Loading story…
Forcepoint X-Labs reported a high-volume phishing campaign leveraging the long-running Phorpiex botnet to deliver Global Group ransomware (described as a successor to the Mamona family). The emails commonly use the subject line “Your Document” and include attachments that appear to be documents inside ZIP archives but are actually malicious Windows Shortcut files (.lnk) disguised via double extensions such as Document.doc.lnk—a tactic that benefits from Windows hiding file extensions by default. When opened, the shortcut triggers a living-off-the-land execution chain (e.g., cmd.exe and PowerShell) to download and run a secondary payload that may be named to resemble a legitimate component (e.g., windrv.exe).
Reporting highlighted that Global Group ransomware can operate in a “mute” mode, enabling offline encryption behavior intended to reduce reliance on command-and-control and evade some traditional detections. Separate coverage about the purported 0APT leak site and a Coveware/Clop-focused analysis of downstream mass data-extortion payment trends are not part of this Phorpiex/Global Group activity and do not add incident-specific details to the LNK-based ransomware delivery campaign.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Forcepoint X-Labs publicly reported the phishing campaign and detailed how malicious LNK files, living-off-the-land execution, and Phorpiex malware were being used to deliver Global Group ransomware. The report also highlighted the ransomware's offline capability and anti-forensic behavior.
Researchers observed Global Group ransomware, described as a successor to Mamona, operating in a mode that generates encryption keys locally and does not require command-and-control communication. The malware could therefore encrypt offline or air-gapped systems while also deleting shadow copies, self-deleting, and appending the .Reco extension to files.
A phishing campaign active throughout 2024 and 2025 used emails such as "Your Document" with deceptive .lnk attachments like "Document.doc.lnk" to infect victims. The shortcuts abused cmd.exe and PowerShell to download Phorpiex-related payloads that ultimately deployed Global Group ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourceforcepoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026
Phorpiex, also tracked as **Trik**, grew from an IRC-controlled Windows worm into a large modular botnet used to spread spam, sextortion emails, cryptocurrency miners, stealers, and ransomware. Early variants copied themselves into hidden directories, set **Run** key persistence, weakened host defenses by adding firewall exceptions and disabling Windows Defender, and accepted commands to download payloads, brute-force SMTP accounts, and mass-mail ZIP-packed malware. Researchers later tied the botnet to more than **1 million infected systems**, with infections observed across **160 countries**, and noted propagation through phishing, removable USB drives, instant messaging, fake software sites, and other malware. Later Phorpiex operations shifted from legacy IRC infrastructure toward HTTP, IP-based, and **DGA**-backed command-and-control centered on the **Tldr** loader, while retaining older spam and worming capabilities. The platform delivered secondary payloads including **XMRig**, **Raccoon Stealer**, **Predator The Thief**, **GandCrab**, **Avaddon**, **Nemty**, **Knot**, **Pony**, and other ransomware, and also used clipboard hijacking and data exfiltration for monetization. Check Point and Microsoft reported resilient infrastructure, including dedicated subnets and payload validation with **RC4** encryption plus **RSA-SHA1** signature checks, while a VNC worm module brute-forced exposed port `5900` systems and drove victims to download malware, underscoring Phorpiex's role as a durable criminal distribution service.
Aug 15, 2026
Threat actors are increasingly relying on *living-off-the-land* techniques and trusted tooling to establish persistent access on Windows endpoints. One campaign used weaponized Windows shortcut (`.LNK`) files disguised as investment-related PDFs to deliver **MoonPeak**, a remote access trojan assessed as a **XenoRAT** variant and linked to North Korea–aligned activity targeting South Korean investors and cryptocurrency traders. Opening the `.LNK` launches an obfuscated PowerShell-driven, multi-stage infection chain while displaying a decoy PDF; analysis also tied payload hosting to attacker-controlled GitHub repositories, reflecting “Living Off Trusted Sites (LOTS)” tradecraft. A separate dual-wave intrusion chain used phishing emails masquerading as *Greenvelope* invitations to steal webmail credentials (e.g., Outlook, Yahoo, AOL), then used the compromised accounts to register for and silently deploy **LogMeIn Resolve** (formerly *GoTo Resolve*) for persistent remote access. The installer (`GreenVelopeCard.exe`) was described as signed and configured to connect to attacker-controlled infrastructure, with follow-on actions including modifying service settings for elevated access and creating hidden scheduled tasks for resilience. Related threat intelligence reporting also highlighted broader “rogue RMM” abuse trends, including **Remcos** and **NetSupport Manager** delivery via paste-and-run lures and PowerShell/`cmd` execution chains (including use of the `finger` utility to fetch remote payloads), underscoring that adversaries are operationalizing legitimate remote administration software as a stealthy backdoor mechanism.
Jun 29, 2026