Loading story…
Researchers detailed a digitally signed .NET malware sample, PDFriend.exe, that posed as a PDF utility while acting as a modular fileless dropper. The binary used Costura.Fody to embed dependencies, fetched raw C# source code from api.mikonfig.com, compiled it in memory through .NET Roslyn APIs, and executed the resulting modules without writing a new executable to disk. Those modules performed host fingerprinting, killed browser processes, tampered with Chrome and Edge SQLite databases to hijack search settings, deployed a secondary payload from installmyapps.com, created persistence with a scheduled task named PDfriendTask, and supported data exfiltration to remote infrastructure. The sample was also signed with a GlobalSign EV code-signing certificate issued to THE-SHOP STOP LLC, with timestamping preserving trust after certificate expiration.
Separate reporting on Wicked Panda (APT41) described a comparable intrusion pattern built around stealthy in-memory execution and evasion. In the simulated chain, attackers used DLL sideloading with a legitimate executable such as taskhost.exe to launch the DodgeBox loader, decrypt a second-stage payload from an encrypted DAT file, and reflectively load the MoonWalk backdoor in memory. DodgeBox employed sandbox checks, dynamic API resolution, obfuscated hashing, and NtAllocateVirtualMemory, while MoonWalk enabled remote command execution and persistence through a Windows Run registry key. The activity also showed how command-and-control and data exfiltration could be concealed inside legitimate-looking Google Drive API traffic, underscoring continued attacker reliance on trusted binaries, signed code, and fileless payload delivery to evade detection.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A published analysis examined PDFriend.exe, a digitally signed .NET application masquerading as a PDF utility that downloads raw C# code from api.mikonfig.com, compiles it in memory, and executes modular payloads without writing a new executable to disk. The analysis also described persistence via a scheduled task, browser database tampering, secondary payload delivery from installmyapps.com, and data exfiltration capabilities.
Public reporting cited in the reference describes Wicked Panda (APT41) campaigns active from May 2021 to February 2022 that targeted U.S. state government networks and Taiwanese media organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Rapid7 reported a renewed **Dropping Elephant** malware campaign using a China-themed lure to deliver a heavily reworked, memory-resident remote access trojan on Windows systems. Victims are enticed with a decoy document tied to a GRES-3 seawater pump contract, while a malicious shortcut file, `GRES3001.lnk`, launches a PowerShell-based staging chain that downloads components from `chinagreenenergy[.]org`. The malware then abuses the legitimate Microsoft binary `Fondue.exe` to side-load a malicious `APPWIZ.cpl` file from `C:\Users\Public\`, decrypts an AES-256-CBC protected payload from `editor.dat`, and uses Donut shellcode to map the final 32-bit RAT directly into memory. The RAT patches **AMSI**, **WLDP**, and **ETW** in-process to reduce detection, then communicates over encrypted HTTPS with `gcl-power[.]org` using Salsa20-protected fields and frequent beaconing. Rapid7 said the malware supports host fingerprinting, process enumeration, directory listing, file upload, download-and-execute, shell execution, and screenshot capture, while persistence is maintained through a scheduled task named **GoogleErrorReport** that runs `Fondue.exe` every minute from `C:\Users\Public\`. Researchers linked the activity to earlier Dropping Elephant tooling through shared command-handler structure, screenshot logic, WININET request flow, and beaconing patterns, and urged defenders to focus on behavioral detections such as LNK-triggered PowerShell, nonstandard `Fondue.exe` loading of `APPWIZ.cpl`, and the `GoogleErrorReport` task rather than static indicators alone.
Jun 29, 2026