Loading story…
Researchers documented Hellsing, an espionage group active across the Asia-Pacific region, after an unusual incident in which a recipient of a Naikon spear-phishing email sent back a weaponized archive that infected the original operators. The campaign primarily targeted organizations in Malaysia, the Philippines, and Indonesia, especially around the South China Sea, using spear-phishing messages with RAR, ZIP, and 7ZIP attachments to deliver custom backdoors including msger and xweber.
The malware set also included tools such as xrat, clare, irene, test.exe, diskfilter.sys, and xKat for victim profiling, proxy testing, lateral movement, and removing rival implants from compromised systems. Infrastructure and protocol overlaps linked the activity to other China-associated espionage clusters, while separate reporting highlighted BKDR_RARSTONE as another remote-access trojan to watch, reinforcing concern over archive-based malware delivery and custom RAT development in regional cyber-espionage operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Securelist published a report detailing Hellsing as a distinct espionage operation active in the Asia-Pacific region, including its targeting, malware families, and infrastructure overlaps with other China-linked clusters.
By March 11, 2014, Naikon was targeting nations involved in the search for MH370, including high-level government, military, intelligence, aviation, justice, and police entities.
In March 2014, Naikon began a major operation in the wake of the MH370 disappearance, using spear-phishing documents exploiting CVE-2012-0158 to deploy its RARSTONE backdoor against governments and related institutions.
Analysis of the backdoor delivered to the Naikon operator led researchers to name the actor behind the counterattack "Hellsing." The malware connected to philippinenews[.]mooo[.]com and supported file transfer, self-update, and uninstall functions.
After receiving a Naikon spear-phishing email, one target replied to verify its authenticity, received a follow-up impersonating an internal secretariat employee, and later sent back a password-protected RAR archive containing decoy PDFs and a malicious SCR file aimed at the Naikon operator.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked a sustained cyber-espionage campaign against military, government, and intelligence organizations in Southeast Asia to the Chinese-speaking **Naikon** threat actor, which used the **FoundCore**/RainyDay backdoor alongside a newly documented **Nebulae** implant. Bitdefender said Nebulae was typically delivered through **DLL side-loading** with legitimate software and used mainly for persistence and as a fallback access path after defenders detected other malware, while FoundCore handled reconnaissance, credential dumping, lateral movement, payload delivery, and ongoing remote access. Technical reporting shows the intrusions relied on multi-stage loaders, obfuscated shellcode, and hijacked legitimate components to evade analysis and maintain access. Securelist documented related tradecraft in attacks on high-profile Vietnamese organizations, including side-loading through Microsoft Outlook components, RC4-encrypted communications, runtime repair of scrubbed PE headers, and service-based persistence, while separate Kaspersky research tied Naikon to the long-running **Aria-Body** backdoor family used against executive, law enforcement, military, and intelligence entities across the South China Sea region. The combined reporting indicates Naikon continued refining a long-running regional espionage toolkit rather than conducting isolated intrusions.
Aug 15, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026