Loading story…
The provided items do not describe a single shared incident or disclosure. Two references are substantive threat-intelligence writeups: one analyzes a PlugX RAT infection chain delivered via a “Meeting Invitation” phish and leveraging DLL side-loading (using G DATA’s Avk.exe to load a malicious Avk.dll), and another details APT37’s Ruby Jumper campaign that uses malicious LNK files to drop and execute staged payloads (batch + PowerShell + shellcode) and ultimately run RESTLEAF, including Zoho WorkDrive abuse for C2 token-based API access.
A third reference is a conference write-up from JSAC2026 Day 2 describing a digital forensics technique and tool (FJTA – Forensic Journal Timeline Analyzer) for reconstructing file operations from ext4/XFS journal structures to improve timelines when MACB timestamps are unreliable (e.g., timestomping). While technically relevant to DFIR, it is not connected to the PlugX or APT37 reporting and reads primarily as an event/session summary rather than a specific threat event report.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
LAB52 reported that the PlugX loader downloaded components from onedow[.]gesecole[.]net and communicated over HTTPS with decoraat[.]net:443. The analysis also detailed XOR and RC4-based decryption routines and API hashing used by the loader and payload to hinder static analysis.
The PlugX deployment chain used a legitimate G DATA antivirus executable, Avk.exe, to side-load a malicious Avk.dll, which decrypted and injected a payload stored in the encrypted AVKTray.dat file. The loader also established persistence through a Run key named "G DATA" and created temporary artifacts under %TEMP%.
A recent PlugX intrusion began with a spear-phishing email themed as a meeting invitation that delivered a ZIP archive containing an executable and an MSBuild project file. The .csproj file abused MSBuild as a LOLBIN to download additional components and start the infection chain.
APT37 deployed additional tools including SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and BLUELIGHT to persist, spread via removable media, relay commands across air-gapped systems, and exfiltrate data. These components expanded the campaign's capability to bridge segmented networks and use multiple cloud services for command and control.
In the Ruby Jumper campaign, APT37 used the RESTLEAF malware to download shellcode, inject it into processes, and communicate through Zoho WorkDrive using timestamped files in a cloud folder. ThreatLabz assessed this as the first observed use of Zoho WorkDrive as a C2 channel by APT37.
APT37 conducted the Ruby Jumper campaign, delivering malicious Windows shortcut files that launched PowerShell, extracted embedded components, and executed the RESTLEAF malware in memory. The operation targeted segmented or air-gapped environments and used staged shellcode loaders for stealth.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The provided items do not describe a single cohesive cybersecurity event; they span multiple unrelated threat reports and opinion pieces. Notable incident-level reporting includes **APT28** activity in Western/Central Europe (“Operation MacroMaze”) using spear-phishing lures with Office macros that beacon via `INCLUDEPICTURE` to `webhook[.]site` and then execute VBScript/CMD/batch stages for persistence and follow-on payload delivery. Separately, **MuddyWater** (Iran/MOIS-linked) was reported running “Operation Olalampo” against organizations in the Middle East and Africa, delivering new custom malware (including a **Char** backdoor using a **Telegram bot** for C2) and, in some cases, attempting exploitation of public-facing servers in addition to phishing. Criminal activity and initial-access tradecraft were also covered across distinct stories: a DFIR case study described exploitation of **Apache ActiveMQ** `CVE-2023-46604` to gain RCE, conduct post-exploitation (Metasploit/Meterpreter, privilege escalation, LSASS access, lateral movement), and ultimately deploy **LockBit**-branded ransomware via RDP using previously stolen credentials (with indications the payload was built using the leaked builder and used *Session* for communications). Multiple reports described malware delivery via compromised web assets and social engineering, including **GrayCharlie** injecting malicious JavaScript into WordPress sites to push **NetSupport RAT**, **Stealc**, and **SectopRAT** via fake updates/ClickFix-style CAPTCHAs, and a separate **ClickFix** campaign delivering a custom C++ RAT (**MIMICRAT**) through fake Cloudflare verification prompts that trick users into running PowerShell. Additional, unrelated threat reporting included a **NuGet** supply-chain attack (typosquatted `NCryptYo` plus companion packages) targeting ASP.NET Identity data and enabling backdoored authorization rules, and malicious Chrome extensions using a “**Promise Bomb**” browser-crash technique to drive users to run fake “CrashFix” PowerShell steps. Several other items were generic commentary/roundups (data breach trends, quantum preparedness, Enigma history, NATO public opinion polling, recon how-to, and a malware-newsletter link list) and do not add event-specific intelligence.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Trend Micro reported an APT intrusion involving **PlugX** malware in which the attacker used remotely created **one-time scheduled tasks** to execute payloads, rather than relying on scheduled tasks for persistence or privilege escalation. Investigators found the same user account was used to launch both PlugX and an auxiliary tool, a technique that likely complicated forensic reconstruction and **EDR** root-cause analysis while blending malicious activity with legitimate administration patterns. The attacker also deleted tools from disk quickly—often within **15 minutes**—reducing opportunities for responders to recover artifacts and analyze the toolset. Trend Micro said PlugX remained difficult to detect because it abused a legitimate-looking normal file, and it advised defenders to hunt for anomalous file locations, suspicious hashes and digital signers, mapped Windows administrative shares, and unusual scheduled-task activity as indicators of infection and lateral movement.
Aug 14, 2026