Hacktivist Cluster Exploits ProxyShell to Deploy RATs, Web Shells, and Ransomware

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

3 linked

Cyber Anarchy Squad 4BID Hakerskii Kit

Malware

5 linked

ClearWater Blackout Locker BlackSalt Warp RAT BlackReaperRAT

Organizations

1 linked

Microsoft Corporation

Breaches

1 linked

UNKNOWNRUSSIANORGANIZATION-2026-01

Observables

111 linked

MD5 hash••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••MD5 hash••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••MD5 hash••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••MD5 hash••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••+103

Indicator values are masked on this page. View all 111 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

1 reference tracked. Mallory keeps watching after this page renders.

SecurelistNews · Jun 8, 2026

Hacktivists are broadening their scope beyond political motivation | SecurelistOpen source ↗

On the same thread

Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.

Jun 10, 2026

Multiple APT and malware campaigns abusing phishing, cloud services, and signed binaries

Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)

Mar 3, 2026

BlackCat Ransomware Intrusions Exploit Exchange and Use Web Shells, Cobalt Strike, and Data Theft

BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.

Jul 17, 2020

Hacktivist Cluster Exploits ProxyShell to Deploy RATs, Web Shells, and Ransomware

How this story unfolded

Hacktivist cluster expands operations beyond Russia and Belarus

Related entities

Threat actors

Malware

Organizations

Breaches

Observables

Sources

See the full picture, correlated to your attack surface.

Hacktivist Cluster Exploits ProxyShell to Deploy RATs, Web Shells, and Ransomware

How this story unfolded

Hacktivist cluster expands operations beyond Russia and Belarus

Related entities

Threat actors

Malware

Organizations

Breaches

Observables

Sources

See the full picture, correlated to your attack surface.

Hacktivist Cluster Exploits ProxyShell to Deploy RATs, Web Shells, and Ransomware

How this story unfolded

Hacktivist cluster expands operations beyond Russia and Belarus

Related entities

Threat actors

Malware

Organizations

Breaches

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Pro-Ukrainian Hacktivists Expand Exchange Intrusions Into CIS and Middle East

Multiple APT and malware campaigns abusing phishing, cloud services, and signed binaries

BlackCat Ransomware Intrusions Exploit Exchange and Use Web Shells, Cobalt Strike, and Data Theft

Hacktivist Cluster Exploits ProxyShell to Deploy RATs, Web Shells, and Ransomware

How this story unfolded

Hacktivist cluster expands operations beyond Russia and Belarus

Related entities

Threat actors

Malware

Organizations

Breaches

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Pro-Ukrainian Hacktivists Expand Exchange Intrusions Into CIS and Middle East

Multiple APT and malware campaigns abusing phishing, cloud services, and signed binaries

BlackCat Ransomware Intrusions Exploit Exchange and Use Web Shells, Cobalt Strike, and Data Theft