Loading story…
Huntress uncovered a malware operation abusing software signed by Dragon Boss Solutions LLC and its legitimate Advanced Installer update mechanism to push a multi-stage payload onto Windows systems. The chain reportedly began with RaceCarTwo.exe and Setup.msi and ended with the PowerShell script ClockRemoval.ps1, which executed with SYSTEM privileges to kill antivirus processes, disable security services, add Windows Defender exclusions, block AV vendor domains via the hosts file, and maintain persistence through WMI event subscriptions and scheduled tasks.
Researchers found that update domains including chromsterabrowser[.]com and worldwidewebframework3[.]com were left unregistered, creating a supply-chain-style takeover risk in which anyone controlling those domains could have delivered arbitrary malware through the trusted updater. Huntress registered and sinkholed the infrastructure before it could be hijacked, then recorded 23,565 unique infected hosts from 124 countries contacting the domains within 24 hours, including systems in universities, government agencies, OT networks, schools, healthcare organizations, and multiple Fortune 500 environments; the firm warned the access could have been used to deploy ransomware, infostealers, or other follow-on payloads after endpoint protections were stripped away.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Within 24 hours of the sinkhole going live, 23,565 unique IP addresses contacted the Dragon Boss update infrastructure from 124 countries. Affected environments included universities, government entities, OT networks, schools, healthcare organizations, and multiple Fortune 500 networks.
Huntress published research detailing the Dragon Boss Solutions operation, the AV-killing payload chain, and the risk posed by the abandoned update domains. The disclosure warned that the compromised update path could have been used to deliver ransomware, infostealers, or other malware.
To prevent third-party abuse of the exposed update infrastructure, Huntress registered and sinkholed the unclaimed Dragon Boss update domains. This defensive action blocked potential malicious takeover of the software update channel.
Huntress discovered that update domains including chromsterabrowser[.]com and worldwidewebframework3[.]com were unregistered, creating a path for anyone controlling them to push arbitrary payloads to infected hosts through the trusted update mechanism. This elevated the activity from adware-like behavior to a supply-chain-style compromise risk.
A potentially unwanted program signed by Dragon Boss Solutions LLC used Advanced Installer to silently deliver a multi-stage infection chain on Windows systems. The payload culminated in ClockRemoval.ps1 running with SYSTEM privileges, establishing persistence and disabling antivirus and other security tools.
A Dragon Boss Solutions LLC software update on 2025-03-22 delivered a multi-stage payload via Advanced Installer that disabled security tools, established persistence, and configured Microsoft Defender exclusions on Windows hosts. This marked the operational deployment of the malicious behavior later documented by Huntress.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
6 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourcedarkreading.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026