Loading story…
Breakglass Intelligence reported two active malware operations linked to Turkish-origin threat actors, including a campaign exploiting CVE-2025-8088 in WinRAR and a separate multi-stage XWorm V6.0 distribution chain. In the WinRAR case, victims in Turkey and Germany were lured with a malicious archive named fiyat teklifi.rar, which abused NTFS Alternate Data Streams and path traversal to drop a .NET downloader into the Windows Startup folder. That downloader fetched a second-stage payload from 34[.]69[.]246[.]76, ultimately installing a PyInstaller-packed Telegram RAT, WindowsServices.exe version 1.0.8, capable of keylogging, webcam and screen capture, browser theft, FTP exfiltration, remote shell access, and UAC bypass. Investigators said the infrastructure remained live, including HTTP payload hosting, FTP services, leader-election APIs, and the Telegram bot @Roberta3358_bot, and identified at least one active victim in Istanbul.
A separate Breakglass report described an ongoing XWorm V6.0 campaign attributed with high confidence to a Turkish-origin actor using the GitHub alias flexhere687-art and the exposed email flexhere687@gmail[.]com. That operation used Google Blogger, Filemail, and GitHub to deliver obfuscated JavaScript droppers, BAT files with UAC bypass, and a trojanized Python 3.12 package that decrypted shellcode in memory, while lures referenced taxes, invoices, shipping, banking, and CVs. The malware chain established persistence through Run keys, Startup folder placement, scheduled tasks, and LOLBin abuse via SyncAppvPublishingServer.vbs, and included BAT scripts that broadly weakened Microsoft Defender through exclusions. Both reports highlighted weak operator security, including Turkish-language artifacts, exposed infrastructure, embedded credentials, plaintext HTTP, and still-accessible domains and repositories, indicating the campaigns were active and operational at the time of analysis.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published a Python tool for CVE-2025-8088 that generates malicious WinRAR archives designed to place payloads in Windows startup folders for persistence. The public release made exploit tradecraft for the WinRAR flaw more broadly accessible.
Breakglass Intelligence reported that the CVE-2025-8088 campaign's infrastructure remained active at the time of analysis, including the Telegram bot @Roberta3358_bot, HTTP payload hosting, leader-election APIs, and FTP services. The report also identified one active victim in Istanbul on TurkNet and assessed the operator as a native Turkish speaker based on code comments, filenames, and operational context.
A Turkish-speaking threat actor was observed exploiting CVE-2025-8088 in WinRAR to deliver a custom Python-based Telegram RAT via a malicious archive named "fiyat teklifi.rar." The campaign targeted victims in Turkey and Germany and used a .NET downloader in the Startup folder to fetch later-stage payloads from Google Cloud-hosted infrastructure.
Breakglass Intelligence published analysis attributing the XWorm V6.0 campaign with high confidence to a Turkish-origin actor linked to the GitHub alias flexhere687-art and email flexhere687@gmail[.]com. The report documented persistence methods, Defender exclusion abuse, layered Python and .NET malware components, and live infrastructure including backupallfresh2030[.]com and marchcap28.blogspot[.]com.
A Turkish-origin threat actor began or was already running a multi-stage XWorm V6.0 RAT campaign by at least 2026-03-22. The operation used tax, invoice, shipping, banking, and CV-themed lures and abused Blogger, Filemail, and GitHub to deliver obfuscated droppers and malware.
By 2026-01-28, security reporting indicated that attackers were actively exploiting the WinRAR vulnerability CVE-2025-8088 to deliver remote access trojans. The activity appeared broader than a single campaign, showing the flaw was already being used in the wild before the later Turkish-attributed operation.
RARLAB released WinRAR 7.13 to fix CVE-2025-8088, a path traversal flaw involving Alternate Data Streams in malicious RAR archives. The patch was issued after exploitation had begun in the wild earlier in July 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourcetheregister.com
Open sourceanrdoezrs.net
Open sourcecloud.google.com
Open sourcegithub.com
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two malware campaigns using fake or trojanized software downloads to install remote access trojans with credential theft and persistence features. eSentire identified a previously undocumented **STX RAT** after an attempted intrusion against a finance-sector organization, where a browser-downloaded VBScript launched a multi-stage loader chain using **XXTEA** and **Zlib** unpacking, anti-analysis checks, and several persistence methods. The malware supports **HVNC**, in-memory payload execution, tunneling, screenshots, security-tool inventory, and theft of browser credentials, cookies, Windows Vault data, FTP client secrets, and cryptocurrency wallets. Its command-and-control design uses **X25519 ECDH**, **Ed25519**, **HKDF-SHA256**, and **ChaCha20-Poly1305** over a custom TCP protocol, with infrastructure reachable over both the clear web and **Tor**. A separate investigation by Breakglass Intelligence found a fake software keygen packaged as a malicious WinRAR self-extracting archive that deployed the **Vjw0rm** JavaScript RAT through a four-layer dropper chain. The infection used nested SFX archives, a compiled AutoHotkey loader, parallel payload paths, and three persistence mechanisms, while abusing `upaste[.]me` as a dead-drop service and hiding the RAT as an XML file later renamed to JavaScript for execution. Researchers said the operator appeared to be a Turkish-speaking commodity cybercrime actor relying on reused tooling, deceptive file paths, and bundled legitimate Windows files to evade detection, underscoring how software cracks, keygens, and trojanized installers remain effective delivery vectors for RATs and infostealers.
Jun 29, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026