Loading story…
Palo Alto Networks' Unit 42 identified a new Windows-based malware family named Airstalk, which leverages the VMware AirWatch (Workspace ONE) mobile device management (MDM) API to establish a covert command-and-control (C2) channel. The malware, attributed to a likely nation-state threat actor and tracked as activity cluster CL-STA-1009, was deployed in a suspected supply chain attack targeting organizations through trusted third-party vendors and business process outsourcing (BPO) providers. Airstalk is available in both PowerShell and .NET variants, with the .NET version exhibiting more advanced capabilities, including multi-threaded C2 communication and versioning, and in some cases, the use of a likely stolen certificate for signing.
Airstalk is designed to exfiltrate sensitive browser data such as cookies, browsing history, bookmarks, and screenshots, while evading detection by abusing legitimate cloud service APIs. The campaign highlights the risk posed by supply chain compromises, as infiltrating a single vendor can provide access to numerous downstream targets. The malware's use of the AirWatch MDM API for C2 communications demonstrates a sophisticated approach to blending malicious activity with legitimate enterprise traffic, complicating detection and response efforts for affected organizations.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 publicly reported a new Windows malware family called Airstalk and assessed with medium confidence that a possible nation-state actor used it in a likely supply-chain attack tracked as CL-STA-1009. The report described PowerShell and .NET variants that abuse VMware AirWatch/Workspace ONE UEM APIs for covert command-and-control and data exfiltration.
Researchers found some Airstalk .NET samples were signed with a likely stolen certificate issued to Aoteng Industrial Automation (Langfang) Co., Ltd. The certificate was reportedly revoked shortly after issuance, suggesting an attempt to make the malware appear legitimate.
Unit 42 reported that early Airstalk .NET builds showed a compilation timestamp of June 28, 2024, helping reconstruct the malware's development timeline. Later samples also showed timestamp manipulation, indicating efforts to obscure development history.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcescworld.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited **VMware Workspace ONE Access**, **Identity Manager**, and **vRealize Automation** flaws in the wild, with **`CVE-2022-22954`** emerging as the primary initial access vector. Palo Alto Networks Unit 42 said exploitation began shortly after VMware disclosed the issue, describing the bug as a trivial server-side template injection that can be triggered with a single HTTP request for remote code execution. The activity prompted a **CISA alert**, and researchers warned that related VMware flaws **`CVE-2022-22972`** and **`CVE-2022-22973`** were also highly likely to be targeted. Observed post-exploitation activity included deployment of **Mirai** and **Gafgyt** variants, **Enemybot**, webshells, Perl-based shellbots, coinminers, and payloads that modified SSH keys for persistence. Unit 42 reported that attackers could chain **`CVE-2022-22960`** after the initial compromise to escalate privileges to root by abusing writable paths and sudo-accessible scripts. The company said its Threat Prevention signature **`92483`** blocks exploitation attempts and noted that **about 800 internet-exposed Workspace ONE Access instances** were visible, underscoring the exposure risk for unpatched organizations.
Jun 29, 2026
Researchers linked the **SideWalk** backdoor to multiple China-aligned intrusion sets tied to the broader **APT41/Winnti** ecosystem, with Symantec attributing recent activity to **Grayfly** and earlier ESET reporting associating the malware with **SparklingGoblin**. Recent intrusions hit organizations in **Taiwan, Vietnam, the United States, and Mexico**, with a strong focus on **telecommunications** as well as **IT, media, finance, academia, and government** targets. Investigators said attackers gained access by exploiting exposed **Microsoft Exchange** and **MySQL** servers, then deployed web shells, established persistence with scheduled tasks, and stole credentials using a custom **Mimikatz** variant. Technical analysis showed SideWalk is a modular backdoor closely related to **CROSSWALK**, reinforcing assessments of shared developers or operational overlap inside the APT41 ecosystem. ESET found the malware could retrieve infrastructure through **Google Docs** dead-drop resolvers and use **Cloudflare Workers** for command-and-control, while TeamT5 later documented a related China-nexus backdoor, **Calendarwalk**, that used **Google Calendar** events for C2 and was deployed against Taiwanese IT and ERP organizations in 2024 and 2025. Calendarwalk also used a multi-stage chain involving **Windows Workflow Foundation XOML**, shellcode loaders, and heavy obfuscation, underscoring a broader pattern of Chinese espionage operators adopting stealthy, cloud-backed malware families for long-term post-compromise access.
Aug 15, 2026
**BlueVoyant researchers identified a social-engineering campaign** in which operators linked to **Blitz Brigantine / Storm-1811 / STAC5777**, a cluster associated with the **Black Basta** ecosystem, impersonate IT support over **Microsoft Teams** after overwhelming targets with spam email. Victims are persuaded to launch **Quick Assist**, giving the attackers remote access that is then used to deploy **A0Backdoor** through digitally signed MSI packages masquerading as legitimate Microsoft software such as *Microsoft Teams* and *CrossDeviceService*. The activity has targeted organizations in sectors including **finance** and **healthcare**, and the use of multiple code-signing certificates suggests the operators prepared the toolchain well before the observed intrusions. Once installed, **A0Backdoor** fingerprints the host and communicates with operators using **DNS tunneling** over public resolvers, helping the malware blend into normal traffic while maintaining persistence and command-and-control. The reporting is substantive threat intelligence rather than promotional or advisory content, and the only other mention of the same event is a newsletter item that cites the A0Backdoor research as one entry among many malware stories. Other references in the set cover unrelated vulnerabilities, policy developments, AI security issues, phishing, ransomware trends, and separate malware campaigns, and do not describe this specific Teams-and-Quick-Assist intrusion chain.
Jun 29, 2026