Loading story…
Security researchers reported ongoing phishing activity by Larva-24009, a threat actor active since at least 2023, using email lures to compromise users and install malware. The campaign has targeted victims in South Korea as well as organizations and users internationally, with analysis published by AhnLab ASEC and echoed by other researchers including Cyble.
The newly documented case adds to earlier disclosures from 2024 that linked the actor to similar email-based intrusion activity, indicating a sustained malware delivery operation rather than an isolated incident. Public reporting attributes the attacks to phishing emails crafted to trick recipients into opening malicious content, reinforcing the continued risk from socially engineered initial access campaigns aimed at broad regional and cross-border targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ASEC describes the 2026 intrusion chain as using obfuscated PowerShell, scheduled-task persistence, Notifier malware including a Telegram-reporting variant, QuasarRAT, UltraVNC Server, likely RDP access, NirSoft theft tools, and a batch script that creates a backdoor account named '_BootUEFI_.'.
ASEC says Larva-24009 was still conducting attacks in 2026, primarily using phishing emails with LNK files disguised as documents to target enterprise users in Korea and globally.
The references state that ASEC previously disclosed attack cases attributed to Larva-24009 in 2024. The newer campaign's malware and file naming patterns are described as broadly consistent with that earlier activity.
ASEC reports that the Larva-24009 threat actor has been active since at least 2023, conducting phishing email attacks to install malware on targets in South Korea and other countries.
Cyble is said to have identified the same phishing campaign and named it HeptaX, linking its findings to the activity attributed by ASEC to Larva-24009.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AhnLab Security intelligence Center (ASEC) reported that the **Larva-26005** threat actor is actively distributing the **Xctdoor** malware to users in South Korea and has tied the activity to earlier **CRAT** attack cases. The report connects the current campaign to malware previously disclosed by ASEC in 2024, indicating continuity in tooling and operations rather than an isolated incident. The activity also aligns with a separate March 2026 case disclosed by Hauri, where the malware was disguised as an **integrated security program** to lure victims into infection. The combined reporting suggests an ongoing social-engineering-driven malware campaign in South Korea in which Xctdoor is being reused or adapted alongside tactics seen in prior CRAT-related intrusions.
Aug 6, 2026
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026
Multiple reports describe **phishing-led malware delivery** that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using **Vercel-hosted** pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes **Telegram-based filtering** and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a **remote access tool (RAT)**. A separate campaign (tracked as **PHALT#BLYX**) targets hospitality staff with Booking[.]com-style reservation emails and uses a **fake browser error + fake BSOD** to coerce victims into running the **ClickFix** technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via **`MSBuild.exe`** to deliver **DCRat**, consistent with **LOLBins**-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.
Jun 29, 2026