Loading story…
Research presented at LABScon described a methodology for clustering malware tied to the Lamberts threat actor, also referred to as Bright Constellation, using YARA, auxiliary scripting, and open-source reverse-engineering tools. Starting with about 50 VirusTotal samples and limited prior public reporting from Kaspersky, Symantec, and FireEye, the researcher moved beyond simple overlaps such as import hashes, PDB paths, DLL names, and section or resource hashes to more durable code-similarity techniques based on executable sections, entry points, export functions, and called functions.
The workflow combined YARA console output with tools including FLOSS, Vivisect, and Rizin, and introduced an open-source utility, Floss2YAR, to generate code-focused YARA rules from likely decoding functions. Using that process, the research linked 14 of 21 known Lambert malware families, including Rationalist, Marianas Trench, Invisible Enemy, Bloodletter, Existence, and Escape Artist, and found the tooling commonly ran as Windows services while emphasizing stealth against experienced administrators and Windows logging or telemetry rather than user-lure tactics or obvious antivirus evasion.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
At LABScon, Greg Lesnewich of Proofpoint presented personal research on using YARA, auxiliary scripting, and open-source tools to analyze and cluster malware associated with the Lamberts, also referred to as Bright Constellation. He said the workflow linked 14 of 21 Lambert malware families and included an open-sourced tool called Floss2YAR.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Researchers tied the **VHD ransomware** and related families including **BEAF, PXJ, ZZZZ, CHiCHi, and Tflower** to DPRK-affiliated operators, with Trellix and Kaspersky linking the activity to **Lazarus/APT38/Unit 180**. The reporting says the campaigns were narrowly targeted, especially in the APAC region, and appeared aimed at revenue generation rather than mass extortion. Investigators cited shared code, overlapping artifacts, near-identical visual patterns, a reused ProtonMail address, and the use of the **MATA** framework as evidence that these ransomware strains were not typical criminal affiliate tools but part of a state-linked operation. Kaspersky described two 2020 intrusions in which attackers exploited a vulnerable VPN gateway, escalated privileges, deployed **MATA**, seized **Active Directory**, and pushed VHD across victim networks within hours; another case used a custom SMB brute-force spreading tool with propagation over mounted shares and **WMI**. Separate research from Netlab 360 and VMware detailed **Dacls**, also known as **MATA**, as a cross-platform Lazarus-linked RAT for Windows and Linux that uses TLS and RC4-protected command-and-control, modular plugins, and infrastructure that remained active across more than 100 identified C2 servers. Earlier ESET analysis placed the activity within Lazarus’s broader pattern of combining espionage, sabotage, and financially motivated operations through multiple code-sharing development cells.
Aug 15, 2026
Multiple reports detail **distinct, unrelated malware families and delivery chains** rather than a single shared incident. One analysis covers **NotOpenClaw**, a Windows malware loader distributed via **fake “OpenClaw” installers** (including GitHub-hosted lures) and emphasizing **VM/sandbox evasion**; the sample analyzed was tagged with stealer-related indicators (e.g., VidarStealer) and was previously referenced in third-party reporting about fake OpenClaw installers deploying additional malware. Separate research describes two different fileless/backdoor operations: **HellsUchecker**, a small native x64 backdoor delivered through a **10-stage chain** beginning with a **ClickFix** fake Cloudflare CAPTCHA that tricks users into pasting an obfuscated Run command, using a LOLBin to fetch payloads over **finger (TCP/79)** and retrieving encrypted C2 configuration from a **BNB Smart Chain** smart contract ("EtherHiding"), culminating in an **in-memory** final payload using **Hell’s Gate** direct syscalls; and **GhostWeaver**, a **fileless PowerShell RAT** that selects persistence based on the installed AV product, uses **TLS over TCP/25658**, and relies on multiple **DGA** routines for delivery and C2. A separate brief reports the **VOID#GEIST** campaign delivering **XWorm**, **AsyncRAT**, and **Xeno RAT** via phishing, batch scripts from **TryCloudflare** domains, staged ZIP payloads, Python-based decryption/execution, and abuse of `AppInstallerPythonRedirector.exe` to facilitate additional RAT deployment.
Jun 29, 2026