Loading story…
Attackers used a Chopper ASPX web shell to conduct post-compromise activity on Windows systems, relying heavily on native administration tools to blend in with normal operations. Observed discovery commands included nltest, ping, whoami, netstat, net, nslookup, hostname, and tasklist, alongside JoeWare's LG.exe for domain reconnaissance. Detection telemetry linked the intrusion to web-shell activity, anomalous file-extension execution, remote execution through system tools, and possible exploit attempts.
The operators then moved to credential access and collection, deploying a modified Mimikatz variant (HackTool.MSIL.Mimikatz.AF) and executing it remotely with wmic. They also queried security-related event logs with wevtutil.exe and packaged stolen credentials and logs with makecab, avoiding more obvious third-party archiving tools. To reduce suspicion, some files were disguised with names resembling installed security software components from vendors including Trend Micro, Oracle, and McAfee.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published analysis of a targeted attack in which operators used a Chopper ASPX web shell and then carried out discovery, credential theft, and collection on compromised Windows systems. The report describes use of native tools, LG.exe, a modified Mimikatz variant executed via wmic, wevtutil for event queries, and makecab to package stolen data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blackpoint Cyber reported an intrusion at an industrial organization in which attackers deployed **PCHunter64.exe** from the unusual path `C:\PerfLogs`, alongside **AnyDesk**, **FileZilla**, **MASSCAN**, and **RDP** activity across seven endpoints. Investigators observed failed `ADMIN$` share mount attempts by two user accounts on one machine, indicating attempted lateral movement, and Blackpoint said it isolated affected systems within minutes before issuing remediation guidance. The incident underscores continued abuse of legitimate or allowlisted Windows administration and remote-access tools in operational environments. Sandbox analysis of **PCHunter64** shows the tool can go well beyond administration, including dropping signed driver components, creating Windows service registry entries such as `PCHUNTER64`, loading kernel drivers, deleting **SafeBoot** registry keys, and exhibiting anti-debugging and anti-VM behavior. The activity aligns with MITRE ATT&CK persistence techniques including **Windows Service** creation or modification (`T1543.003`) and boot or logon autostart execution (`T1547.008`), while additional indicators pointed to credential-access behavior, including an artifact consistent with **LSASS** minidump collection. Together, the references show how a dual-use utility can be weaponized for persistence, defense evasion, and deeper compromise inside Windows environments.
Jul 19, 2026
A threat actor repeatedly exploited or attempted to exploit a vulnerable Adobe ColdFusion server, then used IIS worker process `w3wp.exe` to run reconnaissance and deploy multiple steganographic webshells, including `UA4fp7R.aspx` and `WRBYTR5750images.aspx`. Huntress reported the intruder embedded the marker **ONEPIECE** in shell logic and maintained persistence across repeated restoration attempts, indicating the server was returned to production before remediation was complete. The intrusion escalated into broad defense impairment designed to preserve access and obstruct responders. The actor timestomped files, disabled IIS logging and Microsoft Defender, killed security and logging tools, removed the ModSecurity IIS module, and used Image File Execution Options debugger registry entries to neutralize Sysmon and Filebeat. The attacker also weakened credential protections by enabling `WDigest` `UseLogonCredential`, exported ODBC registry data, and used Mimikatz-style credential dumping to write passwords and hashes to files before Huntress disrupted the operation prior to data theft or ransomware deployment.
Jul 2, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026