TCP protocol with **AES-encrypted** payloads and an activation code for command handling.
Aug 15, 2026