Loading story…
ESET researchers reported that the Iran-aligned threat group Ballistic Bobcat used a custom backdoor called Sponsor in operations that combined internet-wide scanning with rapid post-compromise deployment. The malware was delivered through batch scripts, giving the group a lightweight way to establish persistence and remote access on compromised systems while moving quickly from target discovery to intrusion.
The activity highlights an intrusion pattern in which attackers pair broad reconnaissance with simple but effective tooling to convert exposed services into footholds. By using scripted deployment and a bespoke backdoor, Ballistic Bobcat was able to streamline access operations and maintain control over victim environments, underscoring the ongoing risk from state-linked actors that rely on low-complexity initial execution methods backed by tailored malware.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ESET released a report detailing Ballistic Bobcat activity involving the Sponsor backdoor, including the group's scan-and-strike tradecraft and use of batch-file techniques. The publication marks the public disclosure of the campaign's technical details.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco and Palo Alto researchers detailed multiple intrusion campaigns that relied on evasive malware to establish persistence and hide command-and-control traffic, including **ObliqueRAT**, **GoldMax**, **NimzaLoader**, and the **SUNBURST** backdoor tied to the SolarWinds Orion supply-chain compromise. In the SolarWinds intrusion, attackers distributed a trojanized, digitally signed Orion update that deployed **SUNBURST**, which masked its communications as legitimate Orion Improvement Program traffic and was later used to deliver follow-on payloads such as **TEARDROP** and customized **Cobalt Strike BEACON** implants. Cisco Talos also reported that **Transparent Tribe** revived **ObliqueRAT** in campaigns aimed largely at organizations in South Asia, using malicious Office documents to retrieve payloads concealed in BMP image files hosted on hijacked websites. Researchers said newer ObliqueRAT variants added anti-analysis features, screenshot and webcam capture, removable-drive file theft, and updated persistence methods, while Cisco’s broader threat review noted that **GoldMax** used encrypted per-implant configuration and decoy traffic, and **NimzaLoader** used phishing emails, fake PDF-preview links, JSON-based communications, and process injection to deliver second-stage access.
Aug 15, 2026
Threat researchers reported two active intrusion patterns aimed at stealing credentials and maintaining access: a malvertising campaign that impersonated software brands such as **Notion** in Google search ads to deliver **Rhadamanthys** on Windows and **Atomic Stealer** on macOS, and a separate cyber-espionage operation by **Mantis** (also tracked as **Arid Viper**, **Desert Falcon**, and `APT-C-23`) targeting organizations in the Palestinian territories. In the malvertising chain, victims were redirected through intermediary domains, screened with browser-based anti-VM checks, and sent to fake download pages; the Windows installer fetched its payload from a URL hosted on TextBin, while researchers linked the advertiser account to “BUDNIK PAWEŁ” in Poland and noted thousands of views of the staging URL.
Jun 29, 2026
Earth Baku, a cluster linked to **APT41**, has expanded a long-running cyberespionage campaign against government and enterprise targets from the Indo-Pacific into **Europe** and the **Middle East and Africa**, using a steadily evolving malware arsenal and multiple intrusion paths. Trend Micro reported the group has compromised organizations in sectors including airlines, automotive, infrastructure, media, publishing, IT, and hardware, with activity tied to **SQL injection** on public-facing applications, exploitation of **Microsoft Exchange ProxyLogon** `CVE-2021-26855`, IIS server abuse, and web shells including **China Chopper** and **Godzilla**. Earlier reporting also described possible email-delivered LNK downloader chains and continued operational activity after public law-enforcement scrutiny. The operators have introduced **StealthReacher**, an upgraded loader derived from **StealthVector**, to deploy **SneakCross**, a modular backdoor assessed as the successor to **ScrambleCross** and earlier **Crosswalk**-related tooling. Across reporting, the group was observed using **Cobalt Strike Beacon**, **ShadowPad**, **Natwalk**, **RBRAT**, **Errorroot**, **HIGHNOON**, and other loaders and backdoors, while relying on stealth techniques such as ETW disabling, process and DLL hollowing, module stomping, CFG bypass, early-bird injection, and certificate bypass. Researchers also said Earth Baku hid command-and-control through CDN services, **Cloudflare Workers**, and **Google services**, and supported persistence, tunneling, and exfiltration with customized **iox**, **Rakshasa**, **Tailscale**, and **MEGAcmd**.
Aug 15, 2026