Loading story…
K7 Security Labs reported a Python-based remote access trojan (PyRAT) targeting both Windows and Linux, discovered via VirusTotal as a Python ELF binary packaged with PyInstaller (Python 2.7). The malware fingerprints hosts (OS, hostname, username) and communicates with its C2 over unencrypted HTTP to support remote command execution, file theft, and screenshot capture. Persistence differs by OS: on Linux it creates an autostart entry at ~/.config/autostart/dpkgn.desktop (masquerading as Debian tooling), while on Windows it adds a user-level Run key entry (e.g., under HKCU\...\Run with the value name “lee”).
FortiGuard Labs detailed ongoing activity from the Interlock ransomware group, describing a financially motivated operation impacting primarily UK- and US-based organizations, with notable focus on the education sector. Fortinet assesses Interlock as a smaller, non-RaaS group that develops and operates its own tooling across much of the kill chain, and notes that early-stage indicators in a recent intrusion align with prior reporting by eSentire and elements of the Interlock ecosystem previously documented by Mandiant—reinforcing the need for proactive threat hunting to detect intrusions before data theft and encryption occur.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On January 29, 2026, K7 Security Labs disclosed a new Python-based remote access trojan targeting both Windows and Linux, with capabilities including command execution, file transfer, screenshot capture, and ZIP-based bulk exfiltration. Researchers said the malware used unencrypted HTTP POST requests with JSON data and platform-specific persistence mechanisms.
On January 29, 2026, FortiGuard Labs published technical findings on the 2025 Interlock intrusion, including use of the Hotta Killer BYOVD tool abusing CVE-2025-61155 and a custom infostealer named move.dll. The company said it provided indicators of compromise and shared details with law enforcement.
In October 2025, the threat actor prepared for and executed ransomware deployment, encrypting Nutanix systems with an ELF payload over SSH and Windows endpoints with a JavaScript ransomware launched using a dropped javaw.exe. The attack added distinct file extensions and left ransom notes on affected systems.
In September 2025, the Interlock actor resumed operations in the victim environment, deployed multiple RAT instances, used scheduled tasks for persistence, enabled RDP, and installed ScreenConnect for GUI-based access. The actor browsed and staged data, then used AZcopy to exfiltrate more than 250GB from the primary file server to an Azure storage bucket.
FortiGuard Incident Response said a 2025 intrusion attributed to the Interlock ransomware group began on March 31, 2025, when a MintLoader-driven PowerShell download cradle deployed a Node.js runtime and a JavaScript RAT. The malware established persistence through an autorun entry and later expanded to additional Interlock RAT implants.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcefeeds.fortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Multiple threat reports describe **social-engineering-driven malware delivery** leading to remote access and follow-on payload deployment. Fortinet observed a **multi-stage phishing campaign targeting users in Russia** that delivers **Amnesia RAT** and ransomware via business-themed decoy documents and a malicious `.lnk` shortcut using a double extension (e.g., `*.txt.lnk`). The infection chain uses public cloud services for staging—**GitHub** for scripts and **Dropbox** for binary payloads—and abuses **defendnot** to trick Windows into believing a third-party AV is installed, effectively disabling **Microsoft Defender** before later-stage execution. Separately, Huntress attributed activity to **KongTuke**, which uses **malicious browser extensions** to display fake “browser crash” security alerts (“**CrashFix**”) that pressure users into running attacker-provided commands, and also deploys a Python RAT dubbed **ModeloRAT**. ModeloRAT is described as heavily obfuscated, using **Windows Registry** persistence and **RC4**-encrypted communications, with the ability to deliver additional payloads (DLLs, executables, scripts). Red Canary’s January intelligence update highlights **Scarlet Goldfinch** activity using **paste-and-run** lures and a notable technique of using the Windows `finger` client to pull remote content (e.g., `finger user@IP | cmd`), followed by `curl` download of an archive masquerading as a PDF and extraction via `tar -xf`, culminating in **Remcos** (and sometimes **NetSupport**) delivered via **DLL sideloading**.
Jun 29, 2026
Security researchers reported multiple malware campaigns emphasizing stealth and automation. K7 Lab analyzed a **Python-based RAT** packaged inside an apparently benign **ELF** executable, effectively embedding a Python runtime and scripts to evade simple file-type controls and complicate static inspection; the RAT also uses **adaptive beaconing** to reduce network noise by polling C2 rapidly when active (e.g., sub-second intervals) and sleeping longer when idle (e.g., `config.HELLO_INTERVAL`), lowering the chance of detection by behavior-based monitoring. Separately, threat reporting described a Vietnamese actor (“**Huna**”) targeting job seekers with phishing lures (often via **Dropbox-hosted** archives/links) to deliver **PureRAT** and related payloads, with tooling that shows strong indicators of **generative-AI-assisted development** (unusually detailed comments, numbered steps, and even operator instructions embedded in scripts). An Iran-aligned espionage operation attributed to **RedKitten** targeted Iranian human-rights NGOs and activists using malicious **Microsoft Excel** lures and multi-stage malware, including **AI-generated/obfuscated macros**, cloud and messaging platforms for C2 (e.g., *GitHub*, *Google Drive*, *Telegram*), and TTP overlap with known Iranian groups (e.g., *Charming Kitten*/*Nemesis Kitten* patterns), indicating continued evolution toward AI-enabled tradecraft and resilient infrastructure.
Jun 29, 2026