Loading story…
Sophos reported that an updated Burnt Cigar attack tool was used to impair Windows computers, with the tooling designed to disrupt system functionality rather than simply provide covert access. The report indicates the malware was deployed in a way that left affected Windows hosts unstable or unusable, highlighting a destructive capability aimed at operational impact.
The activity underscores how attacker toolsets are evolving beyond persistence and data theft to include direct system sabotage on Windows environments. Sophos tied the incident to a revised version of the Burnt Cigar tooling and warned that organizations should treat such destructive malware behavior as a serious business continuity risk because compromised endpoints may require recovery or full rebuilds after infection.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos Threat Research published a report about an updated attack tool, referred to as Burnt Cigar 2, that impairs Windows computers. No additional incident details or earlier dated events are provided in the reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported the discovery of **Splinter**, a previously unidentified post-exploitation red team tool found on multiple customer systems through Advanced WildFire memory scanning. The malware is a **Rust-based Windows implant** that stores **JSON** configuration data and communicates with its command-and-control infrastructure over **HTTPS**, indicating a mature framework designed for stealthy operator control after initial compromise. Researchers said Splinter supports a broad set of post-exploitation capabilities, including command execution, file transfer, remote process injection, cloud account information gathering, and self-deletion. Unit 42 did not attribute the tool to a known threat actor, but warned that its feature set makes it dangerous if adopted by criminal operators; the report also published technical indicators such as a **SHA-256** sample hash, a debug **PDB path** exposing the internal project name, and C2 URL paths used for tasking, heartbeat, and file operations.
Aug 14, 2026
Researchers reported that **PoorTry**—also tracked as **BurntCigar**—has evolved from a signed Windows kernel driver used to disable endpoint protections into a more destructive **EDR wiper** that deletes security software files before ransomware is deployed. Sophos observed the upgraded tool in a **RansomHub** intrusion, where attackers used a user-mode component to identify endpoint security files and a kernel-mode component to terminate protected processes and remove critical `EXE`, `DLL`, and related files, preventing security products from recovering before encryption began. The newer variants show increasingly evasive tradecraft associated with signed malicious drivers in ransomware operations. Reporting indicates the malware uses hardcoded paths as well as deletion by filename or file type, while operators rotate among differently signed payloads and manipulate signature timestamps in a **"certificate roulette"** approach to improve execution success. The activity reflects a broader pattern seen in ransomware campaigns, including earlier use of signed kernel drivers by groups such as **BlackCat/ALPHV**, to neutralize defenses at the kernel level and give attackers a clearer path to encrypt victim systems.
Aug 15, 2026
Blackpoint Cyber reported an intrusion at an industrial organization in which attackers deployed **PCHunter64.exe** from the unusual path `C:\PerfLogs`, alongside **AnyDesk**, **FileZilla**, **MASSCAN**, and **RDP** activity across seven endpoints. Investigators observed failed `ADMIN$` share mount attempts by two user accounts on one machine, indicating attempted lateral movement, and Blackpoint said it isolated affected systems within minutes before issuing remediation guidance. The incident underscores continued abuse of legitimate or allowlisted Windows administration and remote-access tools in operational environments. Sandbox analysis of **PCHunter64** shows the tool can go well beyond administration, including dropping signed driver components, creating Windows service registry entries such as `PCHUNTER64`, loading kernel drivers, deleting **SafeBoot** registry keys, and exhibiting anti-debugging and anti-VM behavior. The activity aligns with MITRE ATT&CK persistence techniques including **Windows Service** creation or modification (`T1543.003`) and boot or logon autostart execution (`T1547.008`), while additional indicators pointed to credential-access behavior, including an artifact consistent with **LSASS** minidump collection. Together, the references show how a dual-use utility can be weaponized for persistence, defense evasion, and deeper compromise inside Windows environments.
Jul 19, 2026