Loading story…
FortiGuard Labs detailed a MONSOON APT campaign that used malicious RTF files exploiting CVE-2015-1641 to deliver a new BADNEWS backdoor variant. One lure, "Senate_panel.doc", displayed a Pakistan-themed decoy while embedded multi-stage shellcode installed persistence through the Windows Run registry key and launched a malicious jli.dll via DLL side-loading with a renamed signed Java executable. Researchers linked additional lures tied to Pakistan-India conflict themes and UN job content to the same malware family, which supports keylogging, screenshots, file transfer, remote shell access, and theft of documents from USB and other drives.
The malware relied on web-based command-and-control techniques designed to blend into normal traffic, retrieving encrypted C2 information from legitimate services including GitHub, WordPress, RSS feeds, forums, blogs, and Dynamic DNS infrastructure. FortiGuard said exploit documents referenced compromised websites through INCLUDEPICTURE fields, and one site, justfood.pk, appeared to serve the decoy file and had previously been defaced by a persona calling itself R00T D3STR0Y3R, though the researchers did not make a definitive attribution. MITRE ATT&CK documentation and later industry reporting describe BADNEWS as using HTTP-based dead-drop resolvers, registry and scheduled-task persistence, DLL side-loading, and broad document collection and staging for exfiltration, underscoring the backdoor's continued use in South Asia-focused intrusion activity.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research stating that Patchwork continued delivering BADNEWS in operations targeting the Indian subcontinent, marking a later public reporting milestone for the malware's use.
FortiGuard Labs published a follow-up analysis of the MONSOON BADNEWS variant, detailing exploit documents' external URL references, the apparent use of compromised websites including justfood.pk, and campaign indicators such as C2 domains and hashes.
FortiGuard Labs published technical analysis of the "Senate_panel.doc" RTF lure, describing its CVE-2015-1641 exploitation chain, Pakistan-themed decoy document, DLL side-loading, persistence, and BADNEWS capabilities including keylogging and USB document theft.
FortiGuard said the malicious RTF exploit file associated with the MONSOON campaign was uploaded to VirusTotal under the name "Senate_panel.doc." The sample exploited CVE-2015-1641 and was tied to delivery of a BADNEWS variant.
FortiGuard reported that the website justfood.pk had been hacked and defaced by the persona R00T D3STR0Y3R no later than 2017-02-09. The researchers suggested this may indicate the site was under attacker control before it was later referenced in MONSOON exploit activity.
MITRE ATT&CK published an entry for BADNEWS (S0128), documenting it as a backdoor malware family and describing its command-and-control, persistence, collection, and execution behaviors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
researchcenter.paloaltonetworks.com
Open sourceblog.fortinet.com
Open sourceblog.fortinet.com
Open sourceattack.mitre.org
Open sourceforcepoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Fancy Bear (APT28)** has been attributed with high confidence to *Operation Neusploit*, a campaign targeting users in Central and Eastern Europe by weaponizing **CVE-2026-21509**, a **Microsoft RTF** parsing zero-day that enables arbitrary code execution via specially crafted RTF documents. Reported lures were written in multiple languages (including English, Romanian, Slovak, and Ukrainian) and targeted victims in **Ukraine, Slovakia, and Romania**. Microsoft issued an **out-of-band patch** for CVE-2026-21509 on **January 26, 2026**, with in-the-wild exploitation observed shortly after. Post-exploitation activity was described as a multi-stage chain that retrieves a malicious dropper DLL from attacker infrastructure and then deploys different payload paths, including **MiniDoor** (focused on Outlook email theft/exfiltration) and **PixyNetLoader**, which ultimately leads to a **Covenant Grunt** implant for command-and-control. The campaign also uses **evasion and targeting controls**, including region-restricted payload delivery (e.g., only serving malicious DLLs to requests from targeted geographies and specific `User-Agent` patterns) and persistence techniques such as **COM hijacking**, plus additional tradecraft like **steganography in PNG files** and shellcode loading to execute the final implant.
Jun 29, 2026
Security researchers reported multiple malware campaigns that disguised executables as document files to trick users into launching backdoors. In one case, attackers used a file named **"2021년 국방부 업무보고 수정.pif"** that appeared to be a revised South Korean Ministry of National Defense report; when opened, it displayed a legitimate PDF while silently dropping a malicious DLL to `C:\ProgramData\Intel\Driver\driver.cfg`, executing it with **`regsvr32.exe`**, and creating a scheduled task named **`Disk0`** to run every 30 minutes. The payload was identified as a downloader that contacted command-and-control infrastructure for follow-on instructions. A separate campaign used a malicious **SCR** file signed with a valid certificate from a well-known Korean company and presented with a PDF-like icon to reduce suspicion. After execution, the malware opened a decoy PDF from `%TEMP%`, extracted a DLL named `config.dat` into `C:\Users\Public\`, launched it with **`rundll32.exe`**, and deleted the original dropper. The backdoor then established persistence either through a **`MicrosoftEdgeInstaller`** service or a registry key, decrypted embedded configuration data with **RC4** when needed, and connected to its C2 server to support file transfer, process execution, screenshot capture, configuration updates, and code injection.
Aug 15, 2026
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026