Loading story…
Check Point Research detailed an APT32 (Ocean Lotus) backdoor sample that used control-flow obfuscation to frustrate reverse engineering while delivering a multi-stage infection chain. The attack began with a malicious document disguised as a Qihoo 360 file, used VBA macros to inject shellcode into rundll32.exe, then decrypted and reflectively loaded a DLL before launching an auxiliary HTTPProv.dll module for command-and-control communications.
The analysis showed the malware inserted junk basic blocks into functions, often by placing opposite conditional jumps that led to the same target, making flow graphs appear far more complex than they were. To counter that technique, the researcher released a Python-based Graph Deobfuscator plugin for Cutter and radare2 using r2pipe, which patches those conditional branches into unconditional jumps in memory and reanalyzes the function graph without altering the original binary on disk by relying on radare2 cache mode.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published an analysis of an Ocean Lotus (APT32) backdoor sample, detailing its multi-stage infection chain and control-flow obfuscation technique. The report also presented the Python-based "APT32 Graph Deobfuscator" plugin for Cutter and radare2 to simplify analysis of the obfuscated malware.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the Vietnam-linked **APT32**/**OceanLotus** group deployed a multi-stage macOS backdoor inside an application bundle disguised as a Microsoft Word document. The lure used a hidden Unicode character and a bait-and-switch technique to display a legitimate decoy document while silently dropping additional payloads. SentinelLabs linked the activity to earlier OceanLotus macOS operations previously documented by Trend Micro, indicating continued investment by the group in Apple-focused intrusion tooling. The first-stage shell script carried a large base64-encoded Mach-O payload, removed quarantine attributes, and attempted to bypass macOS App Translocation before launching later stages. The malware then established persistence through a hidden `LaunchAgent` or `LaunchDaemon` named `com.apple.marcoagent.voiceinstallerd`, and the final stage enabled backdoor functions including host profiling, file download, and data exfiltration. Researchers said the malware also borrowed stealth ideas seen in coin-miner tradecraft, while exposing huntable artifacts such as hard-coded identifiers, code-signing details, file paths, hashes, C2 domains, and noisy anti-quarantine behavior; Apple has since revoked the observed code signatures.
Aug 15, 2026
Researchers described **TA410** as a distinct cyber-espionage umbrella cluster, separate from **APT10**, operating through at least three subgroups: **FlowingFrog**, **LookingFrog**, and **JollyFrog**. The group has targeted victims through spearphishing with **Royal Road** lure documents and by exploiting public-facing **Microsoft SharePoint** and **Exchange** servers, then deploying a broad malware arsenal that includes **FlowCloud**, **LookBack**, **Tendyron**, **X4**, **QuasarRAT**, and **Korplug** to maintain access and conduct intelligence collection. Proofpoint’s analysis of **FlowCloud RAT v4.1.3** showed the malware remained active with a live command-and-control server and provided extensive remote access features, including filesystem and service control, screenshots, shell access, keylogging, plugin support, port mapping, and **Nmap**-assisted lateral movement. The sample used **Protocol Buffers** for configuration and C2 messaging, stored encrypted settings in `winver.dat`, and downloaded components such as **SQLite** and **Nmap** from attacker infrastructure; researchers also highlighted detection opportunities tied to `certutil`-based payload delivery, suspicious `w3wp.exe` process trees, and **LookBack** network signatures.
Aug 15, 2026
Palo Alto Networks Unit 42 detailed how analysts defeated anti-analysis protections in **BazarLoader**, a Windows backdoor linked to multiple ransomware operations, to accelerate reverse engineering and expose its behavior. The research focused on two obfuscation methods in a BazarLoader sample: API function hashing that concealed Windows API calls and opaque predicates that distorted control-flow analysis and decompilation. By reversing those protections, analysts were able to recover hidden functionality and better map the malware’s execution path. The team used **IDAPython** with IDA Pro’s Appcall feature to invoke BazarLoader’s own API-decoding routine during debugging, automatically recover dynamically resolved API names, and annotate calls. They also identified and patched opaque predicates so dead code blocks were removed and decompiled output became clearer. After applying those techniques, the researchers identified behaviors including **code injection** and determined that one heavily obfuscated routine acted as a wrapper for `GetModuleFileNameW()`, with accompanying GitHub-hosted scripts provided to automate API deobfuscation and opaque-predicate patching.
Aug 14, 2026