Loading story…
Palo Alto Networks detailed a persistence technique used in recent Sofacy intrusions that abuses the Microsoft Office "Office Test" registry mechanism to launch malware each time an Office application starts. The method relies on registry keys associated with Office test features, allowing attackers to execute a malicious DLL or payload while blending into normal Office-related activity and maintaining access on compromised Windows systems.
The reporting describes the technique as a stealthy post-compromise persistence method rather than an initial access vector, highlighting how it can help Sofacy survive reboots and user logoffs while evading casual inspection. By tying the malware to trusted Office startup behavior, the attackers gained a durable foothold that defenders would need to detect through close inspection of unusual Office-related registry entries and associated payloads.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Unit 42 released a technical walkthrough describing the 'Office Test' persistence technique used in recent Sofacy attacks, detailing how the method maintained access on compromised systems. The references do not provide a more specific attack date, so the publication date is used for this event.
2 references tracked. Mallory keeps watching after this page renders.
blog.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly leveraging built-in Windows features to establish persistence and evade detection on compromised systems. Common persistence mechanisms include the abuse of registry keys, scheduled tasks, and Windows Management Instrumentation (WMI), which allow malware to survive reboots and maintain long-term access. These techniques often exploit legitimate system administration tools, making it challenging for defenders to distinguish malicious activity from normal operations. Security teams are advised to proactively hunt for indicators of compromise (IOCs) associated with these persistence methods, as even fileless malware can leave traces in system configurations or memory. Fileless malware represents a significant evolution in attack methodology by operating entirely in memory and utilizing trusted Windows binaries such as PowerShell, MSHTA, and rundll32. This approach enables attackers to bypass traditional signature-based antivirus solutions, as no malicious files are written to disk. Persistence for fileless malware can be achieved by embedding encoded scripts or commands within the Windows Registry, WMI, or Task Scheduler, allowing the malware to re-execute at startup without leaving conventional artifacts. Defenders must adapt detection strategies to monitor for unusual use of native tools and changes in system persistence mechanisms to effectively counter these threats.
Jun 29, 2026
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026
Blackpoint Cyber reported an intrusion at an industrial organization in which attackers deployed **PCHunter64.exe** from the unusual path `C:\PerfLogs`, alongside **AnyDesk**, **FileZilla**, **MASSCAN**, and **RDP** activity across seven endpoints. Investigators observed failed `ADMIN$` share mount attempts by two user accounts on one machine, indicating attempted lateral movement, and Blackpoint said it isolated affected systems within minutes before issuing remediation guidance. The incident underscores continued abuse of legitimate or allowlisted Windows administration and remote-access tools in operational environments. Sandbox analysis of **PCHunter64** shows the tool can go well beyond administration, including dropping signed driver components, creating Windows service registry entries such as `PCHUNTER64`, loading kernel drivers, deleting **SafeBoot** registry keys, and exhibiting anti-debugging and anti-VM behavior. The activity aligns with MITRE ATT&CK persistence techniques including **Windows Service** creation or modification (`T1543.003`) and boot or logon autostart execution (`T1547.008`), while additional indicators pointed to credential-access behavior, including an artifact consistent with **LSASS** minidump collection. Together, the references show how a dual-use utility can be weaponized for persistence, defense evasion, and deeper compromise inside Windows environments.
Jul 19, 2026