Loading story…
Researchers uncovered Auraboros C2, a previously undocumented Brazilian remote access trojan framework whose management panel at 174.138.43[.]25:5000 was exposed on the public internet without authentication. The HTTP-based Express.js and Socket.io dashboard, hosted on DigitalOcean and written in Brazilian Portuguese, allowed anyone with network access to view victim metadata, command history, keylogs, browser credential theft results, and real-time operator activity. Investigators said the platform supports extensive surveillance and post-compromise actions, including screenshots, webcam capture, live audio streaming, Wi-Fi password extraction, file operations, shell execution, reverse SOCKS5 proxying, and over-the-air malware updates.
Analysis indicated the Windows implant likely used DLL sideloading via DiskIntegrityScanner.exe, decrypted Chrome and Brave credentials with Windows DPAPI, and included a cookie impersonation capability alongside a self-destruct function. Despite the broad feature set, researchers found only one registered beacon tied to a Lenovo laptop in Goiânia, Brazil, suggesting the infrastructure was still in development or testing rather than large-scale deployment. The exposed server also listened on ports 1080 and 9000, believed to support reverse SOCKS5 and beacon or stager traffic, and the operator was assessed as a Brazilian Portuguese-speaking developer whose poor operational security left the entire framework and test telemetry publicly accessible.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Censys disclosed technical details on the long-running OLUOMO phishing cluster, including its two-stage architecture, use of a stolen naturalization-form lure image, service worker registration, and routing through the lookalike domain orgid[.]com. The report also described geographically distributed first-stage infrastructure and Azure-hosted second-stage backends.
Breakglass Intelligence published a report detailing Auraboros C2's capabilities, including keylogging, browser credential theft, live audio streaming, webcam capture, reverse SOCKS5 proxying, and OTA updates. The report assessed the infrastructure as likely still in development, with only one beacon tied to a Lenovo laptop in Goiânia, Brazil.
Breakglass Intelligence, after receiving tips from external researchers, identified a previously undocumented Brazilian RAT framework called Auraboros C2 exposed on 174.138.43[.]25. Its HTTP management panel on port 5000 was accessible without authentication and exposed victim data, commands, and operator functionality.
Ctrl-Alt-Intel published research on the UPMI phishing-as-a-service platform. The reference indicates public reporting on the phishing operation by this date, though the synopsis provides no further event details.
Censys reported that the adversary-in-the-middle phishing cluster it tracks as OLUOMO has been active since late November 2025, targeting Microsoft credentials and session tokens. The campaign used compromised legitimate websites as first-stage lures and Azure Web Apps as second-stage phishing proxies.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
censys.com
Open sourcecybersecuritynews.com
Open sourceintel.breakglass.tech
Open sourcectrlaltintel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zscaler ThreatLabz disclosed **Abyssos**, a newly identified modular Windows remote access trojan written in C++ that combines surveillance, credential theft, file exfiltration, and post-exploitation features. The malware uses anti-analysis checks for hypervisors and running processes, dynamically resolves Windows APIs with `CRC32` checksums, creates a mutex to ensure a single instance, and registers infected hosts to command-and-control infrastructure with a `HELLO` message carrying host metadata and the malware version. Researchers said Abyssos is under active development, with multiple observed versions including `2.4F` and `2.1F` and differing obfuscation across samples. Abyssos communicates over a custom TCP protocol encrypted mainly with **AES-GCM** using a hardcoded 32-byte key, while some downloaded modules rely on **AES-CBC** or XOR-based decryption. Its command set enables hidden **VNC** remote desktop access, browser session hijacking, clipboard interception, process and network monitoring, remote shell access, payload execution, UAC bypass, self-deletion, and broad file operations. Auxiliary modules extend the malware with keylogging, cookie and credential theft, domain controller discovery, vulnerability scanning, SYSTEM token elevation, and possible RDP-related functionality, and the report included associated sample hashes and command-and-control IP addresses.
Aug 11, 2026
Researchers reported that **Cobian RAT**, a freely advertised remote access trojan distributed on underground forums, contained a hidden backdoor planted by its original author. The malware was marketed as a basic `njRAT`-style tool with common surveillance and remote-control features, including keylogging, webcam access, screen capture, and arbitrary code execution on infected systems. Analysis found that an encrypted library inside the Cobian RAT builder allowed the author to silently take over machines infected by downstream operators and even lock those operators out of their own campaigns. The covert component retrieved a command-and-control address from a preset Pastebin page, giving the author centralized control and effectively turning other criminals’ distribution activity into a **crowdsourced botnet-building scheme**.
Aug 15, 2026
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed **DollRAT** or **"Lilly's RAT V8"** and the other using **njRAT v0.7d (Bladabindi)**. DollRAT was observed using a modified QuasarRAT `v1.4.1` codebase with **ConfuserEx** obfuscation, runtime string decryption, and command-and-control traffic routed through an **ngrok** TCP tunnel at `0.tcp.eu.ngrok.io:18107`, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including **"Lilly's RAT V8"** and **"C.U.M Software Inc."** suggests an actively maintained custom build rather than an unmodified public RAT. A separate analysis tracked an **njRAT** sample named `Client.exe` to a broader campaign using the hardcoded No-IP hostname `njspider.myddns.me` on TCP port `4444`, resolving to Belgian residential IP `62.235.6.231`. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via `HKCU` Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as **ngrok**, **No-IP**, `ipwho.is`, and `api.ipify.org` to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Jun 29, 2026