Loading story…
Researchers and U.S. authorities reported multiple spearphishing campaigns linked with moderate confidence to APT29/Nobelium/Cozy Bear that targeted government agencies, NGOs, research institutions, embassies, and other high-value organizations. In one campaign, emails impersonating USAID used Constant Contact links to deliver malicious ISO files containing a decoy PDF, a weaponized .lnk shortcut, and a DLL loader that launched Cobalt Strike Beacon through rundll32.exe; CISA said the beacon used HTTP traffic disguised as requests for .woff2 files and embedded metadata in a _cfuid cookie while contacting infrastructure including theyardservice.com subdomains and worldhomeoutlet.com. Volexity also identified a second-stage malware family, FRESHFIRE, which retrieved encrypted payloads from Firebase and decrypted them with host-specific logic before deleting the remote content.
The activity fit a broader pattern seen in earlier and later operations attributed to the same cluster. FireEye documented a separate campaign in which attackers impersonated the U.S. Department of State, delivered ZIP archives with malicious shortcuts, used PowerShell to drop a decoy document, and installed Cobalt Strike Beacon communicating with pandorasong.com via a modified malleable C2 profile. Fortinet later described embassy-focused phishing that used HTML smuggling to build an ISO on the victim system, then relied on shortcut-triggered DLL execution to deploy another beacon, showing continued reuse of ISO-based delivery, decoy documents, and staged loaders across politically themed intrusion attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Volexity identified a phishing campaign on May 25, 2021 targeting organizations in the United States and Europe, including NGOs, research institutions, government agencies, and international agencies. The emails impersonated USAID and used Constant Contact links to deliver an ISO file that led to Cobalt Strike Beacon infection.
On November 14, 2018, FireEye detected targeted phishing against more than 20 clients across multiple sectors. The emails impersonated a U.S. Department of State Public Affairs official and delivered a ZIP with a weaponized LNK that installed a Cobalt Strike Beacon.
FireEye reported that the command-and-control domain pandorasong.com, used in a suspected APT29 phishing campaign, was registered as part of attacker infrastructure setup.
FortiGuard Labs reported a spearphishing campaign attributed to Nobelium/APT29 targeting embassy-associated Windows users with Omicron/COVID-19 themed lures. The attack used HTML smuggling to create an ISO file that mounted malicious shortcuts and loaded a DLL deploying Cobalt Strike Beacon via sinitude.com infrastructure.
CISA and the FBI released a malware analysis report on three malicious ISO files tied to the spearphishing campaign spoofing a U.S. government organization via Constant Contact. The report documented the malicious LNK, decoy PDF, custom Cobalt Strike Beacon DLL loader, and command-and-control infrastructure on theyardservice.com and worldhomeoutlet.com.
Volexity published technical analysis of the USAID-themed campaign, assessing with moderate confidence that APT29 was likely responsible based on overlaps in lures, delivery methods, infrastructure, and tooling. The report also identified and named a second-stage malware family, FRESHFIRE, which used Firebase-hosted encrypted payloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourceus-cert.cisa.gov
Open sourcevolexity.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
Threat researchers reported multiple spear-phishing campaigns targeting Indian government and military personnel with **COVID-19-themed** and investigation-themed decoy documents delivered through disk image files. In one operation attributed with moderate confidence to **Transparent Tribe**, victims received an `IMG` file containing a benign vaccination PDF, a malicious shortcut, and a `VBS` script that launched **PeppyRAT**, a Python-based Windows payload. The malware gathered host and process information, sent it to command-and-control servers over `HTTP`, and established persistence by placing a .NET loader in the Windows Startup folder to await a second-stage DLL, `mscontainer.dll`, which researchers said may be previously undocumented. A separate campaign aimed at Indian government and local institutions used `ISO` files with `LNK` shortcuts and malicious DLLs that were executed through `rundll32.exe` to load **Cobalt Strike** beacons directly in memory. Researchers said the lures referenced cyberattack investigations and COVID-19 precautions, while the infrastructure included the domain `instade.co.in` and compromised systems tied to `comesa.int`, including `covid.comesa.int`. Analysis of the loader showed XOR-encrypted strings, custom API hashing, PEB walking for API resolution, and `LZNT1`-compressed embedded payloads; the beacons also shared the same public key and watermark, suggesting linked operator infrastructure even though attribution remained unconfirmed.
Aug 15, 2026
Targeted intrusion campaigns used tampered **Microsoft-signed DLLs** to evade trust checks and launch malware through **DLL side-loading** and service hijacking. LAC researchers documented the **SigLoader** malware family modifying data in a file's certificate or overlay area while preserving Windows signature validation, allowing the DLL to still appear legitimately signed. The loader then decrypted and executed additional stages in memory using layered routines including **XOR**, custom **DES**, **AES**, and later **RC4**, with observed payloads including **DelfsCake**, **GreetCake**, and shellcode associated with **Metasploit Framework** or **Cobalt Strike**. In one case, the intrusion began with exploitation of an **SSL-VPN vulnerability** before the loader was deployed on a compromised endpoint. A related campaign assessed as likely tied to **APT41** used the same signed-DLL abuse technique to deliver **Cobalt Strike Beacon**, including a tampered `KBDTAM131.DLL` derived from `UXLibRes.dll` and malicious loading via the Windows **IKEEXT** service and `wlbsctrl.dll`. Researchers said the loader stored encrypted configuration data, API strings, offsets, and payload content with **ChaCha20**, then decrypted a Beacon linked to a leaked or cracked **Cobalt Strike 4.x** build using watermark `0x12345678` and C2 over **HTTPS**, with other samples using **HTTP** or **DNS**. The activity was also tied to a malicious shortcut file masquerading as a PDF, campaign infrastructure including `119.45.238[.]189` and `192.109.98[.]187`, and detection guidance using **Sigcheck**, **Autoruns**, Windows event logs, YARA rules, and stricter Authenticode verification.
Aug 15, 2026