Loading story…
MITRE ATT&CK documents APT42 as a phishing-focused threat actor that steals credentials and MFA tokens through spearphishing links, impersonation, and cloned login pages, including interception of SMS one-time passwords. The group is also associated with masquerading domains, anonymized VPS infrastructure, and command-and-control over HTTPS, including use of NICECURL and Base64-encoded traffic. On compromised systems, APT42 has used PowerShell, scripts, and WMI for discovery, deployed malware for keylogging, screenshots, and browser credential and cookie theft, and collected data from Microsoft 365 environments while using built-in cloud features and public tools to reduce detection.
The mapped tradecraft also shows APT42 maintaining access through Registry changes and scheduled tasks, while removing evidence by clearing Chrome history and deleting mailbox artifacts. Separately, Splunk published a detection for suspicious creation or modification of files in Linux /etc/update-motd.d, a persistence path where login-triggered Message of the Day scripts can be abused to execute malicious code. The analytic, based on endpoint filesystem telemetry such as Sysmon for Linux Event ID 11, is disabled by default and intended to surface intermediate risk events because legitimate administrative changes can also trigger the rule.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Splunk updated its "Linux MOTD Script Added" analytic, which detects creation or modification of files in /etc/update-motd.d that attackers can abuse for persistence or execution on Linux systems. The detection is implemented as an anomaly rule in Splunk Enterprise Security and is disabled by default.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Analysis of the MITRE ATT&CK Evaluations APT29 dataset found an intrusion chain centered on the `DMEVALS\pbeesly` account, where `cod.3aka3.scr` executed from `C:\ProgramData\victim` and quickly spawned `cmd.exe` and `powershell.exe`, indicating automated malware launch. Investigators traced PowerShell loading `monkey.png`, extracting hidden payload data from image pixels, and compiling it in memory through Microsoft-signed binaries `csc.exe` and `cvtres.exe`, while the broader telemetry showed far heavier memory-access and registry activity than process-creation events, consistent with an effort to minimize obvious execution artifacts. A second pivot from a timestomped `.tmp` file exposed a dense burst of implant behavior tied to a PowerShell-related `ProcessGuid`, including DLL loads, registry changes, named pipe creation, and rapid file creation and deletion. The same activity chain included an unsigned `.pyd` module loaded from a Temp directory, creation of `rar.exe` and `sdelete.exe`, and hundreds of outbound network connections; Sysmon Event ID 10 then showed PowerShell requesting full access (`0x1fffff`) to `lsass.exe`, a strong sign of credential theft, followed roughly 12 minutes later by PsExec connections to a second internal host, indicating lateral movement with stolen credentials.
Jun 29, 2026
Mandiant reported that **APT29** conducted phishing campaigns that leveraged **Atlassian Trello** and cloud-hosted infrastructure to support credential theft and follow-on intrusion activity. The operation used legitimate online services to blend malicious traffic with normal business activity, a tactic that can complicate detection and attribution while helping the threat actor stage phishing lures and redirect victims through trusted platforms. The reporting links the activity to the Russia-aligned espionage group commonly tracked as **APT29**, which is known for stealthy, intelligence-focused operations against government and other high-value targets. The campaign highlights continued abuse of widely used SaaS and cloud services as part of state-backed phishing tradecraft, reinforcing the need for defenders to monitor suspicious authentication flows, investigate links delivered through trusted collaboration platforms, and harden identity protections against credential-harvesting attempts.
Jul 12, 2026
Threat actors are continuing to prioritize **credential theft** while using defensive and trusted services to evade detection. DomainTools reported a Microsoft 365 phishing operation that **weaponizes Cloudflare protections** (including *Turnstile* human verification) to block automated analysis and security crawlers, then selectively serves a credential-harvesting flow only to “clean” visitors. The infrastructure used additional gatekeeping such as IP reputation checks (including lookups via `api.ipify.org`), hardcoded blocks for security-vendor and cloud-provider ranges, and user-agent filtering that returns a fake `404` page to bots, with the theft logic hidden behind heavy obfuscation. Separately, Hunt.io documented **Operation Roundish**, assessed with medium-high confidence as aligned to **APT28 (Fancy Bear)**, after discovering an exposed open directory hosting a Roundcube exploitation toolkit used against Ukrainian targets (including `mail.dmsu.gov.ua`). The toolkit included XSS payloads, a Flask-based C2, and modules for credential harvesting, mail forwarding persistence, bulk email exfiltration, address book theft, and 2FA secret extraction, plus a Go-based Linux implant (`httd`) found on a compromised Ukrainian web application. In parallel reporting on credential-access tradecraft, Flashpoint analysis highlighted the low-cost **DarkCloud infostealer** (sold for about **$30**) that steals browser logins/cookies and other data and exfiltrates via common channels (email/FTP/Telegram/HTTP), while Aryaka Threat Labs described the **BlackSanta** campaign using steganographic lures and **BYOVD** techniques to disable EDR and enable stealthy data theft over HTTPS—underscoring that credential access and defense evasion remain common precursors to broader enterprise compromise.
Jul 1, 2026