Loading story…
Researchers uncovered a previously undocumented 12 KB custom Windows backdoor on a single domain-joined Windows 7 SP1 x64 corporate workstation after spotting unusual WMI persistence. The malware masqueraded as Realtek software, using a WMI event subscription named Realtek to launch RtkNGUI64.exe each evening, and concealed its command-and-control domain in C:\ProgramData\desktop.ini by encoding data as counts of UTF-16 whitespace after a legitimate-looking header. Decoding the file reconstructed diagrtrack.com, a typosquatted domain resembling Microsoft DiagTrack naming.
The implant used an ICMP knock before sending HTTP POST beacons to /version/check.php, with a victim identifier derived from CRC-32 values tied to the host and user. Its functionality was limited but operationally useful, supporting shell command execution, file writing, and polling interval changes, while analysis found no packer, anti-debugging, or links to a known threat actor. Investigators said the malware showed zero known prevalence over more than five years, the domain had been registered in 2020 and expired in 2021, and no additional victims or related samples were identified, suggesting a selectively deployed operation whose persistence remained active even after the C2 infrastructure disappeared.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Gen Digital published a technical analysis describing the backdoor's whitespace-based desktop.ini configuration, WMI persistence, and ICMP-plus-HTTP communications. The write-up said no known threat actor had been identified and no additional victims or related samples were found.
The diagrtrack.com domain registration expired in July 2021 and was not renewed. By the time researchers detected the malware, the C2 domain had already expired.
Researchers found that the last DNS record observed for diagrtrack.com dated to March 2021. This indicated the backdoor's known C2 infrastructure stopped resolving after that point.
The malware's configuration file on the victim disk was created a little over three hours after the binary was compiled, indicating deployment on the enterprise Windows 7 workstation shortly afterward. The implant was already present before security software was installed on the host.
The custom 12 KB x64 Windows backdoor binary was compiled at 13:34 UTC. Researchers later noted the sample appeared custom-built rather than commodity malware.
The command-and-control domain diagrtrack.com, a typosquat of Microsoft's DiagTrack naming, was registered through a privacy proxy. Later analysis linked this domain to the custom Windows backdoor's hidden configuration.
Investigators found a previously undocumented custom Windows backdoor on a single domain-joined Windows 7 SP1 corporate workstation while hunting for unusual WMI persistence. They observed a WMI event subscription named "Realtek" launching the masquerading binary RtkNGUI64.exe each evening.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Researchers reported a highly targeted intrusion campaign that concealed its final-stage payload by storing encrypted shellcode inside Windows event logs, giving attackers a stealthy way to maintain a **fileless** presence on compromised systems. Observed from September 2021 through at least February 2022, the operation used a multi-stage chain that combined commercial offensive tools including **Cobalt Strike** and **SilentBreak** with custom anti-detection wrappers, **DLL sideloading**, memory injection, and patching of **ETW** and **AMSI** to reduce visibility. The attackers also used signed malware, victim-tailored domain mimicry, and infrastructure hosted with providers including **Linode**, **Namecheap**, and **DreamVPS**. Persistence was established by copying `WerFault.exe` and a malicious `wer.dll` into `C:\Windows\Tasks`, while later-stage RAT variants communicated over **HTTP** or named pipes and supported reconnaissance, command execution, file operations, credential theft, screenshot capture, privilege abuse, and lateral movement. Researchers did not attribute the activity to a known threat actor and provisionally labeled the operation **SilentBreak** because that toolset featured prominently in the campaign.
Aug 14, 2026