Loading story…
A financially motivated malware operation targeted businesses in Croatia, Serbia, Montenegro, and Bosnia and Herzegovina with tax-themed phishing that impersonated official institutions and delivered decoy PDF files alongside malware. Researchers said the campaign, active from at least 2016 to 2019, focused largely on financial and accounting staff and deployed two complementary tools: BalkanDoor, a backdoor capable of remote shell access, screenshot capture, and unlocking Windows sessions, and BalkanRAT, which abused legitimate Remote Utilities software for hidden remote desktop access.
The attackers later incorporated the WinRAR ACE archive path traversal flaw, tracked as CVE-2018-20250, to install payloads by writing files to attacker-chosen locations on victim systems. Separate reporting showed the same WinRAR vulnerability was exploited in multiple campaigns to achieve persistence and code execution, often by dropping files into startup paths, and was also used to deliver malware including Netwire RAT, QuasarRAT, Azorult, Razy, Buzy, PowerShell Empire, and FireEye’s SappyCache. The flaw was fixed in WinRAR 5.70, but researchers warned that the product’s lack of auto-update left many systems exposed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ESET reported telemetry showing the Balkan malware campaign remained active through July 2019. The company described the operation as long-running and financially motivated based on its targeting and tooling.
WinRAR remediated CVE-2018-20250, a path traversal vulnerability in ACE archive handling that could let attackers write files to arbitrary locations for persistence and code execution. Both references note the fix was released in WinRAR 5.70.
ESET observed some 2019 BalkanDoor samples delivered as ACE archives disguised as RAR files to exploit CVE-2018-20250. This marked an evolution in the Balkan campaign's delivery methods beyond earlier tax-themed malspam and self-extracting droppers.
ESET said the financially motivated malware campaign was active from at least January 2016, targeting financial and accounting staff in Croatia, Serbia, Montenegro, and Bosnia and Herzegovina with tax-themed lures. The operation used the BalkanDoor backdoor and BalkanRAT remote-access malware, often together on the same victim machine.
FireEye disclosed that multiple threat campaigns were abusing the WinRAR ACE vulnerability with tailored decoy documents and payloads including Netwire RAT, the newly dubbed SappyCache malware, and the PowerShell Empire backdoor. The report also described additional lure themes used to distribute QuasarRAT, Azorult, Razy, and Buzy.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused the WinRAR remote code execution flaw **`CVE-2023-38831`** in spear-phishing campaigns that used crafted RAR archives to trigger malware execution when victims opened a decoy document. In one case, a phishing email impersonating a consultant from Russia’s Ministry of Industry and Trade targeted a major Russian semiconductor supplier and delivered the **Athena** agent from the **Mythic C2** framework. The archive paired a benign PDF with a malicious script disguised through the trailing-space filename trick tied to the WinRAR flaw; execution led to a PowerShell downloader, retrieval of a decoy PDF and payload from **`45.142.212.34`**, persistence via a scheduled task named **`aimp2`**, and command-and-control over Discord-backed channels. Ukraine’s **CERT-UA** separately reported active exploitation of the same vulnerability by **UAC-0057**, which used a malicious archive named **`Збірник_тез_НУОУ_23.rar`** to launch a chain involving a BAT file, an LNK shortcut, **`mshta.exe`**, and an embedded HTA file. That intrusion dropped a decoy PDF, executed JavaScript identified as a PicassoLoader variant, downloaded an SVG containing an encrypted .NET payload, decrypted it with the Rabbit algorithm, and ultimately deployed **Cobalt Strike Beacon**. The reports indicate that public proof-of-concept code and broad post-disclosure abuse have made **`CVE-2023-38831`** a practical delivery vector for multiple malware families and threat actors.
Aug 15, 2026
Breakglass Intelligence reported two active malware operations linked to Turkish-origin threat actors, including a campaign exploiting **`CVE-2025-8088`** in WinRAR and a separate multi-stage **XWorm V6.0** distribution chain. In the WinRAR case, victims in Turkey and Germany were lured with a malicious archive named **`fiyat teklifi.rar`**, which abused NTFS Alternate Data Streams and path traversal to drop a .NET downloader into the Windows Startup folder. That downloader fetched a second-stage payload from **`34[.]69[.]246[.]76`**, ultimately installing a PyInstaller-packed Telegram RAT, **`WindowsServices.exe`** version 1.0.8, capable of keylogging, webcam and screen capture, browser theft, FTP exfiltration, remote shell access, and UAC bypass. Investigators said the infrastructure remained live, including HTTP payload hosting, FTP services, leader-election APIs, and the Telegram bot **`@Roberta3358_bot`**, and identified at least one active victim in Istanbul. A separate Breakglass report described an ongoing **XWorm V6.0** campaign attributed with high confidence to a Turkish-origin actor using the GitHub alias **`flexhere687-art`** and the exposed email **`flexhere687@gmail[.]com`**. That operation used Google Blogger, Filemail, and GitHub to deliver obfuscated JavaScript droppers, BAT files with UAC bypass, and a trojanized Python 3.12 package that decrypted shellcode in memory, while lures referenced taxes, invoices, shipping, banking, and CVs. The malware chain established persistence through Run keys, Startup folder placement, scheduled tasks, and LOLBin abuse via **`SyncAppvPublishingServer.vbs`**, and included BAT scripts that broadly weakened Microsoft Defender through exclusions. Both reports highlighted weak operator security, including Turkish-language artifacts, exposed infrastructure, embedded credentials, plaintext HTTP, and still-accessible domains and repositories, indicating the campaigns were active and operational at the time of analysis.
Jul 12, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026