Loading story…
Aryaka Threat Research reported that the BlackSanta malware campaign is targeting recruitment workflows, using job-related lures to reach victims and then attempting to neutralize endpoint protection with EDR-killing functionality. The operation was described as a stealthy intrusion chain designed to blend into normal hiring activity while weakening host defenses early in execution, increasing the likelihood of follow-on compromise and persistence.
Separately, Censys published an advisory on GNU Inetutils telnetd remote authentication bypass tracked as CVE-2026-24061, highlighting a flaw that could allow unauthorized access to exposed services. Together, the reports underscore concurrent risks from both socially engineered malware delivery and internet-exposed remote access software vulnerabilities, with defenders urged to review recruitment-related security controls, validate endpoint protection tamper resistance, and identify any externally reachable telnetd instances requiring remediation.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Aryaka Threat Research published a report describing the BlackSanta malware campaign, which it said targeted recruitment workflows and attempted to disable endpoint security tools.
Censys published an advisory for CVE-2026-24061 affecting GNU Inetutils telnetd. The topic indicates the advisory was issued on January 27, documenting a remote authentication bypass vulnerability.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
censys.com
Open sourcearyaka.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 reported multiple intrusions tied to an ongoing social-engineering campaign that starts with email bombing and follow-up calls, often over Microsoft Teams, to pressure users into installing **AnyDesk**. In the observed June 2024 cases, the operators moved away from earlier Quick Assist and batch-script tradecraft and instead used a signed .NET credential harvester, `AntiSpam.exe`, followed by payloads masquerading as software updates. Those payloads included **SystemBC**, Golang HTTP beacons, SOCKS proxy implants, a PowerShell proxy script, reverse SSH tunnels, and **Level RMM** for persistence and lateral movement, with several binaries signed by the same certificate to appear legitimate. Rapid7 said one payload, `update6.exe`, attempted to exploit **`CVE-2022-26923`** to add a machine account for privilege escalation on vulnerable domain controllers, then moved to **Kerberoasting** by requesting Kerberos service tickets tied to service principal names and cracking them offline to recover service-account credentials. That technique can provide valid account access and support further privilege escalation, persistence, and lateral movement inside Windows domains. Rapid7 published indicators of compromise and urged defenders to use application allowlisting, block unapproved remote monitoring and management tools and related domains, train users to resist help-desk impersonation, and patch systems exposed to `CVE-2022-26923`.
Aug 15, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026
Aryaka researchers reported a **Russian-speaking** threat actor targeting corporate **HR teams and recruiters** with fake job applications that deliver malware via a resume-themed **ISO** file, likely distributed through spam and hosted on common cloud storage services. When the ISO is mounted, victims are tricked into executing a disguised **Windows shortcut (`.lnk`)** that launches `cmd`/PowerShell, extracts hidden data from an image file, and runs additional PowerShell in memory. The chain then downloads a decoy archive (e.g., `SumatraPDF.zip`) from attacker-controlled domains (including `resumebuilders.us` and `thresumebuilder.com`), leveraging **DLL sideloading** (e.g., `SumatraPDF.exe` loading `DWrite.dll`) to execute the next-stage payload while blending into normal user activity. A key capability in the operation is an **EDR/AV “killer”** component (described as **BlackSanta**) intended to disable endpoint defenses before follow-on actions such as host profiling and data theft, with much of the activity occurring **in memory** to reduce forensic artifacts. Aryaka assessed the campaign as **low-noise and potentially long-running (over a year)**, but noted limited telemetry on overall prevalence; the tradecraft is designed to exploit routine hiring workflows where recruiters rapidly open candidate materials and may not scrutinize ISO-mounted content or shortcut execution.
Jun 29, 2026