Loading story…
Sophos highlighted a Secureworks incident response case in which the Russia-linked IRON LIBERTY espionage group likely intercepted a victim’s web traffic and used a man-on-the-side technique to deliver Karagany malware. In the 2018 intrusion, the victim downloaded an Adobe Flash installer over unencrypted HTTP from adobe.com; within seconds, Karagany was written to disk, installed as SearchIndexer.exe, and configured to persist through the user’s Startup folder. The installer then appeared to self-modify, leaving behind a legitimate Adobe Flash binary to reduce suspicion.
Investigators assessed that a compromise of Adobe, an internal man-in-the-middle attack, and BGP hijacking were unlikely, concluding that interception through a compromised router outside the victim network was the most plausible explanation. The case underscores how attackers can gain initial access by manipulating Internet traffic rather than directly breaching endpoints, and it reinforces broader warnings that espionage actors are increasingly targeting routers, service providers, and other supply-chain pathways to undermine trust in core Internet infrastructure.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
After ruling out compromise of Adobe, an internal man-in-the-middle attack, and BGP hijacking as likely explanations, Secureworks concluded that interception of traffic via a compromised router outside the victim network was the most plausible scenario. The assessment highlighted how attackers can exploit core Internet infrastructure and trusted software delivery paths for initial access.
In a 2018 incident response case, forensic evidence indicated that the Russia-linked IRON LIBERTY espionage group likely used a man-on-the-side attack to deliver Karagany malware through a trojanized Adobe Flash installer downloaded over HTTP from adobe.com. The malware was written to disk within seconds, installed as SearchIndexer.exe, persisted via the user's Startup folder, and the installer appeared to leave behind a legitimate Adobe Flash binary.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI and Justice Department said they disrupted multiple Russian GRU operations that hijacked small office/home office routers to conceal espionage activity, proxy malicious traffic, and steal credentials. In one court-authorized action, **Operation Dying Ember**, agents remotely accessed hundreds of compromised **Ubiquiti EdgeOS** routers infected with **Moobot**, deleted malware and related files, and temporarily changed firewall rules to cut off **APT28**—also tracked as **Fancy Bear**, **Sednit**, and **Forest Blizzard**—without disrupting normal device use. Officials said the botnet had originally been built by cybercriminals abusing internet-exposed routers with default administrator passwords before being repurposed by Russia’s **GRU Unit 26165**. U.S. authorities later said a related GRU campaign also compromised SOHO routers, including **TP-Link** devices, to alter **DNS** settings and conduct adversary-in-the-middle attacks against **TLS** sessions, including Outlook traffic, in operations affecting government, IT, telecommunications, and energy targets. In **Operation Masquerade**, the FBI sent commands to infected routers to collect forensic data and reset malicious DNS configurations, removing Russian access from the devices. Microsoft and U.S. agencies linked the activity to APT28 and warned that router compromises can enable traffic redirection, credential theft, malware delivery, and denial-of-service attacks, urging organizations to patch firmware, verify DNS settings, disable unnecessary remote management, and replace end-of-life hardware.
Jun 29, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026
Infoblox reported a large malspam operation that used about **13,000 compromised MikroTik routers** to send malicious email and relay traffic through open `SOCKS4` proxies, helping the activity blend in with legitimate network traffic. The campaign impersonated **DHL** with freight-invoice lures and delivered ZIP archives containing obfuscated JavaScript that launched PowerShell and contacted a malware command-and-control server at `62.133.60[.]137`. Researchers said the infrastructure could support not only spam and malware delivery, but also phishing, DDoS, and other covert operations. A major factor in the campaign’s success was widespread **SPF misconfiguration** across roughly **20,000 sender domains**, especially records that allowed `+all`, enabling attackers to spoof trusted domains and evade normal email checks. Separate research on **MikroTik RouterOS** showed that exposed devices remained vulnerable to `CVE-2023-30799`, a privilege-escalation flaw that can lead to root access on affected hardware, while weak default credentials, username enumeration, and limited brute-force protections reduced the practical value of the authentication barrier. Together, the findings show how insecure router management and weak email authentication created durable infrastructure for a Russian-linked botnet.
Aug 15, 2026