Loading story…
Researchers detailed an ongoing Snip3 crypter malware campaign that used spear-phishing emails themed as tax statements to launch a multi-stage infection chain. The attacks began with obfuscated VBScript and PowerShell downloaders that retrieved additional components from remote infrastructure including SQL-backed command sources and public text-hosting services, then established persistence through startup-folder VBS files. Later stages gathered host information, communicated with download servers over HTTP POST, and decrypted further payloads directly in memory to reduce detection.
The final Snip3 stage dynamically compiled C# RunPE code with CodeDom and used process hollowing to inject remote-access trojans into legitimate Windows processes including AppLaunch.exe, RegAsm.exe, and regsvcs.exe. Analysis across samples showed the framework delivering both DcRAT and QuasarRAT, with one examined payload identified as DcRAT through artifacts including its mutex naming, X.509 certificate fields, and the AES salt string DcRatByqwqdanchun. The reporting indicates Snip3 remains an adaptable loader for concealing commodity RATs behind layered scripting, in-memory decryption, and changing command-and-control infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The documented campaign's later stages fetched PowerShell payloads from PasteText, established multiple Startup-folder persistence mechanisms, collected host information, and contacted 185.81.157.59:3333 over HTTP POST. The final Stage-4 Snip3 loader dynamically compiled RunPE code and injected RAT payloads into legitimate processes, with analyzed samples delivering DcRAT via crazydns.linkpc.net:5900.
ThreatLabz documented an ongoing Snip3 campaign beginning with spear-phishing emails themed as tax statements, using attachments including a malicious VBScript. The first-stage script connected to a remote SQL database to reconstruct command components and launch a downloader PowerShell stage.
After extracting and examining the final payload from the Snip3 chain, the analysis concluded it was DcRAT rather than AsyncRAT. The determination was based on indicators including the mutex DcRatMutex_qwqdanchun, the embedded certificate issuer CN "DcRat Server," and the AES salt string "DcRatByqwqdanchun."
A first-stage VBScript sample obtained from MalwareBazaar was analyzed as a multi-stage Snip3 crypter chain. The chain launched PowerShell, fetched a second-stage script from textbin[.]net, established persistence with MicroSoftOutlookLauncher.vbs, and used in-memory compiled RunPE code to inject a final payload into RegSvcs.exe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026