Loading story…
Researchers linked intrusions at telecom organizations in South Asia and an ISP in West Asia to CloudComputating—also tracked as BackdoorDiplomacy and Faking Dragon—after uncovering a new modular malware framework called QSC. The framework was delivered through Quarian v3 (also known as Turian) and consists of Loader, Core, Network, Command Shell, and File Manager components designed to keep most functionality in memory. In a later campaign, the attackers also deployed a new Golang backdoor, GoClient, to execute commands, manage files, capture screenshots, and conduct post-compromise reconnaissance.
The operators used QSC and GoClient to enumerate compromised environments, identify domain controllers and file servers, steal NTDS.dit using shadow copies, and move laterally with WMIC and stolen domain administrator credentials. Researchers said the activity showed a tactical shift toward a plugin-based framework with internal pivoting and port-forwarding to route command-and-control traffic through compromised hosts. The attribution to CloudComputating was made with medium confidence based on Quarian infrastructure, malware overlaps, shared tooling, and consistent operational patterns.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Based on Quarian infrastructure, malware similarities, shared tooling, and operational patterns, researchers assessed with medium confidence that the activity was conducted by the CloudComputating group, also known as BackdoorDiplomacy or Faking Dragon. The report described this as an evolution toward a plugin-based framework that keeps most functionality in memory.
In the 2023 campaign against an ISP in West Asia, the attackers introduced a new Golang backdoor called GoClient. It supported command execution, file operations, screenshots, and post-compromise reconnaissance.
Researchers investigating intrusions at telecom organizations in South Asia uncovered QSC, a modular in-memory malware framework deployed via the Quarian v3 backdoor. The framework consisted of Loader, Core, Network, Command Shell, and File Manager modules.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Researchers disclosed **Showboat**, a previously unreported modular Linux malware framework used since at least mid-2022 to compromise telecommunications organizations in the Middle East, Asia Pacific, and other regions. Black Lotus Labs said the malware operates as a post-exploitation backdoor that enables remote shell access, file transfer, host reconnaissance, persistence, process hiding, port mapping, and **SOCKS5 proxying**, allowing attackers to maintain access and pivot into internal systems not exposed to the internet. Investigators said the malware stayed largely undetected for months after a 2025 sample submission, highlighting the stealth of Linux-focused intrusions against telecom infrastructure. Infrastructure and victimology linked the activity with moderate confidence to one or more **China-aligned threat clusters**, with command-and-control nodes and related IP activity tied to **Chengdu, Sichuan**, and domains impersonating telecom brands in Southeast Asia. Reporting also connected the broader campaign to the deployment of a Windows implant, **JFMBackdoor**, through DLL sideloading, suggesting a cross-platform espionage operation against telecom providers. Confirmed or suspected victims included a telecom provider in the Middle East, an ISP in Afghanistan, entities in Azerbaijan, and networks in the United States, Ukraine, and the Donbas region, reinforcing concerns that shared malware tooling is being used across multiple PRC-linked operations.
Jun 29, 2026
CloudSEK disclosed a coordinated intrusion campaign dubbed **Operation Escaneo** that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing **Fortinet FortiOS SSL-VPN**, **Ivanti Connect Secure**, and **Apache Tomcat** systems, while also maintaining capabilities for `EternalBlue`, `Zerologon`, `GhostCat`, `Log4Shell`, and `PwnKit`. CloudSEK attributed the activity with medium confidence to **MexicanMafia**, also tracked as **PanchoVilla**, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations. The attackers used a custom reconnaissance framework called **Kimera**, **Neo-reGeorg** web shells, **Chisel** reverse tunnels, and persistence on compromised Cisco routers through **GRE tunnels** to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as **RDP**, **PsExec**, and **Impacket** for lateral movement and privilege escalation. Reported theft included a **407 MB BloodHound** Active Directory dataset, more than **1.3 million personal records**, and **SSL private keys**, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Jun 29, 2026