Loading story…
Kaspersky researchers reported that the BE2 espionage platform was deployed with unusual, modular plugins in an attempted intrusion involving Siemens-related targets, but the operation was undermined by multiple development and operational mistakes. The malware framework included specialized components beyond standard backdoor functionality, indicating a tailored campaign aimed at industrial or enterprise environments linked to Siemens.
The investigation found that the attackers’ tooling exposed weaknesses in execution, with coding and deployment errors reducing the effectiveness of the intrusion and helping defenders reconstruct the operation. The case highlighted how advanced threat actors continue to build extensible malware for high-value targets, while also showing that poor development practices and operational failures can disrupt even sophisticated campaigns.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report on the BE2 malware framework's extraordinary plugins, including details related to Siemens targeting and development failures. No additional dated incident milestones are provided in the reference content.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
eSentire reported a resurging malware operation dubbed **Resident** targeting manufacturing, commercial, and healthcare organizations. The campaign, active since late 2022 and likely run by native Russian-speaking operators, used phishing emails and drive-by downloads from compromised WordPress sites to deliver JavaScript payloads that installed MSI packages, VBS scripts, screenshot utilities, and a **Node.js-based backdoor**. Across multiple incidents, the attackers also deployed custom Resident backdoors, **Cobalt Strike** loaders and beacons, reconnaissance tools, and persistence mechanisms to maintain access. The intrusion chain relied on repeated MSI retrieval, host profiling, screenshot capture, command execution, and scheduled-task or startup persistence to support follow-on activity after initial compromise. In one case, the operators attempted to deploy the **Rhadamanthys** stealer, indicating an interest in credential and data theft alongside broader post-compromise operations. The tooling and workflow described point to a flexible access-and-surveillance campaign designed to establish footholds, collect system intelligence, and enable additional malicious actions on victim networks.
Aug 15, 2026
Multiple reports describe **social-engineering-led initial access** that pivots into malware execution and credential/financial theft. A documented “pig butchering” approach abuses the higher-trust dynamics of matrimonial platforms to build rapport and then steer victims toward cryptocurrency-related actions. Separately, an “inbound” recruitment lure targets **Web3/crypto professionals** by impersonating legitimate companies and driving candidates to install fake interview software (e.g., `collaborex_setup.msi`) that initiates command-and-control to infrastructure such as `179.43.159.106`, with the added risk that victims often use corporate endpoints that also have personal wallets installed. In parallel, technical reporting highlights enterprise-focused malware delivery via trojanized software and email. **ValleyRAT_S2** (a C++ second-stage backdoor/RAT) is being distributed via fake Chinese-language productivity tools, cracked software, and trojanized installers, including **DLL side-loading** (e.g., a malicious `steam_api64.dll`) and C2 over custom TCP (e.g., `27.124.3.175:14852`), enabling long-term control and theft of financial data. Kaspersky also reported a malicious-email wave against Russian private-sector organizations using a PDF-icon masquerade that drops a .NET downloader, installs a persistent service, and stages payloads under `C:\ProgramData\Microsoft Diagnostic\Tasks` before delivering an **infostealer**. A separate blog post discusses phishing enabled by **misconfigured Microsoft 365/hybrid Exchange mail routing and weak SPF/DKIM/DMARC enforcement**, allowing spoofed “internal” emails that can facilitate credential theft and BEC; while related in theme (phishing), it is not clearly tied to the same malware campaigns described elsewhere.
Jun 29, 2026
Threat actors used **SEO poisoning** to steer victims searching for IT management software to lookalike sites hosting a trojanized **ManageEngine OpManager** installer, which delivered **Bumblebee** malware and opened the door to a broader intrusion that culminated in **Akira** ransomware. Investigators said the attackers used DLL side-loading to launch Bumblebee, then deployed an **AdaptixC2** beacon by injecting it into a renamed Windows Address Book binary, linking the activity to a wider campaign also observed by Swisscom involving trojanized IT tool installers such as OpManager and IP scanner software. After gaining access, the attackers quickly escalated privileges, created domain accounts, moved laterally with RDP and SSH-based tunneling, and stole credentials from **Active Directory**, **LSASS**, and **Veeam**, including dumping `NTDS.dit`. They established persistence with **RustDesk** and a reverse SSH tunnel, exfiltrated about **77 GB** of data with **FileZilla** over SFTP and additional **SYSVOL** data over SSH, then deployed Akira across the root domain roughly **44 hours** after compromise before returning to encrypt a child domain; in a related Swisscom case, ransomware was reached in as little as **nine hours**.
Jun 30, 2026