Loading story…
NTT Security Japan reported a malware campaign that used malicious Microsoft Management Console (.msc) files and AppDomainManager Injection to execute payloads with minimal user interaction. Since around July 2024, attackers distributed ZIP archives through spear-phishing emails and attacker-controlled websites, then abused the GrimResource technique so that opening an MSC file could trigger embedded JavaScript via apds.dll, execute VBScript, download additional files, and launch a renamed legitimate Microsoft binary, oncesvc.exe.
The attack chain relied on a companion configuration file that abused .NET version redirection to load a malicious DLL derived from AppDomainManager, culminating in deployment of a Cobalt Strike beacon. Researchers said the tooling and infrastructure resembled APT41, with likely targeting that included Taiwanese government organizations, the Philippine army, and Vietnam’s energy sector. Separate public research from Elastic and offensive-security writeups from Rapid7 and Pentest Laboratories show that AppDomainManager Injection is an established technique that can be easier to abuse and harder to detect than traditional DLL side-loading, raising concern that its use may spread.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
NTT Security Japan assessed the loader and infrastructure used in the campaign as similar to APT41. The report also suggested likely targeting of Taiwanese government organizations, the Philippine army, and Vietnam's energy sector.
In the observed intrusions, opening the MSC file triggered GrimResource-based code execution through apds.dll, which led to VBScript downloading files and launching a renamed Microsoft-signed binary with a malicious AppDomainManager-derived DLL. The attackers ultimately deployed a Cobalt Strike beacon on victim systems.
NTT Security Japan reported that attacks abusing AppDomainManager Injection had been observed since around July 2024. The campaign used malicious MSC files delivered in ZIP archives from attacker-controlled websites or spear-phishing emails.
Rapid7 published research on new AppDomain Manager Injection techniques for red teams, further documenting offensive use of the method.
A public write-up described AppDomainManager Injection and detection considerations, establishing the technique as a known method for loading malicious .NET code through legitimate processes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
jp.security.ntt
Open sourceelastic.co
Open sourcepentestlaboratories.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Targeted intrusion campaigns used tampered **Microsoft-signed DLLs** to evade trust checks and launch malware through **DLL side-loading** and service hijacking. LAC researchers documented the **SigLoader** malware family modifying data in a file's certificate or overlay area while preserving Windows signature validation, allowing the DLL to still appear legitimately signed. The loader then decrypted and executed additional stages in memory using layered routines including **XOR**, custom **DES**, **AES**, and later **RC4**, with observed payloads including **DelfsCake**, **GreetCake**, and shellcode associated with **Metasploit Framework** or **Cobalt Strike**. In one case, the intrusion began with exploitation of an **SSL-VPN vulnerability** before the loader was deployed on a compromised endpoint. A related campaign assessed as likely tied to **APT41** used the same signed-DLL abuse technique to deliver **Cobalt Strike Beacon**, including a tampered `KBDTAM131.DLL` derived from `UXLibRes.dll` and malicious loading via the Windows **IKEEXT** service and `wlbsctrl.dll`. Researchers said the loader stored encrypted configuration data, API strings, offsets, and payload content with **ChaCha20**, then decrypted a Beacon linked to a leaked or cracked **Cobalt Strike 4.x** build using watermark `0x12345678` and C2 over **HTTPS**, with other samples using **HTTP** or **DNS**. The activity was also tied to a malicious shortcut file masquerading as a PDF, campaign infrastructure including `119.45.238[.]189` and `192.109.98[.]187`, and detection guidance using **Sigcheck**, **Autoruns**, Windows event logs, YARA rules, and stricter Authenticode verification.
Aug 15, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Researchers disclosed **Operation PhantomCLR**, a malware campaign that abuses Microsoft .NET's `AppDomainManager` mechanism to hijack execution of the legitimate, digitally signed Intel utility `IAStorHelp.exe` without altering the original binary. The intrusion chain begins with spear-phishing emails carrying a disguised `.pdf.lnk` file; when opened, it launches the Intel binary, loads a malicious configuration and DLL, and presents a decoy Saudi ministry-themed document to the victim. Reported targeting has focused on organizations in the Middle East and the broader EMEA financial sector. CYFIRMA said the framework functions as a multi-stage post-exploitation platform comparable to **Cobalt Strike** and **Brute Ratel C4**, with anti-analysis, in-memory execution, and anti-forensic features. The malware reportedly delays execution through CPU-intensive calculations and an AES key-derivation loop to evade sandboxes, then uses a JIT trampoline to run shellcode in memory and a DLL injection storm to mask activity. Command-and-control traffic is routed through **Amazon CloudFront** using domain fronting so communications blend with legitimate cloud traffic; defenders were urged to treat affected hosts as fully compromised, block identified C2 infrastructure, inspect CDN-bound TLS traffic, and harden .NET `AppDomainManager` usage.
Jun 29, 2026