Loading story…
Palo Alto Networks' Unit 42 analyzed Seaduke, a Windows backdoor detected by some antivirus products as Trojan.Win32.Seadask, and linked it to the broader Duke malware family previously documented by Symantec. The sample was a UPX-packed Windows PE file built from Python with PyInstaller and shielded by several obfuscation layers, including Base64- and ZLIB-encoded payloads. Researchers decompiled the embedded Python, recovered a JSON configuration, and identified a sophisticated implant designed for stealthy remote access.
The malware can maintain persistence through PowerShell, the Windows Run registry key, or a Startup .lnk file, and it supports command execution, file transfer, process migration, and self-removal. Unit 42 found that Seaduke used an HTTP-based command-and-control channel with RC4-encrypted traffic, deriving session keys from random strings and SHA1, while hiding encrypted data in HTTP cookies and HTML-like server responses. The recovered configuration referenced http://monitor.syn[.]cn/rss.php, used a Facebook referer, and specified a SiteBar user agent, underscoring the malware's effort to blend malicious traffic into normal web activity.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 analyzed a Seaduke malware sample, extracted and decompiled its Python-based payload, and documented its obfuscation, persistence mechanisms, command set, and encrypted HTTP command-and-control protocol. The recovered configuration referenced monitor.syn[.]cn/rss.php and showed use of a Facebook referer and SiteBar user agent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research detailed an **APT32 (Ocean Lotus)** backdoor sample that used control-flow obfuscation to frustrate reverse engineering while delivering a multi-stage infection chain. The attack began with a malicious document disguised as a **Qihoo 360** file, used **VBA macros** to inject shellcode into `rundll32.exe`, then decrypted and reflectively loaded a DLL before launching an auxiliary `HTTPProv.dll` module for command-and-control communications. The analysis showed the malware inserted junk basic blocks into functions, often by placing opposite conditional jumps that led to the same target, making flow graphs appear far more complex than they were. To counter that technique, the researcher released a Python-based **Graph Deobfuscator** plugin for **Cutter** and **radare2** using `r2pipe`, which patches those conditional branches into unconditional jumps in memory and reanalyzes the function graph without altering the original binary on disk by relying on radare2 cache mode.
Aug 14, 2026
Researchers detailed a digitally signed .NET malware sample, `PDFriend.exe`, that posed as a PDF utility while acting as a modular fileless dropper. The binary used Costura.Fody to embed dependencies, fetched raw C# source code from `api.mikonfig.com`, compiled it in memory through .NET Roslyn APIs, and executed the resulting modules without writing a new executable to disk. Those modules performed host fingerprinting, killed browser processes, tampered with Chrome and Edge SQLite databases to hijack search settings, deployed a secondary payload from `installmyapps.com`, created persistence with a scheduled task named `PDfriendTask`, and supported data exfiltration to remote infrastructure. The sample was also signed with a GlobalSign EV code-signing certificate issued to **THE-SHOP STOP LLC**, with timestamping preserving trust after certificate expiration. Separate reporting on Wicked Panda (**APT41**) described a comparable intrusion pattern built around stealthy in-memory execution and evasion. In the simulated chain, attackers used DLL sideloading with a legitimate executable such as `taskhost.exe` to launch the DodgeBox loader, decrypt a second-stage payload from an encrypted DAT file, and reflectively load the MoonWalk backdoor in memory. DodgeBox employed sandbox checks, dynamic API resolution, obfuscated hashing, and `NtAllocateVirtualMemory`, while MoonWalk enabled remote command execution and persistence through a Windows Run registry key. The activity also showed how command-and-control and data exfiltration could be concealed inside legitimate-looking Google Drive API traffic, underscoring continued attacker reliance on trusted binaries, signed code, and fileless payload delivery to evade detection.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026