Loading story…
Recent DFIR reporting detailed how investigators can reconstruct attacker activity from Windows and Unix artifacts while avoiding common misreads of legitimate security tooling. Securelist published deep analyses of UserAssist and AmCache, showing how shell32.dll updates GUI execution records, how session statistics and undocumented bytes can reveal usage patterns, and why AmCache can identify executables, drivers, shortcuts, and installed applications even after deletion, despite limits such as SHA-1 hashing only the first 31,457,280 bytes of large files. Separate research showed that Zsh session files can preserve command evidence even when .zsh_history is deleted, and that binaries wrapped with shc or AutoIT often remain recoverable or observable through runtime artifacts rather than being truly opaque.
Incident write-ups and field notes also showed how attackers and defenders alike can complicate investigations. Analysts documented a typosquatted npm package, peritter, that dropped OneDrive.exe into Startup and stole Chrome credentials; an intrusion in which phishing, Slack installation, RDP access, and Google Drive traffic were tied to document staging and exfiltration; and broader cases in Brazilian educational institutions involving ransomware, valid-account abuse, AnyDesk, PsExec, and insider-planted malware. Other reports warned that legitimate tools and platform features can masquerade as threats or hide them: NSSM was used to run payloads such as ngrok as Windows services, Azure Batch was abused for cryptomining, RMM cleanup scripts attempted to conceal remote access software, and Microsoft Defender for Endpoint activity including device discovery and Defender XDR deception accounts generated telemetry that could be mistaken for attacker reconnaissance or privileged account misuse unless investigators validated the underlying configuration and scripts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
In a controlled Windows 10 lab, Hayabusa analysis of Security.evtx identified Sliver implant activity along with attacker commands including whoami /all and net.exe user creation for persistence. The article also reports Windows Defender detected the delivered implant GASTRIC_EPOXY.exe as Trojan:Win32/Gracing.I during the simulation.
Analysis showed the package's obfuscated index.js copied dataset.db into the user's Startup folder as OneDrive.exe for persistence and execution. MFT and Prefetch artifacts placed the malicious execution shortly after installation.
MFT analysis indicated the peritter package was downloaded or installed on the system. Package metadata identified the author as s1rx-dev, and analysis later showed the package contained an obfuscated index.js and a malicious payload in dataset.db.
Chrome history showed the user visited the npmjs.com page for the package peritter, a likely typosquat of prettier. This browsing event preceded installation of the malicious package on the compromised host.
The analyzed incident-response dataset covered attacks against Brazilian educational institutions from January 2025 through June 2026. It included ransomware, suspicious endpoint activity, privilege escalation, and insider threats, with DragonForce and LockBit 3 appearing prominently.
Windows Defender MPLog entries recorded four Project Venus-related documents being placed in Jane's Downloads folder during the attacker-linked RDP session. The files were Energy Storage.txt, Research.txt, Solar Panel Tech.txt, and Wind Turbine Design.txt, indicating staging or exfiltration activity.
Magnet AXIOM RDP artifacts showed an incoming RDP connection from 104.203.174.169 to Jane Andrada's workstation. The write-up tied this session to the attacker activity that followed the phishing compromise.
Jane Andrada received and opened a malicious email masquerading as IT Support, as shown by Chrome web history and Chrome Web Visits artifacts. This phishing event preceded the attacker-controlled remote access and suspected data theft.
Artifacts showed Slack was installed on Jane Andrada's machine despite the organization primarily using Microsoft Teams. The installation became part of the reconstructed intrusion timeline tied to later attacker activity.
An example .session file in Zsh contained a restored-session timestamp corresponding to Thu May 16 2024 09:47:05 UTC. The article highlighted this as useful forensic evidence for narrowing when commands were executed, even if .zsh_history is deleted.
Decoded Microsoft Defender for Endpoint Device discovery parameters included an ExpirationDateTime of 2024-04-19T01:26:02.1473403Z for the scan job. The investigation concluded the observed port-scan-like behavior was legitimate Defender discovery rather than attacker reconnaissance.
Metadata from the analyzed Docker image showed the ubtssl/webappx image used in the Azure Batch cryptomining setup was created on 2024-01-03T06:31:11.0826861Z. The image later ran a Python HTTP server and the xm cryptocurrency miner with configured pool and wallet parameters.
One of the Brazilian educational-institution case studies involved an insider planting a Python keylogger on a system that used shared accounts. The article presented this as part of the broader pattern of insider threats observed in the dataset.
Another case in the Brazilian education-sector dataset involved attackers using a compromised user account to install AnyDesk and deploy DragonForce ransomware. Investigators identified the DragonForce sample through Prefetch and Amcache.hve artifacts and matched the SHA-1 of 1.EXE to a DragonForce variant.
In one case from the Brazilian education-sector dataset, attackers used a leaked valid account to deploy a custom LockBit variant, disabled defenses with a batch script, enabled RDP, and used PsExec for lateral movement. Internal systems including file servers and databases storing student profiles were encrypted, and investigators found no evidence of data exfiltration.
A PowerShell cleaner script downloaded from an open directory was found to hide AteraAgent and Splashtop Streamer by setting uninstall entries' SystemComponent value, deleting Start Menu folders, and renaming a Splashtop firewall rule to resemble a benign Windows rule. Testing confirmed it removed Splashtop from Apps & features while leaving other forensic artifacts behind.
A SANS ISC diary explained how the Atuin shell history tool stores command history in a SQLite database and identified key forensic artifacts including history.db, WAL/SHM files, encryption keys, session tokens, and configuration files. The write-up also noted soft-deleted records, sync-related cross-host history, and logging gaps investigators must account for.
An attacker who had obtained access to an Azure administrator account created a new resource group and the Azure Batch account websecv1, then sought a quota increase so compute pools could be launched for mining activity. The attacker later created a Linux Ubuntu pool that used a Start Task to download and run a script that installed Docker and launched the ubtssl/webappx container running the xm miner.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcexakep.ru
Open sourceisc.sans.edu
Open sourcetrojan-killer.net
Open sourcedfir.ch
Open sourcedfir.ch
Open sourcedfir.ch
Open sourcedfir.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of DFIR case studies documented how attackers are increasingly relying on living-off-the-land techniques, uncommon runtimes, and legitimate administration tools to maintain access while evading detection. On Windows, investigators dissected a PHP backdoor that used `php-win.exe`, a scheduled task named **ClockLauncher**, and a **ClockSystemService** service to fetch and execute second-stage code invisibly; a separate intrusion used mailbombing and Microsoft Teams vishing to deliver a modular **Deno**-based RAT and proxy that persisted via the `HKCU\Run` key and communicated over WebSocket infrastructure hosted behind CloudFront. Another investigation traced a malicious `.lnk` file to a WebDAV-hosted **Remcos** payload cached under `TfsStore\Tfs_DAV`, while repeated compromises of a vulnerable **Kentico CMS** server led to webshell deployment, SEO spam, PowerShell-based payload retrieval, and installation of a malicious IIS module, **HTTPCacheLog**, that accepted commands through HTTP cookies. On Linux and cloud infrastructure, researchers showed how attackers abused both commodity malware and stealthier post-exploitation tooling. TeamTNT-linked activity used **tmate** as a covert backdoor on Linux servers, often without normal login traces, while analysis of the **REPTILE 2.0** rootkit loader showed it bypassing `insmod` by decrypting an embedded kernel module and loading it directly with the `init_module` syscall. A separate **Sysrv** botnet infection established cron persistence, masqueraded as `kthreaddk`, and included exploitation and brute-force features for propagation. In AWS, an extortion actor deleted S3 buckets and supplied a fake Linux “recovery” binary that merely simulated restoration rather than recovering cloud data. Across the investigations, defenders were urged to hunt for recurring artifacts such as scheduled tasks, Run keys, suspicious services, unusual binaries in user-writable paths, outbound SSH or WebSocket traffic, and syscall-level module loading, using telemetry and tools including **Velociraptor**, AutoRuns, Sysmon, and CloudTrail.
Aug 1, 2026
Multiple weekly threat roundups and research posts reported a mix of active exploitation, new malware tradecraft, and breach claims. Ukraine’s CERT reported **APT28** rapidly weaponized a Microsoft Office zero-day (**CVE-2026-21509**) within roughly a day of Microsoft’s disclosure, using spearphishing emails with malicious DOC lures to deliver **Covenant** backdoors against Ukrainian government targets and EU-related entities. Separately, researchers described **ShadowHS**, a stealthy **fileless Linux** post-exploitation framework that runs in-memory (e.g., via `memfd`-style execution), uses encrypted multi-stage loading (AES-256-CBC), fingerprints defensive tooling (including major EDR agents), and retains operator-driven capabilities such as credential theft, lateral movement, and covert tunneling for exfiltration. Other reporting highlighted incident and exposure claims and defensive takeaways. Check Point described a **supply-chain compromise** affecting *eScan* (MicroWorld Technologies) in which malicious updates were pushed through the legitimate updater, prompting an emergency shutdown of global update services; it also noted **Crunchbase** confirmed a breach affecting **2M+ records** claimed by **ShinyHunters**, and cited extortion/leak claims involving **Qilin** (Tulsa International Airport) and **WorldLeaks** (Nike). Google’s legal/technical disruption of the **IPIDEA** residential proxy network was also cited as reducing available proxy nodes by millions and cutting off C2 domains used to route attacker traffic. Additional coverage described a phishing chain using a fake DHL invoice to abuse a signed Java utility via **DLL sideloading** (malicious `jli.dll`) and **process hollowing** into `AddInProcess32.exe` to run **Phantom Stealer**; detection-engineering updates emphasized new rules for Windows defense-evasion (e.g., tampering with Credential Guard/HVCI, disabling AMSI and the vulnerable driver blocklist) and expanded Kubernetes and Linux post-exploitation detections.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026