Loading story…
An ongoing intrusion campaign targeted government entities in Thailand with the Bookworm Trojan, using spear-phishing emails and decoy files tied to current Thai events to lure victims into execution. The lures included seemingly legitimate Adobe Flash Player installers and Flash slideshow executables, while telemetry showed that most systems communicating with Bookworm command-and-control infrastructure were located in Thailand, particularly around Bangkok, reinforcing the assessment that the operation was focused on Thai government networks.
Investigators found that hardcoded date strings in Bookworm samples were likely campaign codes rather than build dates, typically referencing events or attack timing by 6 to 18 days. The operators also used compromised legitimate web servers—including Thai government and military sites—to host Bookworm and related tools, indicating unauthorized access and the potential for broader strategic web compromise. Bookworm infrastructure also overlapped with infrastructure associated with FFRAT, PlugX, Poison Ivy, and Scieron, pointing to a wider malware toolkit supported by a large command-and-control ecosystem that relied heavily on dynamic DNS.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
The threat actors used compromised legitimate web servers, including Thai government and military sites, to host Bookworm and related tools. Unit 42 said this suggested unauthorized server access and possible preparation for future strategic web compromise activity.
Unit 42 reported an ongoing spear-phishing campaign delivering the Bookworm Trojan that had primarily targeted government entities in Thailand since at least mid-2015. The campaign used decoy files themed around current Thai events, including fake Adobe Flash Player installers and slideshow executables, to socially engineer victims.
On 2015-11-24, Unit 42 published its analysis of the ongoing Bookworm campaign targeting Thailand. The report also noted infrastructure overlap with FFRAT, PlugX, Poison Ivy, and Scieron, indicating a broader toolset and command-and-control ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 75 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used spear-phishing emails with `TinyURL` links and an actor-controlled redirection server to deliver the **9002 Trojan** from a Google Drive-hosted ZIP archive. The redirection chain embedded a target email address and destination URL in base64-encoded parameters, apparently to track victim clicks, and one lure targeted a legitimate Myanmar politician and human rights activist. The downloaded executable posed as a PowerPoint file, displayed a Myanmar-related conference decoy, and installed malware through **DLL sideloading** by abusing a legitimate RealNetworks executable. Researchers linked the campaign’s infrastructure and beaconing artifacts to broader activity associated with **Poison Ivy**, **PlugX**, **Zupdax**, **HenBox**, and the later-identified **Farseer** malware family. Farseer shared tradecraft including DLL sideloading with signed binaries, encrypted and compressed payloads, obfuscated configuration data, registry persistence, and command-and-control over domains such as `update.tcpdo[.]net`, `honor2020[.]ga`, and `up.outhmail[.]com`. The overlapping infrastructure and Myanmar- and Southeast Asia-themed lures indicate a sustained intrusion set focused on targets in Myanmar, Taiwan, and the wider region.
Aug 15, 2026
Researchers reported overlapping malware campaigns that use fake or trojanized PDF reader packages to compromise Windows systems through **DLL sideloading**. Cisco Talos identified **PXA Stealer** targeting government and education organizations, while Beazley Security and SentinelLabs said the Python-based infostealer has operated at scale since late 2024, affecting more than **4,000 victims in 62 countries**. The activity has been linked to Vietnamese-speaking threat actors who used phishing, signed software such as **Haihaisoft PDF Reader** and **Microsoft Word 2013**, and multi-stage loaders to evade detection and establish persistence through Windows `Run` registry keys. The malware chains ultimately steal browser credentials, cookies, autofill data, cryptocurrency wallet contents, and other sensitive application data, with exfiltration routed through **Telegram bots** and **Cloudflare Workers** and ties observed to the **Sherlock** stolen-data marketplace. In a related development, Kroll said **XWORM** operators adopted a similar fake PDF reader delivery chain using **Ghost Crypt**, packaging a renamed Haihaisoft executable, a malicious DLL, and a decoy PDF in a ZIP archive. That infection path uses a "process hypnosis" technique to inject payloads into `csc.exe`, persists via `rundll32.exe`, and ends with a plugin-based RAT capable of information theft and ransomware-related actions.
Aug 14, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026