Loading story…
Cisco Talos reported that a modular malware operation targeted travel and hospitality organizations in Latin America using malspam and malicious Office attachments to deliver njRAT and AsyncRAT, while later campaigns also distributed LimeRAT. The activity was tied to the 3LOSH crypter, also referred to as Crypter 3losh RAT, which Talos assessed was used by a Brazil-based operator distinct from the crypter’s author, though the campaigns showed technical overlap with activity associated with the crimeware actor Aggah and shared tooling likely derived from the same crypter code base.
The infection chains evolved across campaigns but consistently relied on layered script execution and defense evasion. Talos observed embedded XLSM, PPAM, and XLAM files, along with HTA, VBScript, batch files, and PowerShell, to establish persistence, bypass AMSI and Microsoft Defender, and inject final RAT payloads through process hollowing or via aspnet_compiler.exe; newer waves used ISO disk images and scheduled-task persistence under "Office". Talos also said the 3LOSH builder/crypter author advertised the tool publicly and appeared to run separate malicious campaigns, including payload hosting through archive.org, while new samples continued to surface regularly.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Talos also observed additional test malicious document submissions from Brazil in July 2021 tied to the same campaign tooling. These artifacts further reinforced the Brazil-based operator assessment.
Talos observed test malicious documents submitted to VirusTotal from Brazil in June and July 2021, including Portuguese-named archives such as "Exploit pronto para envio.rar." The submissions supported Talos' assessment that the operator used a Brazilian Portuguese environment.
Cisco Talos reported that a malware campaign delivering njRAT and AsyncRAT began in October 2020 and targeted travel and hospitality organizations in Latin America. The campaign primarily used malspam with macro-enabled Office documents to start a multi-stage infection chain.
Cisco Talos assessed that the author of the 3LOSH crypter, using the nickname "alosh," had likely been active since at least 2018. Talos also linked the author to social media promotion and archive.org accounts used to host malicious payloads.
Cisco Talos later reported ongoing malware campaigns using ISO disk images and malicious VBScript to deliver AsyncRAT, LimeRAT, and other commodity malware. Talos linked the activity to a new version of the 3LOSH crypter that used GZIP-compressed embedded payloads and a more complex VBS, BAT, and PowerShell execution chain with persistence via a scheduled task named "Office."
In its August 2021 reporting, Cisco Talos described the ongoing Latin America-focused njRAT and AsyncRAT campaign and assessed that it was operated by a distinct threat actor based in Brazil. Talos also identified use of the .NET-based "Crypter 3losh RAT" and concluded the campaign was separate from, but technically overlapped with, Aggah activity and campaigns run by the crypter author.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 317 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourceblog.talosintelligence.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026