Loading story…
Researchers linked Nodersok—also tracked as Novter and Divergent—to the long-running KovCoreG malvertising operation, which used fake Adobe Flash update lures and compromised ads on popular websites to infect Windows systems. The multi-stage chain abused legitimate tools including mshta.exe, PowerShell, node.exe, and WinDivert, fetched RC4-encrypted payloads from short-lived infrastructure and CDN services such as Cloudfront and Cdn77, and ran largely in memory using HTA execution, registry-based staging, and reflective PE injection. The malware also attempted to disable Windows Defender and Windows Update, bypassed UAC through CMSTPLUA, and established persistence through registry Run keys and scheduled tasks.
The final payload turned infected hosts into proxy zombies and click-fraud nodes, with Node.js-based modules supporting SOCKS4A relaying and fraudulent ad traffic disguised as Android or iOS devices through TCP/IP and SYN packet manipulation. Additional modules supported traffic blocking and technical-support scam activity, while anti-analysis checks and encrypted command-and-control updates helped the operators keep the campaign active and evolving. Microsoft said the operation hit thousands of systems, mostly consumer devices in the United States and Europe, with some enterprise victims across sectors including education, healthcare, finance, retail, and professional services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Trend Micro and Proofpoint researcher Kafeine identified Novter as a modular fileless botnet distributed by KovCoreG and concluded its Nodster module was used to proxy attacker-generated ad traffic disguised as Android mobile-app traffic. The report also noted the campaign had expanded from U.S. targets into several European countries.
Microsoft published technical details on the multi-stage fileless Nodersok campaign, describing its use of mshta.exe, PowerShell, node.exe, and WinDivert to turn infected systems into proxy zombies. Microsoft also said Defender ATP detected and disrupted the campaign through behavioral, memory, and command-line protections.
Cisco Talos published analysis of a previously undocumented malware family named Divergent and its loader. Talos described its registry-backed fileless installation, PowerShell reflective injection, anti-analysis checks, WinDivert abuse, and NodeJS-based click-fraud components.
Microsoft says it uncovered the Nodersok campaign in mid-July after detecting anomalous use of mshta.exe in Defender ATP telemetry. The campaign had targeted thousands of machines, mostly consumers in the United States and Europe.
Trend Micro says the KovCoreG campaign had been distributing the modular fileless botnet Novter, also known as Nodersok and Divergent, since March. The campaign used fake Adobe Flash update lures and malvertising to infect users.
Cisco Talos found the earliest reference containing several Divergent indicators of compromise dated back to February 2019. This shows the malware family was active by at least that month.
Trend Micro reports the Kovter botnet was taken down at the end of 2018 through efforts by law enforcement and cybersecurity experts, including Trend Micro. The operators then continued activity and developed another botnet.
Trend Micro says the Kovter botnet had been involved in click-fraud operations since 2015. This provides historical context for the later Novter/Nodersok activity tied to KovCoreG.
Trend Micro states the KovCoreG malvertising campaign has been active since 2011. It later became associated with Kovter distribution and click-fraud activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourceblog.trendmicro.com
Open sourceblog.talosintelligence.com
Open sourcemicrosoft.com
Open sourcedocuments.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Multiple reports detail **social-engineering-driven malware delivery** that results in **remote access trojans (RATs)** and credential theft. Infoblox described observing an affiliate push-notification ad network after exploiting misconfigured DNS delegations (“**Sitting Ducks**”/lame name server delegation) to take over abandoned threat-actor domains, allowing collection of **~57M logs** over two weeks and visibility into widespread **scams and brand impersonation** delivered via push ads. Nextron Systems separately reported recurring **malvertising** chains where “free converter” tools (e.g., document/image converters) downloaded from ads on legitimate sites function as advertised while covertly installing **persistent RATs**, with common artifacts such as Windows **Mark-of-the-Web** (`ZoneId=3`) indicating internet origin. Other activity in the set reflects different initial-access lures but the same general outcome—RAT-style access and data theft. Fortinet analyzed a **phishing** campaign using a fake Vietnam shipping document: a Word attachment leads to an RTF stage that exploits an RTF-related vulnerability, then uses **VBScript/PowerShell** to load a **fileless .NET module**, ultimately downloading and injecting a **Remcos** variant (including process hollowing) to provide full remote control. Separately, reporting on North Korea’s **“Contagious Interview”** campaign described fake recruiter outreach (e.g., via LinkedIn) that tricks developers into opening malicious code repositories; execution can be triggered via a hidden **VS Code `tasks` configuration**, server-side logic hooks, or a malicious npm dependency to steal credentials/crypto wallets and establish persistence—this is thematically similar (social engineering leading to remote access) but is a distinct operation from the malvertising/push-ad and Remcos phishing activity.
Jun 29, 2026
VMRay Labs detailed **Operation STANDOFF**, a previously unattributed Russian-speaking cybercriminal campaign that delivers multiple payloads through a pay-per-install `NSIS` loader masquerading as `setup_x86_x64_install.exe`. The operation has been observed deploying **Raccoon Stealer, RedLine Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig**, and **WebBrowserPassView**, combining credential theft, botnet activity, and cryptomining in a single infection chain. Researchers said the operators used layered evasion and persistence techniques, including disabling Microsoft Defender, anti-VM and anti-debug checks, scheduled tasks, registry `Run` keys, fake VirtualBox-named services, and a masqueraded `csrss.exe` path, while a gaming-themed **“Mobile Arena”** lure targeted young Russian-speaking users. The campaign’s infrastructure included command-and-control systems hosted on **TimeWeb Ltd.**, a broader 44-server cluster, and dead-drop resolvers on **Telegram, Mastodon, and Pastebin**. Additional reporting tied the operation to command-and-control traffic concealed behind **GitHub redirects** and exposed indicators including suspicious installer filenames, hashes, domains, IP addresses, Telegram and social-media handles, anti-virtualization artifacts, and **Monero** mining infrastructure such as `pool.supportxmr.com:3333`. VMRay also identified **STANDOFF COORD**, a Russian-language multi-operator console designed for **Active Directory** intrusion, alongside a separate AI-enabled influence platform used for Telegram account farming and mass messaging.
Jul 28, 2026