Loading story…
Palestinian-aligned threat group TA402 (also tracked as Molerats) ran a spear-phishing campaign against Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline, delivering a newly identified C# implant called NimbleMamba. Researchers said the malware appears designed to replace the group’s older LastConn backdoor and was used alongside a secondary trojan, BrittleBush, in parts of the operation. The activity was tied to late-2021 and early-2022 intelligence collection efforts focused on carefully selected regional targets.
The attackers used evolving delivery chains to limit exposure and evade detection, including geofenced links, actor-controlled domains, Dropbox-hosted payloads, and WordPress-based redirects to legitimate Arabic news sites before serving malicious RAR archives. NimbleMamba reportedly includes regional guardrails, anti-analysis checks, and configuration hosted on JustPasteIt, while using the Dropbox API for command-and-control and data exfiltration. Proofpoint linked the campaign to TA402 through technical overlaps, victim targeting, lure themes, and infrastructure connections between LastConn and NimbleMamba.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Proofpoint published research attributing the late-2021 to early-2022 espionage campaign to TA402/Molerats and detailing the new NimbleMamba implant as a likely replacement for LastConn.
In December 2021 and January 2022, TA402 incorporated actor-controlled WordPress redirect sites such as emaratalyoumcom[.]wordpress[.]com into its infection chain. These sites impersonated Arabic-language news content and likely redirected in-region victims to NimbleMamba downloads.
In December 2021, TA402 changed its delivery chain to use Dropbox URLs to distribute malicious RAR files containing NimbleMamba. Proofpoint also found the actor was abusing Dropbox for command-and-control.
In November 2021, TA402 used an actor-controlled Gmail account and the domain uggboots4sale[.]com while masquerading as Quora. The geofenced delivery URL served a malicious RAR file to selected-country targets and redirected others to emaratalyoum[.]com.
Proofpoint stated that pivoting on the JustPasteIt user “Nefaty Benet” suggested the NimbleMamba campaign likely began in August 2021.
Proofpoint had previously reported an attack involving deployment of the LastConn backdoor, which it later assessed NimbleMamba was likely intended to replace.
Proofpoint said LastConn was likely an updated version of the SharpStage backdoor, which Cybereason had reported being used by the same threat actor in campaigns in December 2020.
After Proofpoint shared its findings, Dropbox took action to neutralize the malicious activity associated with the TA402 campaign.
Across late 2021 to early 2022, Proofpoint observed TA402 spear-phishing campaigns targeting Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline. The campaigns delivered the new NimbleMamba implant and often the BrittleBush trojan.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that **TA402/Molerats** targeted government entities in the Middle East with a new malware family called **LastConn**, a .NET backdoor that appears to be an updated version of **SharpStage**. The malware shares several traits with earlier Molerats tooling, including **Dropbox API**-based command-and-control and checks associated with **Arabic-language environments**, reinforcing attribution to the long-running espionage group. Independent reverse engineering showed the sample was heavily obfuscated with **.NET Reactor**, requiring analysts to recover encrypted strings manually after standard deobfuscation failed. Researchers extracted resource data, identified a **32-byte key-like array**, reproduced the string decryption routine in Python, and recovered indicators from calls to the decryption function; the sample also contained a date-based execution check linked to an unregistered .NET Reactor trial message that prevented execution after **2021-06-30**.
Aug 15, 2026
Proofpoint reported that threat actor **TA800** used personalized phishing emails to deliver a newly identified loader dubbed **NimzaLoader**, while separate analysis referred to the malware as **NimarLoader** or **Nimrod**. The campaign sent recipients to **GetResponse** landing pages and then to a fake PDF executable hosted on **Slack**, after which the malware established HTTPS command-and-control using encrypted JSON messages and a key-exchange routine. Researchers said the loader was written in the **Nim** programming language, used encrypted or XOR-decoded strings, and included functionality for `handshake`, `heartbeat`, `cmd`, `powershell`, and shellcode execution. Both analyses concluded the malware had been initially confused with **BazaLoader/BazarLoader** because of overlapping campaign traits and infrastructure, but they found it to be a separate malware family with a different codebase and implementation. Observed activity included fileless delivery of **Cobalt Strike** stagers, and one campaign contacted `topservicebin[.]com`, which resolved to `45.141.87.41`; researchers also noted SSL certificate similarities with infrastructure tied to other Cobalt Strike deployments associated with BazarLoader and Ryuk. The reporting indicates TA800 introduced a new initial-access tool that may share operational infrastructure patterns with existing criminal ecosystems without being the same malware.
Aug 15, 2026
Researchers tied multiple malware families used in espionage campaigns to the **TA428** cluster, linking the previously undocumented **TManger** RAT, **Smanager/PhantomNet** loaders, and the later **Mail-O** implant through shared code, export names, configuration structures, and command handling. NTT Security reported that TA428 used **Poison Ivy**, **Cotx RAT**, and **EternalBlue** during Operation LagTime IT before deploying TManger, a modular toolset made up of `SetUp`, `MloadDll`, and `Client` components that supports persistence, host reconnaissance, file operations, process execution, keylogging, and screen capture over **RC4-encrypted** command-and-control traffic. Separate analysis found **Smanager** to be closely related to TManger and **Albaniiutas**, with droppers such as `VVSup.exe` and `SACEventLog.exe` unpacking `Smanager_ssl.dll`, modifying embedded configuration data, and establishing persistence either as a service or through `rundll32` using the misspelled exported function `Entery`. SentinelLabs later assessed that **Mail-O**, used in a 2021 campaign against the **FSB** and other Russian government organizations while masquerading as Mail.ru Disk-O software, was a variant of **PhantomNet/SManager** rather than a Western intelligence tool, reinforcing links to TA428. Across the reporting, the actor was associated with intrusions affecting government and regional targets in **East Asia**, **Southeast Asia**, and **Russia**, showing continued development of a shared malware arsenal for intelligence collection.
Aug 15, 2026