Loading story…
Positive Technologies reported that PhantomCore conducted a large-scale cyberespionage campaign using a mix of phishing, compromised corporate email accounts, malicious attachments and links, and in some cases exploitation of a TrueConf vulnerability chain tracked as BDU:2025-10114, BDU:2025-10115, and BDU:2025-10116. The group was observed deploying a substantial custom toolset including PhantomRAT, PhantomRShell, PhantomTaskShell, PhantomProxyLite, PhantomStealer, and a dedicated control panel, while also abusing legitimate software such as MeshAgent, OpenSSH, Rclone, and XenArmor. Researchers said the activity may indicate a split within the PhantomCore APT group.
After gaining access, the attackers established persistence with disguised scheduled tasks, services, local accounts, and web shells, then stole credentials from LSASS and NTDS, moved laterally over RDP, SMB, and WinRM, and masked operations with obfuscated PowerShell, DLL hijacking, disabled defenses, and cleared logs. Their command-and-control infrastructure used phishing domains, VPS hosts, compromised servers, SSH and SOCKS5 tunnels, HTTPS, and nonstandard ports, with data exfiltration carried out through HTTP channels, external servers, and cloud storage including Mega.nz. In at least one intrusion, the operation escalated from espionage to destructive impact when PhantomCore used Kaspersky Security Center to distribute LockBit 3.0 ransomware across compromised systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A later Positive Technologies report says PhantomCore used active scanning, a chain of TrueConf vulnerabilities (BDU:2025-10114, BDU:2025-10115, BDU:2025-10116), spearphishing with malicious LNK files, and legitimate administration tools to expand access. The intrusion culminated in credential dumping, lateral movement, exfiltration over C2 channels, and deployment of LockBit 3.0 ransomware on compromised systems.
Positive Technologies' global report details PhantomCore's full intrusion lifecycle, including phishing-based initial access, persistence through scheduled tasks, credential theft, segmented command-and-control infrastructure, and exfiltration to external servers and Mega.nz. This publication consolidates technical details on the group's malware ecosystem and operational methods.
Positive Technologies describes PhantomCore as running a broad cyberespionage campaign using phishing through compromised corporate email accounts, custom malware families such as PhantomRAT and PhantomRShell, lateral movement via RDP/SMB/WinRM, and data theft using tools including PhantomStealer and Rclone. The reporting also raises the possibility of a split within the PhantomCore APT group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
ptsecurity.com
Open sourceglobal.ptsecurity.com
Open sourcehabr.com
Open sourceptsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
A multi-stage phishing campaign is delivering **Phantom Stealer v3.5.0** through compressed archive attachments that contain obfuscated JavaScript, using shipment and tax-audit lures that impersonate trusted organizations including **UPS Forwarding Hub** and Malaysia’s **Inland Revenue Board (LHDN)**. After a victim opens the attachment, the JavaScript launches hidden PowerShell stages that decode and decrypt additional payloads with **AES** and **XOR**, keeping much of the activity in memory to reduce detection. The final payload is reflectively executed and injected into `aspnet_compiler.exe`, where it steals system information, browser credentials, cookies, payment card data, cryptocurrency wallet files, and messaging application data. The stolen information is then exfiltrated over authenticated **SMTP** on **TCP port 587** using **EHLO**, **STARTTLS**, and **AUTH LOGIN** with Base64-encoded credentials; researchers said they could not conclusively attribute the activity to a specific threat actor, noting that Phantom Stealer is broadly available in the cybercriminal ecosystem.
Jul 22, 2026
PhantomStealer v3.5.0 was deployed in multiple phishing campaigns using invoice, RFQ, maritime, and industrial lures delivered as heavily obfuscated JavaScript droppers. Across the observed samples, the malware followed a consistent multi-stage chain: Windows Script Host launched PowerShell, decrypted additional payloads, reflectively loaded .NET components, and hollowed the signed Microsoft binary `Aspnet_compiler.exe` to run the final infostealer. Researchers tied the activity to the PhantomStealer malware-as-a-service ecosystem advertised via `phantomsoftwares.site` and the Telegram identity **Oldphantomoftheopera**, with builder-generated samples showing per-build customization but a stable framework, anti-analysis logic, and optional persistence. The payloads stole browser credentials, cookies, credit cards, email and messaging data, Wi-Fi passwords, screenshots, keystrokes, and cryptocurrency wallet information, while some builds also enabled a crypto clipper that replaced wallet addresses across multiple chains. The campaigns abused legitimate but compromised infrastructure for both delivery and exfiltration, including a Portuguese theater website hosting encrypted PowerShell stages, a Chilean mail server and a Malaysian business email account used as SMTP relays, and Romanian FTP hosting used by another PhantomStealer build. Exfiltration varied by sample—SMTP to attacker mailboxes at `graceishere.tech`, Telegram Bot API, Discord, or FTP—but infrastructure overlap repeatedly linked the deployments back to the same MaaS operation, and one report also connected a PhantomStealer FTP campaign to related AgentTesla activity through shared submissions and tooling. The targeting and lure themes indicate a focus on procurement, shipping, maritime, industrial, and accounts receivable personnel, while the repeated use of compromised SMB hosting and mail systems suggests operators favored hijacked third-party services over dedicated attacker-owned infrastructure.
Jun 29, 2026