Loading story…
Attackers compromised the Vietnam Government Certification Authority (VGCA) website, ca.gov.vn, and replaced two legitimate Government Certification Authority digital-signature toolkit installers with trojanized MSI packages that deployed the PhantomNet backdoor. The malicious installers were hosted on the official HTTPS site from at least July 23 to August 16, 2020, requiring victims to manually download and run them. The packages reportedly dropped a legitimate application alongside a malicious component to reduce suspicion, turning a trusted software source into a delivery channel for malware.
Once executed, PhantomNet established persistence as either a Windows service or a scheduled task depending on user privileges, then communicated over HTTPS with hardcoded command-and-control domains using certificate pinning. ESET said the malware supported plugins, including one observed component that appeared capable of credential theft and lateral movement through embedded Invoke-Mimikatz functionality. ESET notified VGCA and Vietnam’s national computer emergency response team in December 2020, while VGCA said it was already aware of the compromise and had informed affected users.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
On December 17, 2020, ESET disclosed Operation SignSight, describing a 2020 supply-chain attack against the Vietnam Government Certification Authority website involving trojanized digital-signature toolkit installers and the PhantomNet backdoor.
In December 2020, ESET notified the Vietnam Government Certification Authority and VNCERT about the supply-chain compromise. VGCA said it was already aware of the incident and had notified affected users.
The compromise of the VGCA website appears to have lasted until August 16, 2020, ending the period during which victims could manually download the malicious installers from the official HTTPS site.
From at least July 23, 2020, attackers replaced two legitimate installers on the Vietnam Government Certification Authority website, ca.gov.vn, with trojanized MSI packages carrying the PhantomNet backdoor as part of a supply-chain attack.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a malware campaign distributing a trojanized **RVTools** installer signed with a legitimately issued **Sectigo** code-signing certificate linked to Xiamen Lunwei Huage Network Co., Ltd., allowing the malicious MSI to appear trusted and reduce SmartScreen-style warnings. The installer abused MSI Custom Actions to run an obfuscated VBScript loader, which launched hidden PowerShell and downloaded a roughly 33 MB archive, `winp.zip`, from Dropbox into `AppData`, where staged components unpacked a modular Python remote access trojan. After reboot, the malware executed `collector.py` and `Pmanager.py` to gather host and Active Directory data, save it to `configA.json`, and exfiltrate the information after **RC4** encryption and **zlib** compression via HTTP POST to one of five hardcoded command-and-control servers every 300 seconds. The RAT also enabled command execution and payload delivery, while persistence was established through a Registry Run key and a scheduled task running as **SYSTEM**; researchers warned the campaign is especially dangerous because RVTools is widely used by VMware administrators with elevated privileges, and noted that certificate revocation may not stop execution in environments that do not enforce real-time **OCSP** or **CRL** checks.
Jun 29, 2026
Official Windows installers for **DAEMON Tools** were compromised in a supply chain attack, with malicious versions distributed from the vendor’s legitimate website beginning on April 8. Kaspersky said the trojanized installers affected **DAEMON Tools Lite** versions `12.5.0.2421` through `12.5.0.2434`, were signed with valid AVB Disc Soft certificates, and implanted a staged backdoor that contacted the typosquatted command-and-control domain `env-check.daemontools[.]cc`. TechCrunch reported that an independently downloaded installer also appeared to contain the backdoor when scanned, while Disc Soft said it was investigating and taking remediation steps. Researchers observed thousands of infection attempts across more than 100 countries, but the attackers appear to have selectively escalated only a small number of victims in **Russia, Belarus, and Thailand**. Follow-on activity targeted organizations in the **government, scientific, manufacturing, and retail** sectors and included additional payloads such as an information stealer, an in-memory backdoor using **RC4**, and a more advanced **QUIC RAT**. Kaspersky said Chinese-language artifacts in the malware suggest a Chinese-speaking threat actor may be involved, though attribution remains unconfirmed, and urged defenders to hunt for related hashes, suspicious DAEMON Tools process activity, and communications with `env-check.daemontools[.]cc` and `38.180.107[.]76`.
Jul 30, 2026
A targeted spear-phishing operation used convincing decoy documents to compromise entities in Taiwan and the Vietnamese government, delivering the **Agent.NJK** backdoor and **Terminator RAT**. The attackers relied on social engineering rather than software exploits, disguising malware with Word document icons and hidden executable extensions so victims would launch the payloads themselves. Researchers found that Agent.NJK functioned as a simple HTTP backdoor and trojan proxy with hard-coded command-and-control infrastructure and signs of live operator activity, including reconnaissance commands and an apparent typo consistent with manual control. Terminator RAT was described as more feature-rich but poorly engineered, using an **XTEA**-encrypted configuration, a custom `XOR`/`ROR` network protocol, persistence through Startup Folder manipulation and delayed file moves, and a separate proxy tunnel component to move data through corporate proxies. The activity was linked to earlier reporting through reused tooling, dynamic DNS infrastructure, and command-and-control servers in the same Taiwan-based `/24` network, indicating an ongoing intrusion set marked by targeted victim selection but weak malware development, bad cryptography, and operational mistakes.
Aug 14, 2026