Loading story…
Researchers attributed a new phishing campaign to GOFFEE, an APT group tracked since 2023, targeting mainly technology organizations in Russia and newly extending to Belarus. The attackers sent emails with intentionally corrupted-looking documents that pushed victims to enable content, triggering remote template injection, a staged payload chain, and final in-memory .NET execution. The operation relied on a mix of phishing and living-off-the-land techniques, with operators conducting manual post-exploitation and using legitimate tools to blend into victim environments.
Post-compromise activity included reconnaissance and theft of credentials and configuration data from software such as AnyDesk, OpenVPN, Kerio Control, Telegram, and pgAdmin, along with data exfiltration hidden in HTTP User-Agent headers. Investigators also observed GOFFEE bringing its own mshta.exe, establishing persistence through InstallUtil.exe and a malicious service disguised as ASUS software, and modifying pgAdmin source code to redirect communications to attacker-controlled infrastructure. In a notable escalation, researchers identified a Mythic agent running inside a Linux container, likely launched through a tampered RabbitMQ service script and executed filelessly with memfd_create, marking the group’s apparent move into containerized environments.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Kaspersky states it has tracked the GOFFEE APT group since 2023, establishing the start of the group's observed activity in this reporting context.
The Securelist report describes GOFFEE bringing its own mshta.exe, using InstallUtil.exe and a malicious service disguised as ASUS software for persistence, and modifying pgAdmin source code to redirect communications to attacker-controlled infrastructure.
Researchers found a GOFFEE Mythic agent running inside a Linux container, likely launched through a modified RabbitMQ service script and executed filelessly with memfd_create. The report presents this as an apparent expansion of GOFFEE activity into containerized environments.
The reporting highlights GOFFEE exfiltrating data through HTTP User-Agent headers as part of the observed campaign.
The attackers were observed relying heavily on legitimate tools and manual post-exploitation, including reconnaissance and harvesting credentials and configurations from software such as AnyDesk, OpenVPN, Kerio Control, Telegram, and pgAdmin.
The campaign uses phishing emails with corrupted-looking documents that prompt victims to enable content, triggering remote template injection and a multi-stage chain that ends with an in-memory .NET payload.
Researchers identified a newly observed phishing campaign attributed with high confidence to GOFFEE. The campaign primarily targets technology-sector organizations in Russia and newly includes organizations in Belarus.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 86 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A previously unreported cyber espionage campaign has been uncovered targeting Russian military personnel and defense industry organizations. The campaign, attributed to the group known as Goffee, utilized phishing lures such as fake New Year concert invitations and forged official letters to entice victims into opening malicious XLL files. Once executed, these files deployed a new backdoor named EchoGather, which enabled attackers to collect system information, execute commands, and exfiltrate files to a command-and-control server disguised as a food delivery website. The phishing documents showed signs of artificial generation, including linguistic errors and poorly imitated Russian emblems, suggesting the use of AI-generated decoys to enhance stealth and evade detection. Researchers from Intezer first identified the malicious XLL file on VirusTotal, with uploads originating from both Ukraine and Russia. The campaign demonstrates the evolving tactics of the Goffee group, which has been active since at least 2022, as they experiment with new methods to bypass security controls. The use of AI-generated content and XLL-based payloads highlights a growing trend in cyber espionage operations, particularly those targeting sensitive sectors such as defense. The full extent of the campaign's success and the specific data sought by the attackers remain unclear, but the operation underscores the persistent threat posed by sophisticated, state-aligned cyber actors.
Jun 29, 2026
Researchers reported multiple intrusion campaigns adopting **Golang-based malware loaders** delivered through phishing to improve evasion and persistence. In one campaign, tracked as **GO#WEBBFUSCATOR**, attackers sent malicious Microsoft Office documents that abused an external template to retrieve a `DOTM` file, whose VBA macros downloaded a JPEG with appended Base64 data, decoded it with `certutil`, and launched a Golang executable named `msdllupdate.exe`. The malware used layered obfuscation including **ROT25**, **XOR-obfuscated Go assemblies**, and gobfuscation, then persisted by copying itself into `LOCALAPPDATA` and creating a **Run** key under `HKCU`. A separate campaign tied to **TA416**/**Mustang Panda** used phishing lures themed around Vatican-China relations and spoofed journalist identities to target Catholic, diplomatic, Myanmar, and African organizations. Proofpoint said the actor deployed a **Golang-based PlugX loader** inside RAR archives, using a legitimate Adobe executable for **DLL side-loading** of `hex.dll`, which decrypted `adobeupdate.dat` and executed the PlugX payload. Across the campaigns, operators relied on stealthy command-and-control methods, including **TXT DNS requests via `nslookup`** to attacker-controlled domains such as `xmlschemeformat.com`, `apiregis.com`, and `updatesagent.com`, while TA416 infrastructure included command-and-control IP `45.248.87[.]162`, underscoring a broader shift toward Golang tooling in espionage-focused malware operations.
Aug 15, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026