Loading story…
Researchers documented continued Simda malware activity using a domain generation algorithm (DGA) to maintain command-and-control resilience and evade takedowns. Reverse-engineering of Simda, also tracked as Shiz and sometimes linked to iBank, showed the malware can generate 1,000 domains per run using sample-specific seeds, keys, domain lengths, and top-level domains. Historical analysis tied multiple malware samples observed between 2013 and 2015 to several distinct seed sets, expanding prior public tracking of the family’s DGA behavior.
A later Simda sample analyzed by SonicWall used DLL injection into the Windows winlogon process, calling WriteProcessMemory and CreateRemoteThread to load WinSCard.dll. SonicWall said the sample retained the family’s DGA-based infrastructure, generating up to 1,000 active C2 domains, with observed use of .com domains and prior Simda-related activity also tied to .eu, .info, .su, and .net. The malware was described as an information stealer that can also alter websites through injection, underscoring Simda’s combination of stealthy process compromise and durable C2 generation.
Get the actors, campaigns, and ATT&CK mapping behind it.
10 events from the most recent confirmed update back to the earliest known activity.
A sample with MD5 ad71cd5a05db9473c5580eb070963bf9 was analyzed on Malwr.com and mapped to seed set 1, showing the DGA configuration still in use in 2015.
A sample with MD5 809652095b88a2fa0ea4dd89760599c1 was analyzed on Malwr.com and mapped to seed set 2, adding another observed Simda/Shiz DGA variant.
A sample with MD5 11b54c5d8531c0705d30a87f2b42a20f was analyzed on Malwr.com and mapped to seed set 4, for which the key sum was later brute-forced by the researcher.
The reverse-engineering note states that multiple Malwr.com samples analyzed between February and July 2014 mapped to seed set 5, indicating recurring use of that Simda/Shiz DGA configuration.
A sample with MD5 d0acd37e9075990d0f1289db350c258d was analyzed on Malwr.com and mapped to seed set 1, indicating continued reuse of that Simda/Shiz DGA seed set.
A sample with MD5 ecbdcf103052f1537798e5b27e1f2538 was analyzed on Malwr.com and mapped to seed set 3, showing another Simda/Shiz DGA configuration in use.
A Simda/Shiz malware sample with MD5 9c5e9e1a049ec198abf461f92758d8b5 was analyzed on Malwr.com and mapped to seed set 1 of the malware's DGA configuration.
SonicWall said Microsoft had previously documented the Simda malware family and first identified its use of a domain generation algorithm in 2012.
SonicWall Capture Labs reported a new Simda sample and related activity observed in August, describing DLL injection into the Winlogon process and loading of a DLL named WinSCard.dll.
A reverse-engineering analysis of the Simda/Shiz DGA documented how the malware generates 1,000 domains per run and identified six seed sets in total, including two additional seeds beyond prior DGArchive and abuse.ch work.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 93 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers Jason Reaves and Joshua Platt reported new infrastructure and malware activity tied to **MetaStealer**, identifying a new wordlist-based domain generation algorithm while confirming the malware’s older DGA is still active. Their analysis found MetaStealer gate servers are largely domain-agnostic and depend more on IP address, port, URI, and HTTP headers to relay traffic, indicating operators can shift domains without significantly changing backend behavior. The investigation also uncovered a related Windows payload called **RuntimeSync**, described internally as a “tracker” and still appearing to be under development. The malware includes backdoor and RAT functions such as keylogging, screenshot and desktop video capture, file upload, self-updating, and remote command execution, and it uses its own DGA for communications. Researchers said the analyzed routine used a hardcoded seed, generated 1,000 domains from a 101-word list with width three, and used the hardcoded TLD `com`; they also published network and endpoint indicators for both MetaStealer and RuntimeSync.
Jun 29, 2026
Researchers documented **Ramnit** as a Zeus-like banking trojan, worm, and file infector that was distributed through the **Blackhole exploit kit** and equipped with rootkit capabilities, spam-sending functions, and aggressive persistence. Analysis of multiple samples showed the malware dropping several components, installing a fake **"Mi cor soft Windows Service"**, injecting into `svchost.exe`, and in some cases infecting executable and HTML files by appending malicious code. One sample was tied more closely to botnet and spam activity, while another emphasized file infection, a combination that made reliable cleanup difficult and led researchers to recommend full system rebuilds rather than partial remediation. The reporting also showed that Ramnit used resilient command-and-control methods, including communications over port `443` with a custom encoded protocol rather than SSL and large fallback domain lists to find active servers. Separate reverse engineering of the malware's **domain generation algorithm (DGA)** found that Ramnit generated variable-length `.com` domains using a simple linear congruential generator and multiple observed 32-bit seeds, including `0xEF214BBF`, `0x28488EEA`, `0x4BFCBC6A`, and `0x79159C10`. Investigators linked parts of the infrastructure to pharma spam operations, noted overlap with previously documented Ramnit C2 servers, and reported that while one command server had been sinkholed, other infrastructure remained active.
Aug 15, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026