Loading story…
Hancitor, also tracked as Chanitor and associated with TA511/MAN1, remained a persistent Windows malware loader delivered through phishing emails that lured users to malicious Word or Excel documents. The campaign shifted from direct malicious attachments to links hosted on compromised websites, fraudulent hosting accounts, and services such as Google Drive or Google Feed Proxy to evade mail filtering. Once macros were enabled, Hancitor profiled the host, checked external IP information, contacted command-and-control servers over HTTP, and commonly used recurring URI patterns such as /8/forum.php; researchers also documented hard-coded fallback C2 infrastructure and second-stage payloads hosted on compromised business websites.
Intrusions tied to Hancitor showed it functioning as an initial-access malware that frequently delivered Cobalt Strike, Ficker Stealer, Pony, NetSupport Manager RAT, spam bot malware, and other follow-on tools. Incident reports described operators using Hancitor infections for rapid post-exploitation, including network discovery, SMB-based lateral movement, remote service execution, attempted access to lsass.exe, and in one case exploitation of Zerologon (CVE-2020-1472) to reach domain administrator privileges in under an hour. Multiple technical analyses also detailed Hancitor’s layered obfuscation, RC4- and XOR-based decoding, task parsing, and code injection into svchost.exe, underscoring its role as a mature malware delivery platform rather than a standalone payload.
Pull IOCs and campaign context straight into your stack.
17 events from the most recent confirmed update back to the earliest known activity.
Across packet captures from January 20 through March 4, 2021, Unit 42 observed Hancitor infections that performed api.ipify.org checks, used /8/forum.php C2 traffic, and retrieved follow-on payloads including Ficker Stealer and Cobalt Strike.
On 2021-01-12, Hancitor activity resumed after a lull since 2020-12-17, with spoofed DocuSign-themed emails linking to Google Docs pages that generated malicious macro-enabled Word documents. The infection chain dropped Hancitor DLLs and was observed leading to follow-on Cobalt Strike delivery in Active Directory environments.
Unit 42 reported that since November 2020, Hancitor command-and-control URLs had consistently ended with /8/forum.php, providing a recurring network indicator for defenders.
As of December 2017, Hancitor Word documents were most commonly distributed through fraudulent hosting-provider accounts rather than compromised legitimate websites.
By November 2017, Hancitor had reverted from its temporary DDE-based delivery method back to macro-enabled Office documents in malspam campaigns.
Since early October 2017, Hancitor distribution servers were usually set up through fraudulent accounts at hosting providers, marking an infrastructure shift away from relying primarily on compromised servers.
Beginning in early October 2017, Hancitor temporarily shifted to DDE-based Word document delivery before later returning to macro-enabled documents.
From January through September 2017, the majority of compromised domains used for Hancitor infections were located in Asia, suggesting widespread abuse of vulnerable legitimate business servers in the region.
FireEye published research in September 2016 documenting Hancitor, also known as Chanitor, using multiple attack approaches, indicating diversification in the malware's delivery and infection methods.
Palo Alto Networks tested a decoder against 10,000 unique Microsoft Word documents first seen on August 15, 2016 that exhibited Hancitor-like behavior, successfully decoding thousands of stage-1 and stage-2 payloads and identifying only three distinct C2 URLs across the corpus.
Since the end of 2016, Hancitor operators added an extra delivery step by sending links to distribution servers instead of attaching malicious documents directly to emails, a change intended to evade improved email filtering.
A Malwarebytes blog post from November 2015 covered Hancitor activity delivering the Pony trojan via malicious email, showing the malware family was active in malspam campaigns by that time.
ThreatLabZ analyzed Chanitor samples observed since October 2014 and found the downloader using phishing-delivered .scr attachments, api.ipify.org checks, and TOR-to-web C2 beacons to /gate.php before fetching a second-stage payload. In the analyzed case, Chanitor installed a new Vawtrak variant via a dropper that registered the DLL with regsvr32 for persistence.
The DFIR Report states that Hancitor, also known as Chanitor and Tordal, was first observed in 2014.
In July, attackers used a phishing email and malicious Word document to deploy Hancitor, then leveraged Cobalt Strike and a custom Zerologon tool to obtain a domain administrator NTLM hash and compromise key systems within hours.
The DFIR Report documented a Hancitor intrusion in which a malicious macro-enabled Word document delivered Hancitor, which then fetched Ficker Stealer and Cobalt Strike and enabled discovery and lateral movement before defenders interrupted the attack.
A 0ffset reverse-engineering analysis identified a Hancitor sample using build identifier 17bdp12 and stated that this build value indicated a campaign beginning on 17 December.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 176 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
13 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcemalware-traffic-analysis.net
Open sourcemalware-traffic-analysis.net
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceresearchcenter.paloaltonetworks.com
Open sourcefireeye.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceblog.malwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hancitor resurfaced in large email-driven malware campaigns with updated delivery and execution techniques, moving from malicious Word macro attachments to a brief use of RTF files exploiting **`CVE-2017-11882`**. Early campaigns used invoice- and billing-themed lures to deliver Word documents whose VB macros decoded embedded shellcode, allocated executable memory through Windows API calls, extracted an encrypted Hancitor payload hidden inside the document, and installed it with persistence as **`WinHost.exe`**. Proofpoint also linked Hancitor’s return to a Vawtrak affiliate using botnet IDs **80, 81, and 82**, with campaigns primarily targeting U.S. financial organizations and some victims in Canada and the UK. Researchers reported that Hancitor’s operators repeatedly refreshed the malware’s internals, including a revised command-and-control protocol, in-memory DLL execution, and delivery of additional payloads such as **Pony** and **Vawtrak**. In a later campaign, the malware used shellcode and PowerShell launched via the Office Equation Editor flaw to drop a new packer featuring anti-debugging, anti-disassembly, memory-permission changes, and a custom RC4-like unpacking routine before restoring the standard Hancitor payload. Once active, Hancitor collected host details, checked the victim’s external IP through **`api.ipify.org`**, and prepared POST requests to multiple **`gate.php`** command-and-control endpoints recovered from encrypted configuration data.
Aug 15, 2026
Researchers detailed a **MetaStealer** infection chain delivered through malicious email attachments and links, including Excel macro documents and OneNote files, that infected Windows systems and established persistence for follow-on payload delivery. In the observed campaigns, enabling macros or opening the lure file launched scripts that retrieved components from **GitHub** and **transfer.sh**, built a persistent executable on the host, and modified `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` so the malware would restart after reboot. Analysts said the infrastructure remained active near the time of publication, and network traffic to `193.106.191.162:1775` matched **EmergingThreats Pro** detections for Win32/MetaStealer activity. Separate reverse engineering showed MetaStealer used **XOR-based string decryption** and a **domain generation algorithm (DGA)** to supplement or replace static command-and-control infrastructure by generating multiple `.xyz` domains for beaconing. Decrypted strings and observed behavior indicated capabilities beyond credential theft, including **SOCKS proxying, backconnect access, firewall rule manipulation, shellcode execution, and tasking endpoints**, underscoring that MetaStealer functioned as a flexible post-compromise stealer and access tool rather than a simple infostealer.
Aug 15, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026