Loading story…
Researchers attributed an ongoing cyber-espionage campaign to DeathStalker with high confidence, saying the group has targeted foreign exchange and cryptocurrency trading companies since at least Q2 2020 using its VileRAT toolchain. The intrusion chain evolved over time from spear-phishing emails carrying malicious Google Drive-hosted shortcut files to email- and chatbot-delivered DOCX documents that retrieved macro-enabled DOTM remote templates, ultimately deploying VileDropper, VileLoader, and the Python-based VileRAT remote access trojan.
The operators repeatedly refined the malware to evade detection and frustrate analysis, using techniques including VBA stomping, XOR-encoded data hidden in Office objects, JavaScript anti-analysis checks, multi-stage in-memory loading, and Python bytecode obfuscation intended to break decompilers. Investigators also linked the activity to a large infrastructure footprint involving hundreds of domains and IP addresses, many associated with AS42159 (DELTAHOST UA) in the Netherlands from late 2021 onward, and said a rise in related samples and infrastructure from March 2022 pointed to intensified compromise attempts against less mature organizations.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On 2025-12-09, Securelist published research describing the ongoing VileRAT espionage campaign, its evolving infection chain, and its attribution to DeathStalker with high confidence.
The report says researchers saw increased VileRAT-related samples and infrastructure from March 2022, indicating intensified compromise attempts by the operators.
From late 2021 onward, the campaign used extensive infrastructure including hundreds of domains and IP addresses largely tied to AS42159 (DELTAHOST UA), according to the report.
Securelist reports that the VileRAT-centered cyber-espionage campaign attributed with high confidence to DeathStalker has targeted foreign exchange and cryptocurrency trading companies since at least Q2 2020.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 443 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the **DeathStalker** threat actor used a new **Janicab** malware variant to target legal entities, financial institutions, and possibly travel agencies across the Middle East and Europe, with activity observed through 2020 and likely continuing into 2021. Victims were concentrated in **Egypt, Georgia, Saudi Arabia, the United Arab Emirates, and the United Kingdom**, and the report noted Saudi legal entities among the targets for the first time. The campaign relied on spear-phishing emails carrying ZIP archives with malicious **`.LNK`** droppers that launched chained **VBE/VBS** stages, unpacked a CAB archive containing Python-based tools, and established persistence on infected systems. The malware resolved command-and-control infrastructure through dead-drop resolvers hosted on public services including **YouTube**, and researchers linked the operation to other DeathStalker toolsets such as **PowerSing**, **EVILNUM**, and **PowerPepper** through shared tactics, infrastructure, anti-analysis logic, and tools including a **Stormwind** keylogger and an **ICMP** shell; the implant supported command execution, screenshots, keylogging, proxying, FTP access, and reverse SSH tunneling.
Aug 14, 2026
Researchers at eSentire disclosed a previously undocumented remote access trojan, **STX RAT**, after it was used in an attempted intrusion against a financial services organization. The malware was delivered through a sophisticated multi-stage chain involving script launchers, encrypted and compressed payloads, privilege escalation, and in-memory PowerShell execution designed to avoid detection. Investigators said the RAT used **XXTEA** encryption, **Zlib** compression, reflective loading, layered string obfuscation, anti-virtualization checks, registry-based autoruns, and **COM hijacking** to establish persistence and frustrate analysis. Once deployed, STX RAT waited for command-and-control instructions and was built to steal data from browsers, FTP clients, and cryptocurrency wallets while minimizing early detection through delayed credential theft and an encrypted C2 protocol. The malware also supported hidden virtual desktop operations, execution of additional payloads, network tunneling, and simulated user input, giving operators broad post-compromise control. eSentire said the targeted environment was contained and urged organizations, particularly in financial services, to strengthen endpoint protections and reduce exposure to script-based initial access methods.
Jun 29, 2026
Kaspersky identified **DeathStalker**, a long-running hacker-for-hire group that targeted **European law firms** and **fintech companies**, with additional victims in the Middle East including **Israel, Jordan, and Egypt**. Researchers said the group appeared focused on stealing **business and financial intelligence** rather than conducting traditional state espionage, marking it as part of a broader **mercenary APT** market in which private operators sell intrusion capabilities to paying clients. The intrusions typically began with **spear-phishing emails** carrying weaponized `.LNK` shortcut files that launched **PowerShell-based backdoors**. Reporting on mercenary threat actors placed DeathStalker alongside groups such as **Bahamut, DarkBasin, Candiru, and NSO Group**, underscoring how commercial surveillance and hacking services are increasingly used against not only activists and dissidents but also enterprises. Researchers noted that, despite the sophistication associated with mercenary operators, campaigns like DeathStalker’s often still rely on familiar weaknesses such as phishing susceptibility and poor patching.
Aug 15, 2026