Loading story…
Security researchers reported multiple campaigns using trojanized versions of PuTTY and other legitimate tools to compromise high-value users, including administrators, engineers, and technical support staff. LevelBlue said a recent malvertising operation pushed fake PuTTY installers through Bing sponsored ads and typosquatted domains such as puttyy[.]org and puttysystems[.]com, with a signed malicious executable creating scheduled-task persistence, dropping twain_96.dll and green.dll, and communicating with infrastructure linked to Broomstick/Oyster malware. In affected environments, the intrusions progressed to hands-on-keyboard activity, reconnaissance via cmd.exe, and Kerberoasting using an in-memory script derived from PowerSploit’s Invoke-Kerberoast to obtain RC4-HMAC Kerberos service tickets for offline cracking.
Microsoft previously described a related tradecraft pattern in which North Korean state-backed ZINC—now tracked as Diamond Sleet—used social engineering on LinkedIn and WhatsApp to deliver weaponized open-source software, including PuTTY, KiTTY, TightVNC Viewer, Sumatra PDF Reader, and muPDF, to targets in media, defense, aerospace, and IT services across several countries. That activity deployed the ZetaNile malware family using DLL search-order hijacking, staged payloads, persistence, lateral movement, and data exfiltration, while separate analysis of Lazarus-linked BLINDINGCAN showed the group’s broader capability set for encrypted command-and-control, remote command execution, file transfer, and system discovery. Together, the reporting shows attackers repeatedly abusing trusted admin and open-source tools as malware delivery vehicles to gain persistence, steal credentials, and expand access inside victim networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly attributed the campaign to ZINC, now tracked as Diamond Sleet, and described the ZetaNile/BLINDINGCAN malware family, lateral movement, exfiltration, and the use of weaponized open-source software.
Microsoft said the actor began using a trojanized TightVNC Viewer in September 2022, delivering it alongside a weaponized SSH utility over WhatsApp.
Microsoft observed the campaign from late April to mid-September 2022 and said ZINC successfully compromised numerous organizations in media, defense and aerospace, and IT services using weaponized tools including PuTTY, KiTTY, TightVNC Viewer, Sumatra PDF Reader, and muPDF/Subliminal Recording installer.
Microsoft said the North Korean threat actor ZINC began the campaign in June 2022 by contacting targets on LinkedIn to build trust before moving conversations to WhatsApp for malware delivery.
Following the incidents, LevelBlue conducted threat hunting across customer environments for campaign indicators and created new custom SentinelOne detection rules based on the observed IOCs and TTPs.
LevelBlue isolated affected endpoints using SentinelOne, advised disabling the impacted user account, and recommended resetting credentials for SPN accounts observed in Kerberos ticket requests.
LevelBlue observed hands-on-keyboard activity via cmd.exe, reconnaissance commands such as nltest and net group, and execution of an in-memory Kerberoasting script derived from PowerSploit's Invoke-Kerberoast to request RC4-HMAC-encrypted service tickets for offline cracking.
In the investigated incident, the fake PuTTY executable signed by "NEW VISION MARKETING LLC" created a scheduled task named "Security Updater," dropped twain_96.dll and green.dll, and communicated with infrastructure consistent with Broomstick/Oyster malware.
LevelBlue documented several incidents in which privileged users downloaded fake PuTTY installers delivered through malicious Bing sponsored ads and typosquatted PuTTY-themed domains.
LinkedIn Threat Prevention and Defense detected ZINC creating fraudulent recruiter profiles impersonating technology, defense, and media entertainment companies and terminated the associated accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026