Loading story…
Trellix reported a Linux malware campaign that delivers VShell through a spam email carrying a RAR archive whose malicious logic is embedded in a crafted filename rather than the file's contents. The attack is triggered when unsafe shell scripting patterns interpret that filename through expansion and commands such as eval, echo, printf, or logging routines, causing a Base64-decoded Bash downloader to run. The downloader fingerprints the victim's CPU architecture, retrieves an ELF loader from 47.98.194.60, and attempts stealthy execution with nohup from writable directories.
The ELF loader then contacts a hardcoded command-and-control server, receives an XOR-encrypted payload using key 0x99, decrypts it in memory, and launches the final malware with fexecve() while disguising itself as a kernel worker thread such as [kworker/0:2]. Trellix said the initial stage aligns with Snowlight dropper activity and identified the final payload as VShell, a Go-based Linux backdoor linked primarily to Chinese APT operations. The infection chain is notable for remaining effectively fileless after download, supporting multiple CPU architectures, and evading defenses that do not inspect filenames or in-memory execution behavior.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trellix published research describing a Linux malware chain in which a spam-delivered RAR archive abuses malicious payloads encoded in filenames to trigger shell execution via unsafe scripting patterns. The report linked the initial stage to Snowlight-like activity and identified the final in-memory payload as the Go-based VShell backdoor associated primarily with Chinese APT usage.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a highly targeted intrusion campaign that concealed its final-stage payload by storing encrypted shellcode inside Windows event logs, giving attackers a stealthy way to maintain a **fileless** presence on compromised systems. Observed from September 2021 through at least February 2022, the operation used a multi-stage chain that combined commercial offensive tools including **Cobalt Strike** and **SilentBreak** with custom anti-detection wrappers, **DLL sideloading**, memory injection, and patching of **ETW** and **AMSI** to reduce visibility. The attackers also used signed malware, victim-tailored domain mimicry, and infrastructure hosted with providers including **Linode**, **Namecheap**, and **DreamVPS**. Persistence was established by copying `WerFault.exe` and a malicious `wer.dll` into `C:\Windows\Tasks`, while later-stage RAT variants communicated over **HTTP** or named pipes and supported reconnaissance, command execution, file operations, credential theft, screenshot capture, privilege abuse, and lateral movement. Researchers did not attribute the activity to a known threat actor and provisionally labeled the operation **SilentBreak** because that toolset featured prominently in the campaign.
Aug 14, 2026
Cyble Research & Intelligence Labs reported a new **Linux** intrusion chain dubbed **ShadowHS** that uses a highly obfuscated, multi-stage *fileless* loader to decrypt and execute payloads entirely in memory, minimizing disk artifacts and complicating forensic recovery. The loader reconstructs payloads via techniques including high-entropy encrypted blobs, runtime dependency checks, marker/offset manipulation, credential-based **AES** decryption, and `gzip` decompression, then executes from anonymous file descriptors while hiding via process/`argv` spoofing (often masquerading as `python3`). Once established, ShadowHS deploys a weaponized variant of the open-source post-exploitation tool **hackshell**, adapted into an interactive operator-controlled framework. Reported capabilities include host and security-control fingerprinting (including discovery of defensive tools/EDR), credential theft, privilege escalation, lateral movement, and data exfiltration, with an emphasis on stealthy persistence and evasion of endpoint monitoring and network controls.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026