Loading story…
Rapid7 reported a renewed Dropping Elephant malware campaign using a China-themed lure to deliver a heavily reworked, memory-resident remote access trojan on Windows systems. Victims are enticed with a decoy document tied to a GRES-3 seawater pump contract, while a malicious shortcut file, GRES3001.lnk, launches a PowerShell-based staging chain that downloads components from chinagreenenergy[.]org. The malware then abuses the legitimate Microsoft binary Fondue.exe to side-load a malicious APPWIZ.cpl file from C:\Users\Public\, decrypts an AES-256-CBC protected payload from editor.dat, and uses Donut shellcode to map the final 32-bit RAT directly into memory.
The RAT patches AMSI, WLDP, and ETW in-process to reduce detection, then communicates over encrypted HTTPS with gcl-power[.]org using Salsa20-protected fields and frequent beaconing. Rapid7 said the malware supports host fingerprinting, process enumeration, directory listing, file upload, download-and-execute, shell execution, and screenshot capture, while persistence is maintained through a scheduled task named GoogleErrorReport that runs Fondue.exe every minute from C:\Users\Public\. Researchers linked the activity to earlier Dropping Elephant tooling through shared command-handler structure, screenshot logic, WININET request flow, and beaconing patterns, and urged defenders to focus on behavioral detections such as LNK-triggered PowerShell, nonstandard Fondue.exe loading of APPWIZ.cpl, and the GoogleErrorReport task rather than static indicators alone.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Rapid7 identified a malware campaign attributed to Dropping Elephant that uses a China-themed decoy document and a malicious Windows shortcut to deliver a heavily reworked, memory-resident remote access trojan. The chain uses PowerShell staging, DLL side-loading via Fondue.exe, and persistence through a scheduled task named GoogleErrorReport.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers detailed a digitally signed .NET malware sample, `PDFriend.exe`, that posed as a PDF utility while acting as a modular fileless dropper. The binary used Costura.Fody to embed dependencies, fetched raw C# source code from `api.mikonfig.com`, compiled it in memory through .NET Roslyn APIs, and executed the resulting modules without writing a new executable to disk. Those modules performed host fingerprinting, killed browser processes, tampered with Chrome and Edge SQLite databases to hijack search settings, deployed a secondary payload from `installmyapps.com`, created persistence with a scheduled task named `PDfriendTask`, and supported data exfiltration to remote infrastructure. The sample was also signed with a GlobalSign EV code-signing certificate issued to **THE-SHOP STOP LLC**, with timestamping preserving trust after certificate expiration. Separate reporting on Wicked Panda (**APT41**) described a comparable intrusion pattern built around stealthy in-memory execution and evasion. In the simulated chain, attackers used DLL sideloading with a legitimate executable such as `taskhost.exe` to launch the DodgeBox loader, decrypt a second-stage payload from an encrypted DAT file, and reflectively load the MoonWalk backdoor in memory. DodgeBox employed sandbox checks, dynamic API resolution, obfuscated hashing, and `NtAllocateVirtualMemory`, while MoonWalk enabled remote command execution and persistence through a Windows Run registry key. The activity also showed how command-and-control and data exfiltration could be concealed inside legitimate-looking Google Drive API traffic, underscoring continued attacker reliance on trusted binaries, signed code, and fileless payload delivery to evade detection.
Jun 29, 2026