MalwareUsed by 1 actor

Troy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

The new.exe file is a small executable responsible for reflectively loading an embedded DLL containing the Troy backdoor, a previously undocumented backdoor first observed in this campaign.

via checkpoint research blogresearch.checkpoint.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The Operation Dream Job campaign begins with targeted spear-phishing lures centered on attractive job opportunities at well-known companies in the defense, aerospace, and aviation industries.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

ZIPDOWNLOAD|<src>|<dst> Archive and exfiltrate Compresses a path with PowerShell Compress-Archive into a temporary archive

Privilege Escalation

1 technique

T1055Process InjectionEvidence2

it leverages this memory corruption to obtain a kernel read/write primitive ... The injected payload was another instance of MISTPEN

Stealth

3 techniques

T1036MasqueradingEvidence2

The threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy.

T1055Process InjectionEvidence2

it leverages this memory corruption to obtain a kernel read/write primitive ... The injected payload was another instance of MISTPEN

T1620Reflective Code LoadingEvidence2

The new.exe file is a small executable responsible for reflectively loading an embedded DLL containing the Troy backdoor

Discovery

3 techniques

T1057Process DiscoveryEvidence2

For each running process, the module collects the Process PID, PPID, creation timestamp, associated domain and user, and process name.

T1082System Information DiscoveryEvidence2

Host Fingerprinting – The module gathers detailed information about the compromised host, including the operating system version, build number, installed security products, and other system characteristics.

T1083File and Directory DiscoveryEvidence1

LIST|<path> Directory listing Enumerates a directory with names, sizes and timestamps

Collection

2 techniques

T1005Data from Local SystemEvidence1

DOWNLOAD|<victim-source>|<client-destination> File exfiltration Streams a file from the victim to the operator in chunks.

T1560Archive Collected DataEvidence2

ZIPDOWNLOAD|<src>|<dst> Archive and exfiltrate Compresses a path with PowerShell Compress-Archive into a temporary archive, uploads it, then removes the archive.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence2

At startup, the implant iterates through the configured servers in order ... establishing an HTTP connection

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

Command results are returned through the send channel in a compact JSON envelope

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Malware News - Malware Analysis, News and Indicators

A newly identified modular Lazarus backdoor delivered as a 64-bit DLL. It supports 17 C2 commands for reconnaissance, file operations, command execution, process control, configuration changes, and in-memory DLL injection.

checkpoint research blogNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Check Point Research

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Troy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

The new.exe file is a small executable responsible for reflectively loading an embedded DLL containing the Troy backdoor, a previously undocumented backdoor first observed in this campaign.

via checkpoint research blogresearch.checkpoint.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The Operation Dream Job campaign begins with targeted spear-phishing lures centered on attractive job opportunities at well-known companies in the defense, aerospace, and aviation industries.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence2

ZIPDOWNLOAD|<src>|<dst> Archive and exfiltrate Compresses a path with PowerShell Compress-Archive into a temporary archive

Privilege Escalation

1 technique

T1055Process InjectionEvidence2

it leverages this memory corruption to obtain a kernel read/write primitive ... The injected payload was another instance of MISTPEN

Stealth

3 techniques

T1036MasqueradingEvidence2

The threat actor distributed SecurityPDF, a modified PDF viewer designed to open attacker-crafted PDF documents and execute a new backdoor which we named Troy.

T1055Process InjectionEvidence2

it leverages this memory corruption to obtain a kernel read/write primitive ... The injected payload was another instance of MISTPEN

T1620Reflective Code LoadingEvidence2

The new.exe file is a small executable responsible for reflectively loading an embedded DLL containing the Troy backdoor

Discovery

3 techniques

T1057Process DiscoveryEvidence2

For each running process, the module collects the Process PID, PPID, creation timestamp, associated domain and user, and process name.

T1082System Information DiscoveryEvidence2

T1083File and Directory DiscoveryEvidence1

LIST|<path> Directory listing Enumerates a directory with names, sizes and timestamps

Collection

2 techniques

T1005Data from Local SystemEvidence1

DOWNLOAD|<victim-source>|<client-destination> File exfiltration Streams a file from the victim to the operator in chunks.

T1560Archive Collected DataEvidence2

ZIPDOWNLOAD|<src>|<dst> Archive and exfiltrate Compresses a path with PowerShell Compress-Archive into a temporary archive, uploads it, then removes the archive.

Command and Control

1 technique

T1071Application Layer ProtocolEvidence2

At startup, the implant iterates through the configured servers in order ... establishing an HTTP connection

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

Command results are returned through the send channel in a compact JSON envelope

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Malware News - Malware Analysis, News and Indicators

checkpoint research blogNews

Aug 11, 2026

Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack - Check Point Research

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.