Loading story…
Researchers tied multiple government-focused espionage campaigns to a shared malware development and logistics ecosystem built around CMSTAR and related tooling. FireEye’s analysis of 11 APT campaigns found common malware families, overlapping command-and-control infrastructure, reused code-signing certificates, clustered compile times, and distinctive NSIS manifest artifacts, leading to its assessment that a centralized “Sunshop Digital Quartermaster” supplied malware and operational support to otherwise separate intrusion groups. The report linked 110 malware binaries and 54 domains across campaigns that used families such as Trojan.APT.9002, PoisonIvy, and Gh0st, and described a Chinese-language 9002 Builder that further suggested centralized tooling rather than fully independent operators.
Palo Alto Networks later documented how that model appeared in real-world government targeting. In Mongolia, spear-phishing attacks used politically themed Word documents exploiting CVE-2012-0158 and later CVE-2014-1761 to deploy the Cmstar loader and BBSRAT, with some lures sent from compromised or likely compromised government-associated email accounts and one sample aimed at nearly 2,000 recipients. A separate campaign against Belarusian government entities used Zapad-2017-themed phishing emails, malicious RTF and macro-enabled Word files exploiting CVE-2015-1641, and a disguised SCR file to deliver updated CMSTAR variants alongside newly identified backdoors PYLOT and BYEBY. Across both cases, researchers highlighted shared infrastructure, malware lineage, and tooling overlaps that support the view that multiple espionage operators were drawing from a common malware supply chain.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Unit 42 observed 20 phishing emails sent between June and August targeting Belarusian government entities, especially defense, foreign affairs, border, and internal affairs organizations. The campaign used updated CMSTAR variants delivered via RTF exploits, macro-enabled Word documents, and a disguised SCR file.
Unit 42 analyzed a campaign targeting multiple Mongolian government offices from August 2015 through February 2016 using weaponized Word documents, Cmstar, and BBSRAT. Later samples added CVE-2014-1761 alongside CVE-2012-0158, and the report linked the tooling to a possible shared 'Digital Quartermaster.'
A phishing email from davaa_ayush@yahoo.com targeted davaa_ayush@mod.gov.mn, suggesting the victim's personal email account may also have been compromised. Palo Alto highlighted this as evidence of attacker access beyond official government accounts.
A phishing email from bilguun@masm.gov.mn used a Dalai Lama-themed lure and targeted nearly 2,000 recipients within the Mongolian government. The scale of the mailing showed broad targeting within government networks.
A phishing email from ganbat_g@bpo.gov.mn targeted a Mongolian government recipient using a lure about the Beijing military parade. The message was part of the broader spear-phishing campaign against Mongolian government offices.
A phishing email sent from altangadas@energy.gov.mn targeted multiple Mongolian government officials with a document themed around Victory Day. Palo Alto cited this as one of the earliest specifically dated emails in the campaign.
In a May 2015 report, Unit 42 analyzed the Cmstar downloader used in spear-phishing attacks exploiting CVE-2012-0158 and linked it to the Lurid/Enfal malware ecosystem. The researchers cited shared infrastructure, recurring "cgl-bin" C2 URL patterns, and overlapping domain-registration details including use of WANGMINGHUA6@GMAIL[.]COM.
The Palo Alto report notes that BBSRAT had previously been associated with ESET's Roaming Tiger campaign. This establishes earlier public reporting connecting the malware family to espionage activity.
FireEye found that 28 Trojan.APT.9002 binaries using the Sunshop PE resource shared the same compile time. The repeated timestamp was December 19, 2012 at 20:25, supporting the assessment of centralized malware packaging or development.
FireEye identified five Trojan.APT.9002 binaries compiled on 2012-07-21 that used the DTL resource and communicated with domains including engage.intelfox[.]com, ru.pad62[.]com, and tank.hja63[.]com. The samples were linked to a Chinese-language GUI tool dubbed '9002 Builder.'
FireEye reported that 11 apparently separate APT campaigns were active during this period and shared development artifacts, malware, and infrastructure. The activity was observed between July 2011 and September 2013 and later formed the basis for FireEye's 'Sunshop Digital Quartermaster' assessment.
In analyzing the Belarus-targeting CMSTAR activity, researchers found two previously unknown payloads named PYLOT and BYEBY delivered from CMSTAR-related infrastructure. PYLOT used RC4-encrypted HTTP communications, while BYEBY operated as a DLL backdoor over TLS on port 443 and could register itself as the VideoSrv service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
researchcenter.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Multiple reports describe **distinct malware and intrusion campaigns** active across enterprise, government, developer, and consumer targets, rather than a single shared incident. The activity includes vishing-led abuse of *Quick Assist* for remote access and persistence, a **.NET AOT** malware chain delivering **Rhadamanthys** and **XMRig**, renewed **Horabot** banking Trojan activity using fake CAPTCHA and `mshta`, a compromised *Open VSX* extension that fetched **BlokTrooper** payloads, and a Middle East-focused Ramadan coupon lure delivering a **RAT** with AWS S3-based exfiltration. Additional reporting covers **Operation CamelClone**, which used government-themed spear-phishing and `LNK` files to steal data with *Rclone*, and **Contagious Trader**, a cryptocurrency-focused campaign tied to malicious GitHub and npm projects. One reference stands apart as vulnerability research rather than campaign reporting: watchTowr detailed **pre-authenticated RCE chains in BMC FootPrints**, which is a separate product security disclosure and not part of the malware operations described elsewhere. Because the references cover unrelated incidents, malware families, and victim sets, the material should **not** be treated as one cohesive event. It is also **not fluff**, as the sources contain substantive threat intelligence, technical analysis, exploit research, and incident tradecraft rather than marketing or generic advice.
Jun 29, 2026
Multiple reports detailed **state-linked intrusion activity** relying on social engineering and trusted delivery mechanisms to gain initial access and establish remote control. Researchers reported a suspected state-affiliated espionage operation targeting government and financial organizations in **Kazakhstan and Afghanistan**, built around a previously unreported Windows DLL implant dubbed **KazakRAT** delivered via malicious `MSI` installers and decoy documents (e.g., a fake Kazakh presidential letter and an Afghan provincial memo). The malware was described as relatively unsophisticated—unencrypted HTTP beaconing and minimal obfuscation—yet capable of host reconnaissance, file search/exfiltration, and downloading/executing additional payloads, enabling long-running access since at least 2022. Separately, Insikt Group described **North Korean** operators (tracked as **PurpleBravo**) running the “**Contagious Interview**” campaign, using fake recruiter personas and weaponized “coding tests” hosted on platforms like GitHub to trick software developers into executing malware on corporate devices, supporting software supply-chain targeting. The toolset reportedly includes **BeaverTail** (JavaScript infostealer) and newly identified RATs **PylangGhost** and **GolangGhost**. In another supply-chain style incident, Trend research and an Emurasoft advisory reported the **official EmEditor download** being tampered with to serve a trojanized `MSI` whose `CustomAction` launched PowerShell to fetch staged payloads from lookalike domains (e.g., `EmEditorjp[.]com`, `EmEditorgb[.]com`, `EmEditorde[.]com`), followed by environment fingerprinting and geofencing checks—highlighting ongoing risk from compromised public software distribution channels.
Jun 29, 2026