Loading malware…
PHANTOMPULSE is a 64-bit Windows remote-access trojan used as the final payload in the REF6598 social-engineering campaign targeting individuals in the financial and cryptocurrency sectors. The intrusion chain abuses Obsidian community-plugin synchronization after victims are lured by actors impersonating a venture-capital firm; the PHANTOMPULL loader decrypts and reflectively loads PHANTOMPULSE in memory. PHANTOMPULSE gathers detailed host telemetry, inventories security products and selected cryptocurrency, messaging, authentication, mail, and file-transfer applications, captures screenshots, and records keystrokes, foreground-window activity, and clipboard content. It exchanges telemetry, task results, and collected data with operator infrastructure and can drop and execute payloads, uninstall itself, restart, and modify its execution context. The implant maintains access through scheduled-task-based persistence and can restore its persistence artifacts when they are removed. It uses a COM-based UAC-bypass technique to obtain elevated execution. For defense evasion, PHANTOMPULSE employs anti-sandbox checks, direct syscalls, XOR obfuscation, and hardware-breakpoint interception with a vectored exception handler to bypass AMSI, Windows Lockdown Policy checks, and ETW without inline patching. Its command dispatcher supports module stomping for shellcode, debugging-API-based executable execution, and manual DLL mapping with thread hijacking. PHANTOMPULSE resolves active command-and-control infrastructure from encoded transaction inputs on Ethereum, Base, and Optimism, with a hardcoded fallback; its failure to validate transaction senders makes the resolver susceptible to redirection or sinkholing. Tradecraft, targeting, and infrastructure have been assessed as aligned with DPRK-associated cryptocurrency-focused clusters, including Lazarus, BlueNoroff, UNC5342/Contagious Interview, and APT38, but this attribution is not definitive.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Elastic Security Labs published a comprehensive PHANTOMPULSE malware analysis highlighting advanced evasion strategies... The malicious agent retrieves its primary operational server locations through a decentralized blockchain C2 channel... AMSI, WLDP, and ETW are bypassed via a single shared HWBP primitive... the command dispatcher supports three functional injection techniques...
Elastic Security Labs published a comprehensive PHANTOMPULSE malware analysis highlighting advanced evasion strategies... The malicious agent retrieves its primary operational server locations through a decentralized blockchain C2 channel... AMSI, WLDP, and ETW are bypassed via a single shared HWBP primitive... the command dispatcher supports three functional injection techniques...
Elastic Security Labs published a comprehensive PHANTOMPULSE malware analysis highlighting advanced evasion strategies... The malicious agent retrieves its primary operational server locations through a decentralized blockchain C2 channel... AMSI, WLDP, and ETW are bypassed via a single shared HWBP primitive... the command dispatcher supports three functional injection techniques...
On Windows, the commands are used to invoke a PowerShell script to drop an intermediate loader codenamed PHANTOMPULL that decrypts and launches PHANTOMPULSE in memory. PHANTOMPULSE is an artificial intelligence (AI)-generated backdoor that uses the Ethereum blockchain for resolving its command-and-control (C2) server by fetching the latest transaction associated with a hard-coded wallet address.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
...the implant uses to register a high-privilege scheduled task that relaunches it with full administrator rights... Organizations in the crypto sector are strongly advised to monitor for suspicious scheduled tasks... Scheduled Task DotNetSvcUpdateTask Primary persistence... DotNetSvcCoreTask SYSTEM persistence... DotNetSvcUserTask User persistence...
PHANTOMPULSE installs DotNetSvcUpdateTask, DotNetSvcCoreTask, and DotNetSvcUserTask via COM ITaskService, each launching rundll32.exe with svcagent.dll,DllRegisterServer.
...the implant uses to register a high-privilege scheduled task that relaunches it with full administrator rights... Organizations in the crypto sector are strongly advised to monitor for suspicious scheduled tasks... Scheduled Task DotNetSvcUpdateTask Primary persistence... DotNetSvcCoreTask SYSTEM persistence... DotNetSvcUserTask User persistence...
...the implant uses to register a high-privilege scheduled task that relaunches it with full administrator rights... Organizations in the crypto sector are strongly advised to monitor for suspicious scheduled tasks... Scheduled Task DotNetSvcUpdateTask Primary persistence... DotNetSvcCoreTask SYSTEM persistence... DotNetSvcUserTask User persistence...
PHANTOMPULSE installs DotNetSvcUpdateTask, DotNetSvcCoreTask, and DotNetSvcUserTask via COM ITaskService, each launching rundll32.exe with svcagent.dll,DllRegisterServer.
PhantomInject maps dbghelp.dll as a SEC_IMAGE section into a target process, overwrites its .text section with shellcode and a trampoline, repoints a suspended thread's RIP, and resumes it. | PHANTOMPULSE implements three injection techniques: PhantomInject for shellcode, ManualMap for DLLs, and DbgNexum for EXE payloads.
ManualMap handles DLL payloads through full PE manual mapping, including image allocation, relocation, import resolution, remote writes, protection changes, and thread-context hijacking.
PhantomInject and ManualMap suspend a target thread, capture and modify its context, repoint RIP to a trampoline, and resume the thread.
PHANTOMPULL extracts an AES-256-CBC-encrypted PE payload from its own resources ... The macOS dropper constructs sensitive strings at runtime using ASCII character, character id, and string id calls.
PhantomInject maps dbghelp.dll as a SEC_IMAGE section into a target process, overwrites its .text section with shellcode and a trampoline, repoints a suspended thread's RIP, and resumes it. | PHANTOMPULSE implements three injection techniques: PhantomInject for shellcode, ManualMap for DLLs, and DbgNexum for EXE payloads.
ManualMap handles DLL payloads through full PE manual mapping, including image allocation, relocation, import resolution, remote writes, protection changes, and thread-context hijacking.
PhantomInject and ManualMap suspend a target thread, capture and modify its context, repoint RIP to a trampoline, and resume the thread.
Alternatively, the second path executes executable formats using the native Windows debugging programming interface. This advanced mechanism replicates a public technique known as DbgNexum to drive execution via exceptions.
The uninstall workflow removes scheduled tasks, registry artifacts, stub DLLs, sleeper logs, registry PE blobs, ProgramData directories, install/self paths, and residual hosted rundll32 instances.
The loader performs AES-256-CBC decryption ... [and] decrypts the payload with a 16-byte XOR key.
The drop command supports DLL, EXE, shellcode via APC injection, and MSI payloads.
Persistence tasks execute rundll32.exe "<stub_dll>",DllRegisterServer; the elevation workflow also relaunches the implant with rundll32.
At startup, the implant DJB2-hashes the user name and computer name and exits on a match; recovered entries include WDAGUtilityAccount, default VM names, and Joe Sandbox personas.
PHANTOMPULSE obtains the username using GetUserNameW, with a fallback to LookupAccountSidW from the explorer.exe token.
PhantomInject walks the process snapshot to select a host process; DbgNexum host selection excludes critical system processes and searches for usable WoW64 hosts.
The heartbeat sends comprehensive system telemetry ... including CPU model, GPU, RAM, OS version, username, privilege level, public IP, installed AV products, [and] installed applications.
At startup, the implant DJB2-hashes the user name and computer name and exits on a match; recovered entries include WDAGUtilityAccount, default VM names, and Joe Sandbox personas.
DetectInstalledApps checks paths under LOCALAPPDATA, APPDATA, and ProgramFiles(x86) for cryptocurrency wallets, messengers, mail clients, Authy, FileZilla, WinSCP, and Steam.
The malicious agent retrieves its primary operational server locations through a decentralized blockchain C2 channel. Specifically, the program queries public L1 and L2 ledger platforms to harvest encoded transaction inputs.
For each Blockscout provider, the implant issues an HTTPS GET; it also uses HTTP API paths for heartbeat telemetry, task retrieval, uploads, result delivery, and keylog uploads.
PHANTOMPULSE implements a decentralized C2 resolution mechanism using public blockchain infrastructure as a dead drop ... The macOS dropper ... scrapes a public Telegram channel to extract a backup domain.
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware or campaign referenced only as a comparative example of blockchain-based C2 and memory-resident execution.
A highly sophisticated implant/RAT linked to DPRK-aligned espionage and crypto-targeting activity. It uses blockchain-based command-and-control discovery, advanced AMSI/ETW/WLDP bypass via hardware breakpoints and vectored exception handling, private syscall wrappers to evade user-mode hooks, and multiple process injection methods including module stomping, DbgNexum-style execution, and manual mapping.
Remote access trojan used as the final-stage payload in the REF6598 attack chain. It establishes persistence, evades detection, performs process injection, uses a UAC bypass for privilege escalation, and communicates with operators via a blockchain-based C2 with fallback infrastructure.
A Windows remote access implant/final-stage payload that provides command-and-control, process injection, persistence via scheduled tasks, UAC bypass, AMSI/WLDP/ETW evasion via hardware breakpoints, keylogging, screenshot capture, system reconnaissance, and blockchain-based C2 resolution with a hardcoded fallback URL.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.