Loading story…
Researchers at F6 reported a new wave of financially motivated attacks by Hive0117 targeting accountants at companies in Russia and other CIS countries, using phishing emails disguised as routine accounting documents. The messages carry password-protected RAR archives that infect victims with the fileless DarkWatchman malware and a keylogger, giving the attackers access to remote banking systems used by businesses. Victims have also been identified in Belarus, Kazakhstan, and Uzbekistan, and the group has reportedly been active since at least 2021.
F6 estimates Hive0117 has conducted about 400 successful intrusions since the start of the year, with average losses rising from 3 million to 10 million rubles. In the latest campaign, the group reportedly shifted from direct theft to fraudulent payroll register payments, making unauthorized transfers appear to be legitimate salary disbursements while routing the money to drop accounts. The operation highlights continued targeting of finance departments through credential theft, keylogging, and abuse of trusted business payment workflows.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
F6 researchers reported a new wave of Hive0117 attacks in which phishing emails with password-protected RAR archives infect accountants with fileless DarkWatchman malware and a keylogger. In this campaign, the group reportedly shifted from direct transfers to fraudulent payroll register payments that disguise theft as salary disbursements.
F6 researchers said Hive0117 has conducted about 400 successful attacks against Russian organizations since the start of the year, targeting company accountants to steal money through remote banking systems. Average losses reportedly rose from 3 million to 10 million rubles.
After targeting Eriell Group, a Tashkent-based oilfield services company with operations in Russia, the Nova ransomware group reportedly acknowledged the victim was CIS-linked. Nova said the responsible affiliate was cut off and banned, and publicly claimed encryption did not occur and data was not published.
Sekoia.io's Operation Phantom Net Voxel attributed to APT28 reportedly compromised 42 hosts belonging to Ukrainian military structures. The campaign used spearphishing via weaponized Office documents delivered through email and Signal Desktop, then deployed BEARDSHELL, COVENANT, and SLIMAGENT.
Attackers carried out a credential stuffing incident against a corporate VPN gateway using valid employee usernames and recently stolen passwords sourced from Lumma stealer logs. The case illustrated how infostealer infections on personal or unmanaged devices can lead to organizational compromise through valid accounts.
Recently stolen passwords from Lumma stealer logs appeared on Russian Market one day before they were used in a credential stuffing incident against a corporate VPN gateway. The exposure created the opportunity for attackers to reuse valid employee usernames and passwords.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecysecurity.news
Open sourcecodeby.net
Open sourcecodeby.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign known as Operation MoneyMount-ISO has been identified targeting finance, accounting, treasury, and payment departments in Russia. Attackers use Russian-language emails impersonating financial institutions, such as TorFX Currency Broker, to deliver ZIP attachments containing malicious ISO files. When executed, these ISO files mount as virtual drives and deploy executables that load the Phantom information-stealing malware, which is capable of credential theft, invoice and payment fraud, and unauthorized fund transfers. The campaign also targets secondary sectors including procurement, legal, HR/payroll, executive assistants, and Russian-speaking SMEs, posing significant risks of lateral movement within IT systems. Technical analysis reveals that the infection chain involves a multi-stage payload delivery, with the initial executable loading a DLL (`CreativeAI.dll`) that decrypts and injects the final Phantom Stealer payload into memory. The campaign demonstrates advanced social engineering and technical sophistication, leveraging fake payment confirmation lures and ISO mounting to bypass traditional security controls. Security researchers emphasize the need for heightened vigilance among Russian financial organizations and recommend monitoring for related IOCs and MITRE ATT&CK techniques associated with this threat.
Jun 29, 2026
Attackers in the **Payroll Pirate** campaign are targeting HR, payroll, finance, and administrative staff by using adversary-in-the-middle phishing pages to steal active Microsoft 365 session tokens and take over accounts without needing passwords or defeating MFA directly. Researchers linked the activity to Microsoft-tracked clusters **Storm-2755** and **Storm-2657**, which have targeted organizations across sectors including healthcare, manufacturing, and food services to alter direct-deposit details and reroute employee pay to attacker-controlled bank accounts. After gaining access, the actors use **Microsoft Graph** API queries to enumerate directory users and identify payroll-related roles, leaving little or no endpoint evidence and shifting detection to Microsoft Entra sign-in telemetry and Graph activity logs. Investigators observed authentication traffic from U.S. mobile carrier IP ranges and follow-on directory reconnaissance from Canadian residential ISP addresses, suggesting proxy-backed operations; defenders were urged to enable Graph logging, revoke compromised sessions and tokens, tighten Conditional Access, deploy phishing-resistant MFA such as FIDO2 or Windows Hello for Business, audit OAuth consent and enterprise applications for persistence, and review payroll changes made during the compromise window.
Jun 29, 2026
Cybercriminals identified as 'payroll pirates' have launched a targeted phishing campaign against US universities, aiming to divert salary payments from employees to accounts under their control. Microsoft Threat Intelligence reported that since March 2025, at least 11 accounts across three universities were successfully compromised, with phishing emails sent to nearly 6,000 recipients at 25 different universities. The attackers primarily targeted third-party platforms such as Workday, which are commonly used for HR and payroll management in higher education institutions. The phishing emails often contained malicious links and were crafted to steal multifactor authentication (MFA) codes, enabling the attackers to bypass security measures and hijack employee accounts. Once inside a compromised account, the threat actors established inbox rules to automatically delete warning emails from Workday, thereby concealing unauthorized changes to bank account information. This allowed the attackers to redirect salary payments without immediate detection by the victims. The phishing lures were varied, with some emails referencing COVID-19 exposure or faculty misconduct, and often included links to Google Docs to increase credibility. In one instance, a phishing email about illness exposure was sent to 500 individuals at a single organization. Microsoft attributed the campaign to a group it tracks as Storm-2657 and has proactively contacted affected customers with mitigation advice. The campaign demonstrates a sophisticated understanding of university HR processes and leverages social engineering themes relevant to academic environments. The attackers' use of MFA code theft highlights the evolving tactics used to bypass common security controls. Microsoft emphasized that while Workday was a primary target, other HR and payment systems could also be at risk. The scale of the campaign, with thousands of potential victims, underscores the need for heightened vigilance and improved security awareness among university staff. The incident has raised concerns about the security of third-party platforms used for payroll and HR functions in the education sector. Workday, the platform most frequently targeted, did not respond to requests for comment regarding the incident. Microsoft’s response included sharing technical indicators and recommended best practices to help organizations defend against similar attacks. The campaign is ongoing, and universities are urged to review their security protocols, especially around MFA and email filtering. The incident highlights the persistent threat of phishing and the importance of layered security defenses in protecting sensitive financial information.
Jun 29, 2026