Loading malware…
BADNEWS is a Windows backdoor associated with Patchwork activity and also reported in MONSOON-linked operations. It is commonly delivered through malicious document exploitation, including RTF lures exploiting CVE-2015-1641, and is often executed through DLL side-loading using legitimate signed Java or VMware executables. The malware establishes command-and-control over HTTP and can resolve or retrieve command-and-control information through web-based dead-drop channels including RSS feeds, blogs, forums, GitHub, and similar third-party services. Its communications are obfuscated with custom encoding and encryption, including Base64 and simple bitwise transformations.
BADNEWS supports a broad post-compromise feature set. It can execute shell commands through cmd.exe, download and run additional payloads via native process creation mechanisms, and in some variants use process hollowing to inject downloaded executables into new processes. It performs surveillance through keylogging and screenshot capture, and it collects documents from local drives, mapped drives, and removable media such as USB storage. Document theft behavior has targeted common office and text formats, with staged collection prior to exfiltration. The malware also monitors device insertion events to detect newly attached storage and automatically copy selected files.
For persistence, BADNEWS has been observed using Registry Run keys and scheduled tasks. It also employs defense-evasion measures such as masquerading payloads with legitimate-looking names, invalid code-signing to appear trustworthy, string obfuscation, and abuse of trusted host executables for side-loading. Reported campaigns using BADNEWS have used politically themed lures and South Asia-focused themes, particularly involving Pakistan and India. Overall, BADNEWS is a modular espionage-oriented backdoor focused on stealthy access, operator tasking, and document collection from Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This malicious RTF file takes advantage of the vulnerability CVE-2015-1641. Upon successful exploitation, it drops a malware in the %appdata%\Microsoft directory. | Our analysis exposed that this is a new variant of a malware dubbed as BADNEWS, which is actively being used in the MONSOON APT campaign. This variant steals documents from USB drives.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Hardcoded and encoded (sub 0x01) URL addresses... Examples of encoded configuration
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.
BADNEWS attempts to hide its payloads using legitimate filenames.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.
When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
BADNEWS copies files with certain extensions from USB devices to a predefined directory.
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
This talk focuses on cloud abuse in the context of targeted attacks... Patchwork – Badnews... HTTPS GET request... Encrypted C&C... Connect to C&C
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
61 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BADNEWS is a malware family detected in the analysis, but specific details are not provided in the content.
Minor Software changes: BADNEWS
Malware that can download executables and run them via CreateProcess or ShellExecute.
Backdoor that encrypts C2 data using bit rotation and XOR.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.