Loading story…
Avast reported that a remote access trojan used in attacks in the Philippines leveraged what appears to be a compromised Philippine Navy digital certificate, indicating the threat actor likely had access to the certificate’s private key. The certificate was issued to *.navy.mil.ph, was valid from December 15, 2019 to December 15, 2020, and Avast found evidence it was used with the malware in June 2020. The malware communicated with its command-and-control server over pinned TLS at dost[.]igov-service[.]net:8443, using the certificate to support trusted-looking encrypted communications.
The malicious payload, identified as wlbsctrl.dll, was analyzed as a C++ remote access tool with capabilities including file and directory operations and shellcode execution. Avast said the sample contained tampered PE timestamps, used OpenSSL 1.1.1g compiled on April 21, 2020, and included debug artifacts suggesting the author username may have been udste. Although the malware mimicked Quasar RAT superficially through mutex naming, researchers said it was not Quasar and instead used its own implementation, including AES-CBC encryption for configuration strings.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Avast publicly reported a remote access trojan active in the Philippines that used what appeared to be a compromised Philippine Navy certificate and published indicators of compromise for the campaign. The report said the malware communicated with dost[.]igov-service[.]net:8443 using pinned TLS.
The *.navy.mil.ph certificate later identified in the malware campaign reached the end of its validity period on December 15, 2020. Avast noted the certificate was expired by the time of reporting.
Avast found evidence that the compromised Philippine Navy certificate was used with the malware in June 2020. The RAT used the certificate for pinned TLS command-and-control communications.
The OpenSSL 1.1.1g component statically linked into the remote access trojan was compiled on April 21, 2020. Avast used this as a technical anchor in its malware analysis.
A TLS certificate for *.navy.mil.ph was issued and became valid. Avast later reported that this same certificate appeared to have been compromised and used by malware operators.
The Philippine Navy security team later informed Avast that the incident had been resolved. No specific date for that response was provided in the source.
After identifying the malware's use of the Philippine Navy certificate, Avast contacted CERT-PH to help notify the Philippine Navy. This was part of the incident response described in the report.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **APT37** targeted Korean users with spear-phishing emails posing as urgent Microsoft Account Team messages and cybersecurity advisories, delivering ZIP archives that contained malicious `.lnk` files. The shortcut files abused native Windows tools including `cmd`, `PowerShell`, and `curl.exe` to fetch a decoy document and staged payloads, ultimately installing **NarwhalRAT**, a Python-based remote access trojan compiled from Python code. Genians linked the activity to Korea-focused infrastructure and artifacts, including references to `naverwhale`, KakaoTalk-related handling, and Korean relay servers. Once installed, NarwhalRAT established persistence through a scheduled task disguised as a Microsoft task, performed anti-VM checks, and enabled broad surveillance and control functions such as keylogging, screen capture, microphone recording, file transfer, USB data collection, and remote command execution. The malware used a dual command-and-control design that combined Korean relay domains with the **pCloud API** as a dead-drop resolver, complicating detection and tracking. Researchers urged defenders to strengthen EDR coverage for suspicious LNK-to-PowerShell execution chains, unusual scheduled task creation, unexpected `curl.exe` activity, and silent Python execution.
Jul 12, 2026
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026