Loading story…
North Korea-linked Thallium compromised a private stock investment messenger installer and used it to deliver malware in a software supply-chain attack. Researchers said the trojanized package was built with NSIS and abused WMIC with XSL script processing to reach attacker-controlled FTP infrastructure, download VBS payloads, collect host information, and establish persistence through Windows Task Scheduler before selectively deploying additional remote-access malware.
The activity matched the MITRE ATT&CK T1220 XSL Script Processing technique, including the "Squiblytwo" variation that uses WMI's /FORMAT option to execute script content from local or remote XSL files through trusted Windows components. Investigators also found malicious document lures using the same WMIC/XSL method, indicating Thallium reused this tradecraft across both spear-phishing and supply-chain intrusion paths to evade controls and stage follow-on compromise.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
ESRC referenced an earlier case in which the North Korea-linked Thallium group disguised malware as domestic cryptocurrency wallet firmware.
MITRE ATT&CK published technique T1220 describing adversary abuse of XSL files for code execution, including msxsl.exe and the WMI-based "Squiblytwo" variation using the /FORMAT switch.
ESRC also discovered malicious document lures using the same WMIC/XSL technique, where enabling content triggered communication with attacker-controlled FTP infrastructure via a fake protected-document prompt.
ESRC reported that Thallium trojanized a private stock investment messenger installer for Windows, using WMIC with XSL Script Processing to contact attacker-controlled FTP infrastructure, establish persistence, and selectively deliver additional malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly relying on *living-off-the-land* techniques and trusted tooling to establish persistent access on Windows endpoints. One campaign used weaponized Windows shortcut (`.LNK`) files disguised as investment-related PDFs to deliver **MoonPeak**, a remote access trojan assessed as a **XenoRAT** variant and linked to North Korea–aligned activity targeting South Korean investors and cryptocurrency traders. Opening the `.LNK` launches an obfuscated PowerShell-driven, multi-stage infection chain while displaying a decoy PDF; analysis also tied payload hosting to attacker-controlled GitHub repositories, reflecting “Living Off Trusted Sites (LOTS)” tradecraft. A separate dual-wave intrusion chain used phishing emails masquerading as *Greenvelope* invitations to steal webmail credentials (e.g., Outlook, Yahoo, AOL), then used the compromised accounts to register for and silently deploy **LogMeIn Resolve** (formerly *GoTo Resolve*) for persistent remote access. The installer (`GreenVelopeCard.exe`) was described as signed and configured to connect to attacker-controlled infrastructure, with follow-on actions including modifying service settings for elevated access and creating hidden scheduled tasks for resilience. Related threat intelligence reporting also highlighted broader “rogue RMM” abuse trends, including **Remcos** and **NetSupport Manager** delivery via paste-and-run lures and PowerShell/`cmd` execution chains (including use of the `finger` utility to fetch remote payloads), underscoring that adversaries are operationalizing legitimate remote administration software as a stealthy backdoor mechanism.
Jun 29, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Security researchers reported multiple campaigns using trojanized versions of **PuTTY** and other legitimate tools to compromise high-value users, including administrators, engineers, and technical support staff. LevelBlue said a recent malvertising operation pushed fake PuTTY installers through **Bing sponsored ads** and typosquatted domains such as `puttyy[.]org` and `puttysystems[.]com`, with a signed malicious executable creating scheduled-task persistence, dropping `twain_96.dll` and `green.dll`, and communicating with infrastructure linked to **Broomstick/Oyster** malware. In affected environments, the intrusions progressed to hands-on-keyboard activity, reconnaissance via `cmd.exe`, and **Kerberoasting** using an in-memory script derived from PowerSploit’s `Invoke-Kerberoast` to obtain RC4-HMAC Kerberos service tickets for offline cracking. Microsoft previously described a related tradecraft pattern in which North Korean state-backed **ZINC**—now tracked as **Diamond Sleet**—used social engineering on LinkedIn and WhatsApp to deliver weaponized open-source software, including **PuTTY**, **KiTTY**, **TightVNC Viewer**, **Sumatra PDF Reader**, and **muPDF**, to targets in media, defense, aerospace, and IT services across several countries. That activity deployed the **ZetaNile** malware family using DLL search-order hijacking, staged payloads, persistence, lateral movement, and data exfiltration, while separate analysis of Lazarus-linked **BLINDINGCAN** showed the group’s broader capability set for encrypted command-and-control, remote command execution, file transfer, and system discovery. Together, the reporting shows attackers repeatedly abusing trusted admin and open-source tools as malware delivery vehicles to gain persistence, steal credentials, and expand access inside victim networks.
Aug 15, 2026