Loading story…
Researchers detailed a multi-stage malware campaign that used fake trading software installers to deliver MineBridge RAT, including a trojanized TradingView Desktop package served from the look-alike domain tradingview[.]cyou. The malicious Windows installer, signed by YUNIVELL, LLC, selectively targeted Windows 10 systems and launched PowerShell-based stages that installed and configured OpenSSH, retrieved attacker-controlled keys and configuration, and established a reverse SSH tunnel to 86.106.181[.]183:32672 to maintain remote access. The operation also relied on shortened URLs and additional lures such as Bitcoin_Trade.exe, Arbitrage_Bot.exe, and Polarr_Setup (2).exe.
Follow-on stages created scheduled tasks disguised as OneDrive Sync and Google Disk Sync to fetch more PowerShell payloads, eventually deploying NetSupport client components and MineBridge RAT. The malware chain abused TeamViewer for DLL side-loading, giving operators persistent control while blending into legitimate remote administration activity. Reporting indicates the campaign reflects a sophisticated delivery mechanism built to evade suspicion by impersonating trusted trading tools and layering multiple persistence and remote-access techniques.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz reported that it uncovered the full multi-stage MineBridge RAT attack chain in May 2021, documenting the installer, PowerShell stages, reverse SSH tunnel, and final payloads.
Threat actors registered the impersonation domain tradingview[.]cyou to mimic tradingview[.]com and support delivery of a fake TradingView installer.
Threat actors began distributing MineBridge RAT with an updated delivery mechanism in March 2021, using trading-themed lures and multi-stage malware installation.
MineBridge RAT was first discovered in January 2020 targeting financial services organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used the legitimate Windows `finger.exe` utility in a phishing campaign to download and install the **MineBridge** backdoor, turning a rarely used Windows command into a living-off-the-land malware delivery tool. The lures arrived as malicious Word documents disguised as job applicant resumes, and victims who enabled editing or content triggered a password-protected macro that fetched a Base64-encoded payload from a remote server. The payload was written to `%AppData%`, decoded with `certutil.exe`, and executed, showing how multiple native Windows tools were chained together to avoid suspicion. The downloader then retrieved a TeamViewer executable and used **DLL hijacking** to sideload MineBridge, ultimately giving the attackers broad remote access to infected systems. Reported capabilities included command execution, file download, process control, system information collection, and microphone access through TeamViewer. FireEye had previously linked MineBridge to phishing activity targeting South Korean organizations, indicating the campaign fit an established pattern of malware delivery and post-compromise remote control.
Aug 14, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026