Loading story…
A targeted cyber-espionage campaign dubbed Operation DupeHike has been uncovered, focusing on Russian corporate entities, particularly human resources, payroll, and internal administrative departments. Attackers used spear-phishing emails containing ZIP archives with decoy documents themed around employee bonuses and internal financial policies. The infection chain begins with a malicious LNK file, which, when executed, deploys a previously unknown implant named DUPERUNNER. This implant subsequently loads the AdaptixC2 beacon, establishing command-and-control communications with the threat actor's infrastructure via process injection techniques.
Technical analysis reveals that the campaign leverages realistic decoy documents to increase the likelihood of successful compromise. The malware ecosystem is designed for stealth and persistence, with the AdaptixC2 component enabling remote access and control over infected systems. The campaign's infrastructure and tactics suggest a sophisticated threat actor, and indicators of compromise (IOCs) have been published to aid in detection and response. Security researchers recommend heightened vigilance for organizations in the Russian corporate sector, especially those handling sensitive HR and payroll data, and advise updating security controls to detect similar spear-phishing and process injection techniques.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Seqrite said the campaign's infrastructure showed overlaps and was hosted under AS48282 (VDSINA-AS) and AS9123 (TIMEWEB-AS). The company also assessed that the activity may have nation-state sponsorship.
On publication, Seqrite described the campaign's delivery and execution chain: a ZIP archive containing a PDF-themed malicious LNK launched hidden PowerShell to fetch a C++ implant dubbed DUPERUNNER. The implant opened a decoy PDF, downloaded an additional payload disguised as a .woff file, injected shellcode into legitimate processes, and deployed an AdaptixC2 beacon communicating over HTTP.
Seqrite reported tracking a spearphishing campaign it calls Operation DupeHike since November 2025. The activity targeted Russian corporate employees, especially HR, payroll, and internal administrative staff, using bonus- and policy-themed decoy documents.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aryaka researchers reported a **Russian-speaking** threat actor targeting corporate **HR teams and recruiters** with fake job applications that deliver malware via a resume-themed **ISO** file, likely distributed through spam and hosted on common cloud storage services. When the ISO is mounted, victims are tricked into executing a disguised **Windows shortcut (`.lnk`)** that launches `cmd`/PowerShell, extracts hidden data from an image file, and runs additional PowerShell in memory. The chain then downloads a decoy archive (e.g., `SumatraPDF.zip`) from attacker-controlled domains (including `resumebuilders.us` and `thresumebuilder.com`), leveraging **DLL sideloading** (e.g., `SumatraPDF.exe` loading `DWrite.dll`) to execute the next-stage payload while blending into normal user activity. A key capability in the operation is an **EDR/AV “killer”** component (described as **BlackSanta**) intended to disable endpoint defenses before follow-on actions such as host profiling and data theft, with much of the activity occurring **in memory** to reduce forensic artifacts. Aryaka assessed the campaign as **low-noise and potentially long-running (over a year)**, but noted limited telemetry on overall prevalence; the tradecraft is designed to exploit routine hiring workflows where recruiters rapidly open candidate materials and may not scrutinize ISO-mounted content or shortcut execution.
Jun 29, 2026
A sophisticated phishing campaign known as Operation MoneyMount-ISO has been identified targeting finance, accounting, treasury, and payment departments in Russia. Attackers use Russian-language emails impersonating financial institutions, such as TorFX Currency Broker, to deliver ZIP attachments containing malicious ISO files. When executed, these ISO files mount as virtual drives and deploy executables that load the Phantom information-stealing malware, which is capable of credential theft, invoice and payment fraud, and unauthorized fund transfers. The campaign also targets secondary sectors including procurement, legal, HR/payroll, executive assistants, and Russian-speaking SMEs, posing significant risks of lateral movement within IT systems. Technical analysis reveals that the infection chain involves a multi-stage payload delivery, with the initial executable loading a DLL (`CreativeAI.dll`) that decrypts and injects the final Phantom Stealer payload into memory. The campaign demonstrates advanced social engineering and technical sophistication, leveraging fake payment confirmation lures and ISO mounting to bypass traditional security controls. Security researchers emphasize the need for heightened vigilance among Russian financial organizations and recommend monitoring for related IOCs and MITRE ATT&CK techniques associated with this threat.
Jun 29, 2026
A previously undocumented .NET-based malware, dubbed CAPI Backdoor, has been identified as the payload in a targeted phishing campaign against Russian automotive and e-commerce companies. The attack begins with spear-phishing emails containing a ZIP archive, which was first observed on VirusTotal on October 3, 2025. This ZIP file includes a Russian-language decoy document, purporting to be a notification about income tax legislation or payroll recalculation, and a malicious Windows shortcut (LNK) file. The LNK file, named identically to the ZIP archive, is engineered to execute the CAPI Backdoor DLL (adobe.dll) using the legitimate Windows binary rundll32.exe, a classic living-off-the-land (LotL) technique that helps evade detection. Once executed, the backdoor checks for administrator privileges, enumerates installed antivirus products, and opens the decoy document to distract the user while it operates covertly. The malware establishes persistence by creating a scheduled task and placing a shortcut in the Windows Startup folder, ensuring it runs on system reboot. CAPI Backdoor connects to a remote command-and-control server at 91.223.75[.]96, from which it can receive further instructions. Its capabilities include stealing data from popular web browsers such as Chrome, Edge, and Firefox, taking screenshots, collecting detailed system information, and enumerating folder contents for exfiltration. The malware also performs extensive checks to determine if it is running in a virtual machine or sandbox environment, likely as an anti-analysis measure. Infrastructure analysis revealed that one of the domains used in the campaign is linked to the Russian automotive sector, supporting the assessment that this industry is a primary target. The campaign also impacts the broader e-commerce sector within Russia, as indicated by the targeting patterns and decoy content. Seqrite Labs, which conducted the technical analysis, has provided indicators of compromise (IOCs) and mapped the attack to relevant MITRE ATT&CK techniques. The campaign demonstrates a sophisticated use of social engineering, leveraging localized decoy documents and legitimate system binaries to maximize infection success and persistence. The use of a previously unknown .NET implant highlights the evolving tactics of threat actors targeting Russian commercial sectors. Organizations in the affected industries are advised to update their security controls, educate employees about phishing risks, and monitor for the provided IOCs. The discovery underscores the ongoing threat posed by targeted phishing campaigns leveraging custom malware and advanced evasion techniques.
Jun 29, 2026