Loading malware…
PHANTOMPULL is a 64-bit Windows in-memory PE loader used in the REF6598 intrusion chain to deliver the PHANTOMPULSE remote-access trojan. The campaign targeted individuals in financial and cryptocurrency-related sectors through social engineering that abused Obsidian community-plugin synchronization and attacker-defined shell commands. On Windows, a PowerShell stage downloads PHANTOMPULL, which decrypts an AES-256-CBC-protected payload embedded in its resources and reflectively loads it into memory, reducing disk-based detection opportunities. PHANTOMPULL also downloads and launches the PHANTOMPULSE implant in memory. Its evasion features include dynamically resolved APIs using djb2 hashing, timer-queue callback execution, dead-code and integrity-check distractions, and retry logic with exponential backoff for payload retrieval. Activity using PHANTOMPULL has been assessed as aligned with DPRK-associated cryptocurrency-targeting clusters, though attribution is not definitive.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On Windows, the commands are used to invoke a PowerShell script to drop an intermediate loader codenamed PHANTOMPULL that decrypts and launches PHANTOMPULSE in memory.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The Shell Commands plugin's Windows command contained two Invoke-Expression calls with Base64-encoded strings ... [that] download a second-stage PowerShell script ... and execute it.
PHANTOMPULL extracts an AES-256-CBC-encrypted PE payload from its own resources ... The macOS dropper constructs sensitive strings at runtime using ASCII character, character id, and string id calls.
This loader includes runtime API resolution... PHANTOMPULSE uses WinHTTP for C2 communication, dynamically loading winhttp.dll and resolving all required functions at runtime.
According to the Elastic Security Labs report, the implant carries three separate process injection techniques... PHANTOMPULSE ships with three distinct injection methods, each designed for a different payload type.
The loader performs AES-256-CBC decryption ... [and] decrypts the payload with a 16-byte XOR key.
PHANTOMPULL also employs a timer queue callback with a 50-millisecond delay to hand off execution, a tactic used to slip past sandbox environments.
Rather than calling the payload directly ... the loader uses a timer queue callback. The 50ms delay and separate-thread execution can evade various security/sandbox tooling.
The malware never writes its final stage to disk, making it far harder to detect through conventional file-based scanning.
PHANTOMPULL ... decrypts it, and reflectively loads it into memory ... The third-stage payload (PHANTOMPULSE) is then decrypted and loaded reflectively via DllRegisterServer.
A "novel" social engineering campaign has been observed abusing Obsidian... leveraging elaborate social engineering tactics through LinkedIn and Telegram... approaching prospective individuals under the guise of a venture capital firm and then moving the conversation to a Telegram group...
The loader uses the WinHTTP library to connect to the C2 on port 443... The C2 infrastructure is built around five API endpoints.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
In-memory loader used in the REF6598 attack chain to deploy the PHANTOMPULSE implant onto compromised systems.
An in-memory PE loader used earlier in the intrusion chain to deliver the final-stage PHANTOMPULSE RAT.
In-memory PE loader used earlier in the intrusion chain to deliver PHANTOMPULSE.
An intermediate loader dropped via PowerShell on Windows that decrypts and launches PHANTOMPULSE in memory.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.