Loading story…
Trend Micro reported that the Earth Minotaur threat actor is conducting multi-platform attacks using the MOONSHINE Exploit Kit to gain initial access and the DarkNimbus backdoor to maintain control of compromised systems. The activity highlights an intrusion chain built to target more than one operating environment, giving the actor flexibility to compromise victims and establish persistent access across diverse enterprise infrastructure.
The campaign combines exploitation and post-compromise tooling in a way that supports sustained operations after the initial breach. By pairing the MOONSHINE Exploit Kit with the DarkNimbus backdoor, Earth Minotaur can move from exploitation to persistence and remote control, underscoring the risk posed by threat actors that maintain adaptable malware and access capabilities across multiple platforms.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing Earth Minotaur's multi-platform attacks involving the MOONSHINE exploit kit and the DarkNimbus backdoor. The reference does not provide earlier dated events, so the publication itself is the only extractable timeline event from the available content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 67 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcetrendmicro.com
Open sourceblog.talosintelligence.com
Open sourcecloud.google.com
Open sourceabout.fb.com
Open sourcecitizenlab.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple espionage-focused threat clusters have adopted the **BlueMoon** exploit kit, chaining Chromium V8 vulnerabilities, a V8 sandbox escape, and the Windows kernel privilege-escalation flaw `CVE-2026-85880` to gain code execution and elevated privileges. Older Windows 10 and Windows Server 2019/2022 builds are reported to be particularly exposed. The activity begins with phishing and has targeted U.S. NGOs, mining and commodity-trading firms, as well as government, defense, aerospace, manufacturing, financial, and commercial organizations across the United States and Southeast Asia. TA412, also tracked as Violet Typhoon and APT31, was the first identified user and used phishing to install the **GemStone** malicious browser extension. Additional clusters—UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket—have reportedly used the kit to deliver browser-surveillance payloads, ShadowPad, and other loaders. Proofpoint assessed that rapid adoption by several actors, exposed development artifacts, and exploitation during patch gaps suggest a shared exploit-procurement pipeline; AI-assisted development may also have lowered the barrier to weaponizing browser exploits.
Sep 15, 2026
An Iran-linked threat actor tracked as **Nimbus Manticore**—also associated in reporting with **Mirage Kitten**—has been tied to a cyber-espionage campaign targeting organizations across the Middle East, Africa, and parts of South Asia. Researchers said the operation deployed a newly documented Windows backdoor, **NightLedger**, alongside two custom WebSocket tunneling tools, **BridgeHead** and **ArcBridge**, against victims in sectors including government, telecommunications, aviation, aerospace, finance, and small and medium-sized businesses. Reported victim countries include Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso. The malware set was designed to support long-term covert access, with **NightLedger** enabling reconnaissance, command execution, file operations, process discovery, screenshot capture, exfiltration, persistence, and evasion, while **BridgeHead** and **ArcBridge** turned compromised systems into operator-controlled relays for hidden communications through victim networks. The initial intrusion vector has not been confirmed, though the actor has previously used tailored phishing lures such as fake job offers and spoofed videoconferencing pages. Researchers also published indicators of compromise, including malicious domains, an IP address, and multiple MD5 hashes to aid detection and threat hunting.
Jul 31, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026