Loading story…
Cyble Research & Intelligence Labs reported a new Linux intrusion chain dubbed ShadowHS that uses a highly obfuscated, multi-stage fileless loader to decrypt and execute payloads entirely in memory, minimizing disk artifacts and complicating forensic recovery. The loader reconstructs payloads via techniques including high-entropy encrypted blobs, runtime dependency checks, marker/offset manipulation, credential-based AES decryption, and gzip decompression, then executes from anonymous file descriptors while hiding via process/argv spoofing (often masquerading as python3).
Once established, ShadowHS deploys a weaponized variant of the open-source post-exploitation tool hackshell, adapted into an interactive operator-controlled framework. Reported capabilities include host and security-control fingerprinting (including discovery of defensive tools/EDR), credential theft, privilege escalation, lateral movement, and data exfiltration, with an emphasis on stealthy persistence and evasion of endpoint monitoring and network controls.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Further technical details showed ShadowHS deploys a weaponized variant of the open-source hackshell tool, fingerprints hosts for security products, and uses anti-competition logic against rival malware. Researchers also described its use of anonymous file descriptors, argv spoofing, and GSocket tunneling to support credential theft, privilege escalation, lateral movement, and data exfiltration while evading monitoring and firewalls.
Cyble Research & Intelligence Labs reported a newly discovered malware framework dubbed ShadowHS targeting Linux systems. The framework uses a fileless, multi-stage encrypted loader to decrypt and execute payloads directly in memory for stealthy compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trellix reported a Linux malware campaign that delivers **VShell** through a spam email carrying a RAR archive whose malicious logic is embedded in a crafted filename rather than the file's contents. The attack is triggered when unsafe shell scripting patterns interpret that filename through expansion and commands such as `eval`, `echo`, `printf`, or logging routines, causing a Base64-decoded Bash downloader to run. The downloader fingerprints the victim's CPU architecture, retrieves an ELF loader from `47.98.194.60`, and attempts stealthy execution with `nohup` from writable directories. The ELF loader then contacts a hardcoded command-and-control server, receives an XOR-encrypted payload using key `0x99`, decrypts it in memory, and launches the final malware with `fexecve()` while disguising itself as a kernel worker thread such as `[kworker/0:2]`. Trellix said the initial stage aligns with **Snowlight** dropper activity and identified the final payload as **VShell**, a Go-based Linux backdoor linked primarily to Chinese APT operations. The infection chain is notable for remaining effectively fileless after download, supporting multiple CPU architectures, and evading defenses that do not inspect filenames or in-memory execution behavior.
Jun 29, 2026
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026
Multiple weekly threat roundups and research posts reported a mix of active exploitation, new malware tradecraft, and breach claims. Ukraine’s CERT reported **APT28** rapidly weaponized a Microsoft Office zero-day (**CVE-2026-21509**) within roughly a day of Microsoft’s disclosure, using spearphishing emails with malicious DOC lures to deliver **Covenant** backdoors against Ukrainian government targets and EU-related entities. Separately, researchers described **ShadowHS**, a stealthy **fileless Linux** post-exploitation framework that runs in-memory (e.g., via `memfd`-style execution), uses encrypted multi-stage loading (AES-256-CBC), fingerprints defensive tooling (including major EDR agents), and retains operator-driven capabilities such as credential theft, lateral movement, and covert tunneling for exfiltration. Other reporting highlighted incident and exposure claims and defensive takeaways. Check Point described a **supply-chain compromise** affecting *eScan* (MicroWorld Technologies) in which malicious updates were pushed through the legitimate updater, prompting an emergency shutdown of global update services; it also noted **Crunchbase** confirmed a breach affecting **2M+ records** claimed by **ShinyHunters**, and cited extortion/leak claims involving **Qilin** (Tulsa International Airport) and **WorldLeaks** (Nike). Google’s legal/technical disruption of the **IPIDEA** residential proxy network was also cited as reducing available proxy nodes by millions and cutting off C2 domains used to route attacker traffic. Additional coverage described a phishing chain using a fake DHL invoice to abuse a signed Java utility via **DLL sideloading** (malicious `jli.dll`) and **process hollowing** into `AddInProcess32.exe` to run **Phantom Stealer**; detection-engineering updates emphasized new rules for Windows defense-evasion (e.g., tampering with Credential Guard/HVCI, disabling AMSI and the vulnerable driver blocklist) and expanded Kubernetes and Linux post-exploitation detections.
Jun 29, 2026