Loading story…
Attackers distributed remote-access malware through two distinct delivery chains: a fake FileZilla website serving trojanized installers and phishing emails impersonating South Korea’s National Tax Service. In the FileZilla campaign, victims received either a portable archive containing a malicious version.dll for DLL sideloading or a bundled installer that deployed legitimate FileZilla alongside a rogue DLL in the install path. The malware acted as a multi-stage loader, decrypting payloads in memory before launching a RAT that could steal credentials, log keystrokes, capture screenshots, and provide HVNC-based remote control. The operators also used DNS-over-HTTPS to Cloudflare’s resolver to look up welcome.supp0v3[.]com, likely to reduce visibility to DNS-based defenses, and included anti-analysis checks for VMware and VirtualBox environments.
In the tax-themed campaign, recipients were lured to spoofed tax-notice pages and prompted to download a ZIP archive containing a legitimate signed Intel executable, a malicious sideloaded DLL, and an encrypted BIN payload. The malware decrypted shellcode and a RAT/backdoor from vulkan-1.bin using a modified RC4 routine, then established persistence through a service named "Microsoft Compatibility system". Researchers said the backdoor supports remote control, privilege escalation, process injection, file theft, and lateral movement over RPC. Infrastructure analysis linked the activity to multiple variants and multilingual lures, including impersonation of tax and court authorities in Malaysia and India, indicating an organized, evolving multi-country operation.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Analysis of the malware and infrastructure identified multiple variants, multilingual phishing content, and persistence via a service named "Microsoft Compatibility system." The report assessed the activity as an ongoing campaign that continues to be updated and supports remote control, privilege escalation, process injection, file theft, and lateral movement via RPC.
A phishing campaign impersonating South Korea's National Tax Service was observed sending fake tax investigation notices to corporate users. Victims were directed to a spoofed page and prompted to download a ZIP archive containing a legitimate signed Intel executable, a malicious sideloaded DLL, and an encrypted BIN payload.
Researchers reported that the FileZilla-themed malware used a multi-stage loader, DNS-over-HTTPS to Cloudflare's resolver to reach the C2 domain welcome.supp0v3[.]com, anti-VM checks, and a final RAT capable of credential theft, keylogging, screenshots, and HVNC-based remote control.
Attackers set up a fake website impersonating the official FileZilla site to distribute malware through trojanized installers. The campaign used both a portable archive with a malicious version.dll for DLL sideloading and a single executable that installed legitimate FileZilla while dropping a malicious DLL.
Malwarebytes reported a campaign using the fake domain filezilla-project[.]live to distribute a trojanized portable FileZilla 3.69.5 package. The installer abused DLL sideloading via a malicious version.dll to steal saved FTP credentials and communicate with command-and-control infrastructure.
A malware campaign using tax and legal notification lures began around mid-December 2025, targeting users with spoofed government-themed messages. Related content and infrastructure indicate activity spanning South Korea, Malaysia, and India.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
blog.alyac.co.kr
Open sourceblog.alyac.co.kr
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple U.S.-focused phishing campaigns that used **tax-themed lures** to trick victims into opening password-protected ZIP archives and malicious Windows shortcut (`.lnk`) files. Microsoft said the activity targeted accounting, tax preparation, CPA, bookkeeping, and financial services firms, with emails posing as client tax documents and using AWS click-tracking links at `awstrack[.]me` to redirect users to hosted ZIP files. Securonix separately described a related campaign it tracks as **TACTICAL#OCTOPUS**, which used similar tax-season themes and staged lure PDFs to infect victims. The infection chains relied on `.lnk` files to launch PowerShell and VBScript, retrieve additional MSI, DLL, EXE, and PDF payloads, and in some cases use **GuLoader/CloudEyE** to execute shellcode and deliver **Remcos** or other malware directly in memory. Securonix said newer samples shifted from encoded IP-based URLs to public redirect services such as `rebrand.ly`, while payloads used process injection into Internet Explorer utilities including `ieinstal.exe` and `ielowutil.exe` to evade detection. Researchers said the resulting compromises enabled remote access, keystroke logging, clipboard capture, information theft, and potential lateral movement, with observed command-and-control infrastructure including `5.8.8.100`, `109.206.240.67`, and `194.180.48.211`.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026