Loading story…
Sophos X-Ops reported that the Mad Liberator ransomware actor used social engineering and the legitimate remote-access tool AnyDesk to gain access to a victim environment, then deployed a fake "Microsoft Windows Update" program to hide data theft activity. The victim accepted an unsolicited AnyDesk connection request believing it was routine IT support, after which the attacker transferred and executed the fake updater, displayed an animated update screen, and disabled keyboard and mouse input through AnyDesk while exfiltrating files from OneDrive and mapped network shares.
During the roughly four-hour intrusion, the attacker also used Advanced IP Scanner for subnet reconnaissance and dropped ransom notes on a shared network location, although Sophos said the group in this case did not establish persistence for the fake update binary. Sophos identified the malware as Troj/FakeUpd-K and said Mad Liberator has primarily emphasized data exfiltration and pressure tactics, with some reports also linking it to encryption and double-extortion activity; the company urged organizations to tighten remote-support procedures, improve user awareness, and restrict AnyDesk connections with access control lists while reviewing AnyDesk logs for suspicious sessions and file transfers.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos X-Ops reported on a mid-2024 incident involving the Mad Liberator ransomware threat actor. In the observed attack, the actor used an unsolicited AnyDesk session, ran a fake "Microsoft Windows Update" binary to mask activity, conducted reconnaissance, exfiltrated files, and left ransom notes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Rapid7 reported multiple intrusions tied to an ongoing social-engineering campaign that starts with email bombing and follow-up calls, often over Microsoft Teams, to pressure users into installing **AnyDesk**. In the observed June 2024 cases, the operators moved away from earlier Quick Assist and batch-script tradecraft and instead used a signed .NET credential harvester, `AntiSpam.exe`, followed by payloads masquerading as software updates. Those payloads included **SystemBC**, Golang HTTP beacons, SOCKS proxy implants, a PowerShell proxy script, reverse SSH tunnels, and **Level RMM** for persistence and lateral movement, with several binaries signed by the same certificate to appear legitimate. Rapid7 said one payload, `update6.exe`, attempted to exploit **`CVE-2022-26923`** to add a machine account for privilege escalation on vulnerable domain controllers, then moved to **Kerberoasting** by requesting Kerberos service tickets tied to service principal names and cracking them offline to recover service-account credentials. That technique can provide valid account access and support further privilege escalation, persistence, and lateral movement inside Windows domains. Rapid7 published indicators of compromise and urged defenders to use application allowlisting, block unapproved remote monitoring and management tools and related domains, train users to resist help-desk impersonation, and patch systems exposed to `CVE-2022-26923`.
Aug 15, 2026
A threat actor targeted security researchers after Black Hat and DEF CON by impersonating a senior CoinDesk-linked cryptocurrency media executive on X and sending conference-planning lures through trusted services including Google Docs, GitHub Releases, and Dropbox DocSend. Huntress reported that the first lure used a booby-trapped Google Doc with a malicious Google Apps Script sidebar that asked victims for an "encryption key," profiled the host, and then steered users into staged malware delivery paths tailored to macOS and Windows systems. On macOS, victims were served a disk image resembling **Atomic macOS Stealer (AMOS)**, while Windows targets received a fake Google API Connector update that led to a ClickOnce application, PowerShell-based loaders, and additional payloads. Huntress said the Windows chain ultimately deployed **NetSupport RAT**, a fake Ledger wallet application, and a local TLS-intercepting proxy built around a rogue certificate authority, indicating goals that included credential theft, cryptocurrency wallet compromise, and persistent remote access; when the first attempt failed, the actor followed up with a second malicious document disguised as a DocSend share to continue the intrusion attempt.
Aug 24, 2026