Loading story…
Blackpoint Cyber reported an intrusion at an industrial organization in which attackers deployed PCHunter64.exe from the unusual path C:\PerfLogs, alongside AnyDesk, FileZilla, MASSCAN, and RDP activity across seven endpoints. Investigators observed failed ADMIN$ share mount attempts by two user accounts on one machine, indicating attempted lateral movement, and Blackpoint said it isolated affected systems within minutes before issuing remediation guidance. The incident underscores continued abuse of legitimate or allowlisted Windows administration and remote-access tools in operational environments.
Sandbox analysis of PCHunter64 shows the tool can go well beyond administration, including dropping signed driver components, creating Windows service registry entries such as PCHUNTER64, loading kernel drivers, deleting SafeBoot registry keys, and exhibiting anti-debugging and anti-VM behavior. The activity aligns with MITRE ATT&CK persistence techniques including Windows Service creation or modification (T1543.003) and boot or logon autostart execution (T1547.008), while additional indicators pointed to credential-access behavior, including an artifact consistent with LSASS minidump collection. Together, the references show how a dual-use utility can be weaponized for persistence, defense evasion, and deeper compromise inside Windows environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following escalation of the April 22, 2024 incident, Blackpoint isolated all affected endpoints within minutes, notified the partner, and provided remediation guidance.
On April 22, 2024, Blackpoint MDR detected PCHunter64.exe executing from C:\PerfLogs during an intrusion affecting an industrial organization. Investigators identified seven impacted endpoints and observed additional attacker activity involving FileZilla, MASSCAN, AnyDesk, and RDP.
A Hybrid Analysis sandbox report documented PCHunter64.exe exhibiting spyware, credential-access, persistence, defense-evasion, and network communication behaviors, including creation of Windows service registry entries and dropped driver components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blackpointcyber.com
Open sourcehybrid-analysis.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor exploited an **SQL injection** flaw in a web page at a technology-sector organization, compromising an endpoint running **IIS** and **Microsoft SQL Server** and then carrying out extensive post-exploitation activity. Huntress reported the attacker used **base64-encoded PowerShell** for payload delivery, ran reconnaissance including `tasklist /svc`, and exfiltrated process information to an **OAST** domain. The actor then enabled **Remote Desktop Services**, created a new local administrator account named `adminweb2$`, and attempted to disable **Windows Defender** to retain access and reduce detection. The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known **BadIIS** modules using `appcmd.exe`, downloaded the **XMRig** cryptocurrency miner, hid miner-related files with `attrib.exe`, and used `nssm.exe` to keep the miner running persistently. Additional payloads included PowerShell and batch files such as `qdcjoke1.2.ps1`, `c_joke1.2.ps1`, and `qd_tjoke.bat`, along with **CnCrypt Protect**, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Jul 13, 2026
Attackers turned a single **ClickFix** social-engineering lure into a multi-stage Windows intrusion that abused `pcalua.exe` to launch `mshta.exe`, retrieve an HTA payload, and install malware that progressed through loaders and remote-access tooling. Reporting describes a chain involving **EtherHiding** infrastructure and **GULoader**, while Huntress documented a related intrusion in which an MSI dropped **Potemkin**, a custom x64 loader that used a deterministic 10,000-domain DGA to find command-and-control servers and reflectively load a follow-on DLL called **RMMProject** entirely in memory. RMMProject provided browser credential and cookie theft, a Chrome App-Bound Encryption bypass via helper DLL injection, hidden-desktop remote control, process injection, screenshot capture, and runtime module loading. The operators then established persistence with Run keys, scheduled tasks, and a renamed **Cloudflare Tunnel**, and deployed **EtherRAT**, a Node.js backdoor that resolved its C2 from an Ethereum smart contract. Huntress said the attackers conducted hands-on-keyboard activity, repeatedly battled Microsoft Defender, attempted to deploy **Chisel** reverse SOCKS tunnels, and used **WinRM**, **WMIExec**, and **SMBExec** for lateral movement, spreading EtherRAT to more than 11 hosts including the domain controller. The intrusion showed how an unmonitored initial endpoint allowed hours of attacker activity before defenders had telemetry, enabling a single user action to escalate into a network-wide compromise.
Jul 12, 2026
Researchers disclosed **Operation PhantomCLR**, a malware campaign that abuses Microsoft .NET's `AppDomainManager` mechanism to hijack execution of the legitimate, digitally signed Intel utility `IAStorHelp.exe` without altering the original binary. The intrusion chain begins with spear-phishing emails carrying a disguised `.pdf.lnk` file; when opened, it launches the Intel binary, loads a malicious configuration and DLL, and presents a decoy Saudi ministry-themed document to the victim. Reported targeting has focused on organizations in the Middle East and the broader EMEA financial sector. CYFIRMA said the framework functions as a multi-stage post-exploitation platform comparable to **Cobalt Strike** and **Brute Ratel C4**, with anti-analysis, in-memory execution, and anti-forensic features. The malware reportedly delays execution through CPU-intensive calculations and an AES key-derivation loop to evade sandboxes, then uses a JIT trampoline to run shellcode in memory and a DLL injection storm to mask activity. Command-and-control traffic is routed through **Amazon CloudFront** using domain fronting so communications blend with legitimate cloud traffic; defenders were urged to treat affected hosts as fully compromised, block identified C2 infrastructure, inspect CDN-bound TLS traffic, and harden .NET `AppDomainManager` usage.
Jun 29, 2026