Loading story…
Trellix reported a Linux malware campaign that delivers VShell through a spam email carrying a RAR archive whose malicious logic is embedded in a crafted filename rather than the file's contents. The attack is triggered when unsafe shell scripting patterns interpret that filename through expansion and commands such as eval, echo, printf, or logging routines, causing a Base64-decoded Bash downloader to run. The downloader fingerprints the victim's CPU architecture, retrieves an ELF loader from 47.98.194.60, and attempts stealthy execution with nohup from writable directories.
The ELF loader then contacts a hardcoded command-and-control server, receives an XOR-encrypted payload using key 0x99, decrypts it in memory, and launches the final malware with fexecve() while disguising itself as a kernel worker thread such as [kworker/0:2]. Trellix said the initial stage aligns with Snowlight dropper activity and identified the final payload as VShell, a Go-based Linux backdoor linked primarily to Chinese APT operations. The infection chain is notable for remaining effectively fileless after download, supporting multiple CPU architectures, and evading defenses that do not inspect filenames or in-memory execution behavior.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trellix published research describing a Linux malware chain in which a spam-delivered RAR archive abuses malicious payloads encoded in filenames to trigger shell execution via unsafe scripting patterns. The report linked the initial stage to Snowlight-like activity and identified the final in-memory payload as the Go-based VShell backdoor associated primarily with Chinese APT usage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyble Research & Intelligence Labs reported a new **Linux** intrusion chain dubbed **ShadowHS** that uses a highly obfuscated, multi-stage *fileless* loader to decrypt and execute payloads entirely in memory, minimizing disk artifacts and complicating forensic recovery. The loader reconstructs payloads via techniques including high-entropy encrypted blobs, runtime dependency checks, marker/offset manipulation, credential-based **AES** decryption, and `gzip` decompression, then executes from anonymous file descriptors while hiding via process/`argv` spoofing (often masquerading as `python3`). Once established, ShadowHS deploys a weaponized variant of the open-source post-exploitation tool **hackshell**, adapted into an interactive operator-controlled framework. Reported capabilities include host and security-control fingerprinting (including discovery of defensive tools/EDR), credential theft, privilege escalation, lateral movement, and data exfiltration, with an emphasis on stealthy persistence and evasion of endpoint monitoring and network controls.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Researchers reported that the **Dead#Vax** malware campaign delivers payloads through multi-stage **VHD** disk image files and heavily obfuscated batch scripts that parse themselves to reconstruct and launch shellcode directly in memory. The intrusion chain relies on **fileless execution** techniques in Windows, reducing on-disk artifacts and complicating detection, while the staged delivery mechanism helps operators evade traditional security controls. Public reporting said the malware uses self-parsing scripts and in-memory shellcode deployment to maintain stealth across infected systems, with Securonix warning that the campaign abuses native Windows functionality as part of its execution flow. The activity was described as a sophisticated, multi-stage operation designed to blend into normal system behavior, underscoring the need for defenders to monitor suspicious use of virtual disk images, script interpreters, and memory-resident execution patterns.
Jul 12, 2026