Loading story…
Researchers have detailed a PureRAT campaign targeting Windows systems with a multi-stage, largely fileless infection chain that begins with a malicious .lnk shortcut. The shortcut launches PowerShell and an obfuscated VBScript loader, which retrieves a PNG image carrying a hidden Base64-encoded PE payload via steganography and loads it directly into memory. The malware then applies several defense-evasion techniques, including anti-analysis checks for VMware and QEMU, UAC bypass through cmstp.exe, and process hollowing into msbuild.exe, while additional components are protected with .NET Reactor and decrypted in memory with TripleDES.
Once active, PureRAT fingerprints the infected host by collecting details on security tools, hardware, privileges, OS configuration, webcam presence, idle time, and possible cryptocurrency wallet artifacts, then connects to command-and-control infrastructure including crixup[.]com and instantservices1[.]ddnsguru[.]com:1917 linked to 178[.]16[.]52[.]58. Operators can deploy modular capabilities such as keylogging, remote desktop access, environmental monitoring, and broader remote control, while persistence is maintained through scheduled tasks and registry run keys. Published reporting and threat research describe the malware as a high-severity RAT and include indicators of compromise such as domains, an IP address, and multiple SHA-256 hashes to support detection and response.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reported on the same PureRAT campaign, emphasizing its use of PNG-hidden PE payloads and largely fileless execution to evade disk-based defenses. The article reiterated the malware's staged infection chain, anti-analysis features, persistence, and plugin-based capabilities.
Gurucul published a threat research entry summarizing the PureRAT activity and added indicators of compromise such as domains, an IP address, and SHA-256 hashes, along with example detection queries. The content cited the earlier Trellix research as its source rather than introducing a separate incident.
Trellix disclosed a multi-stage PureRAT remote access trojan campaign targeting Windows systems via malicious LNK files, PowerShell, steganography in PNG images, UAC bypass, and process hollowing into msbuild.exe. The report described persistence mechanisms, anti-analysis checks, host fingerprinting, and command-and-control infrastructure including crixup[.]com and instantservices1[.]ddnsguru[.]com:1917 / 178[.]16[.]52[.]58.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcetrellix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers across multiple reports documented continued **njRAT** (also known as **Bladabindi**) activity delivered through diverse infection chains, including malicious PowerPoint macros, phishing attachments, password-protected archives, trojanized software on Korean webhard sites, compiled AutoHotKey loaders, and typosquatted npm packages. The malware was shown using layered obfuscation in VBS and PowerShell, Base64-encoded payloads, reflective or in-memory loading, and staged retrieval from services such as `paste.ee`, `archive.org`, `wtools.io`, and dynamic DNS infrastructure. In one supply-chain case, the npm packages `jdb.js` and `db-json.js` installed a .NET payload that copied itself as `dchps.exe` and connected to `46.185.116.2:5552`, while other campaigns used domains including `fidapeste2.duckdns.org`, `xxxcarldon.duckdns.org`, and `0.tcp.eu.ngrck.io` for command and control. Analysis of multiple samples showed njRAT maintaining persistence through **Startup folder** copies, **registry Run keys**, shortcuts, mutexes, firewall-rule changes, and even `netsh` exclusions, while some variants bundled legitimate applications so victims would not notice the infection. Once active, the RAT collected host profiling data and supported a broad set of attacker functions, including **keylogging, credential theft, webcam access, screenshot and screen viewing, file transfer, process and registry manipulation, remote shell access, and full remote control** of Windows systems. Reports also linked njRAT delivery to long-running loader ecosystems that rotated payload families such as Houdini, LimeRAT, RevengeRAT, AsyncRAT, and VjW0rm, underscoring the malware’s persistence as a flexible commodity RAT used across phishing, malware-hosting, and software supply-chain abuse.
Aug 15, 2026
Researchers detailed an ongoing **Snip3 crypter** malware campaign that used spear-phishing emails themed as tax statements to launch a multi-stage infection chain. The attacks began with obfuscated **VBScript** and **PowerShell** downloaders that retrieved additional components from remote infrastructure including SQL-backed command sources and public text-hosting services, then established persistence through startup-folder VBS files. Later stages gathered host information, communicated with download servers over HTTP POST, and decrypted further payloads directly in memory to reduce detection. The final Snip3 stage dynamically compiled C# **RunPE** code with CodeDom and used **process hollowing** to inject remote-access trojans into legitimate Windows processes including `AppLaunch.exe`, `RegAsm.exe`, and `regsvcs.exe`. Analysis across samples showed the framework delivering both **DcRAT** and **QuasarRAT**, with one examined payload identified as DcRAT through artifacts including its mutex naming, X.509 certificate fields, and the AES salt string `DcRatByqwqdanchun`. The reporting indicates Snip3 remains an adaptable loader for concealing commodity RATs behind layered scripting, in-memory decryption, and changing command-and-control infrastructure.
Aug 15, 2026