Loading story…
Researchers reported that Valak is a modular, enterprise-focused malware family spread through reply-chain email hijacking and malicious attachments or links, often using password-protected ZIP files to evade inspection. Campaigns targeted organizations across sectors including manufacturing, transportation, finance, insurance, health care, and energy, with infection chains commonly relying on Microsoft Word macros or JavaScript droppers that launched payloads through Windows LOLBins such as regsvr32.exe and wscript to load DLLs in memory and reduce detection.
Multiple reports tied Valak to the broader Gozi/Ursnif ecosystem through overlapping infrastructure, delivery patterns, and follow-on activity. Analysts said Valak used compromised websites and PHP proxy scripts to fetch staged payloads and track spam delivery, while specialized plugins such as EXCHGRABBER and CLIENTGRABBER stole Exchange, Office, and email credentials from Credential Manager, autodiscover data, and the Windows registry. Related Gozi/Ursnif campaigns used hijacked email threads, Google Drive links, and password-protected archives before deploying additional tools including Cobalt Strike, TVRat/TeamViewer, and VNC-based modules, reinforcing the connection between credential theft, thread hijacking, and multi-stage enterprise intrusion activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos observed that more than 95% of its Valak activity during the reporting period occurred in May and early June 2020. The campaigns targeted enterprise sectors including finance, manufacturing, insurance, transportation, health care, and energy.
As of April 22, the Ursnif actors moved campaign infrastructure from 8.208.90.28 to 47.241.106.208. The campaign had used 16 domains pointed at the original IP since its start.
A Malware-Traffic-Analysis.net entry documented an Ursnif infection chain involving IcedID (BokBot) and Valak. The post also noted updated ZIP archives using a new password scheme and included associated sample files and network traffic imagery.
SentinelLabs reported that Valak began appearing in testing mode in mid-October 2019. The newer system used JavaScript-based delivery and compromised servers with link-based email campaigns.
Cisco Talos reported that the Valak malware family had been deployed against multiple countries since early-to-mid 2019, marking the start of observed international activity for the malware.
SentinelLabs reported operational overlap between Valak and the Gozi ConfCrew delivery ecosystem, including shared-style infrastructure and URL patterns that had led some sandbox reports to misclassify Valak as Gozi. The report also documented Valak's PHP proxy-based delivery chain and credential-theft plugins.
The DFIR Report said an Ursnif campaign targeting entities across North America and Europe appears to have started around April 6. It used compromised email accounts and Google Drive links delivering password-protected ZIP archives with JavaScript droppers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
www-cybereason-com.cdn.ampproject.org
Open sourcelabs.sentinelone.com
Open sourcesentinelone.com
Open sourceblog.talosintelligence.com
Open sourcethedfirreport.com
Open sourcecybereason.com
Open sourcemalware-traffic-analysis.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Gozi/Ursnif/ISFB** banking trojan remained an active cybercrime threat across Europe and Japan, spreading mainly through targeted malspam and phishing emails carrying weaponized Word, XLS, ZIP, JavaScript, HTA, and macro-enabled attachments. Multiple campaigns used staged infection chains involving VBA macros, PowerShell, `rundll32`, HTA downloaders, and side-loaded DLLs, with distribution tied in some cases to the **Dark Cloud** botnet and other spam infrastructure. Researchers also observed related delivery through Shiotob downloaders and compromised web servers, with operators rotating domains, IPs, and lure content to reduce detection while targeting both retail and corporate banking users.
Aug 15, 2026
The **TA551** (also tracked as **Shathak**) threat group used large-scale malspam campaigns to distribute malware including **Ursnif**, **Valak**, **IcedID**, and **Qakbot** through hijacked email threads and password-protected ZIP attachments. The lures typically contained malicious Microsoft Word documents that urged users to enable macros, after which the infection chain launched follow-on components such as HTA files, obfuscated JavaScript, XSL files, and DLL payloads executed with Windows utilities including `regsvr32.exe` and `rundll32.exe`. Researchers also observed language-specific campaigns, including German-language spam, and noted that Valak frequently acted as both an information stealer and loader for additional malware such as **NetSupport Manager RAT** and IcedID. Analysis of TA551 infrastructure found repeatable patterns across hundreds of domains, including registrar and DNS-provider preferences, TLS certificate behavior, and numeric naming conventions that helped identify likely new campaign domains before they were widely used. Defenders were advised to watch for suspicious process chains such as Word spawning `mshta.exe`, followed by `regsvr32.exe`, as well as file-type masquerading, scheduled-task persistence, registry modifications, Alternate Data Streams, and Temp-directory artifacts associated with Ursnif and Valak infections.
Aug 15, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026