Loading story…
Researchers reported a new Betabot (also known as Neurevt) campaign hitting customer environments through phishing emails carrying weaponized Microsoft Word documents disguised as RTF files that exploit CVE-2017-11882 in the Microsoft Office Equation Editor. The infection chain used embedded scripts and an NSIS-based dropper to unpack the payload, inject it into processes such as Explorer.exe, and establish persistence through registry autoruns and, in some cases, scheduled tasks before reaching command-and-control infrastructure.
Betabot has re-emerged as a mature infostealer descended from a banking Trojan, with capabilities that include credential theft, form grabbing, arbitrary command execution, malware downloads, DDoS, USB propagation, and even a cryptocurrency miner module. Earlier analysis of the malware family documented administration-panel features for bot management, SOCKS4 proxying, browser homepage changes, forced URL visits, updates, file downloads, and form-grabber logs, while the latest campaign also showed extensive self-protection through anti-debugging, anti-VM and anti-sandbox checks, antivirus interference, API hooking to conceal persistence, and a BotKiller function to remove competing malware.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Cybereason reported that a cryptocurrency miner module was added to Betabot in 2017 as the malware expanded beyond banking Trojan functionality.
Cybereason said the Betabot campaign exploited CVE-2017-11882 in Microsoft Office Equation Editor and noted that Microsoft patched the vulnerability in 2017.
XyliBox published a retrospective describing observed Betabot panel versions, the botmaster's support site at betabot.ru, monitored command-and-control URLs, and the claim that development had stalled with a builder existing for version 1.7.0.1.
The XyliBox retrospective references an IC3 notice about Betabot hosted at ic3.gov/media/2013/130918.aspx, indicating a public government warning about the malware.
Cybereason said Betabot, also known as Neurevt, first appeared in late 2012 as a banking Trojan before evolving into a multifunction infostealer.
Cybereason detailed that the malicious document dropped scripts and an NSIS-based dropper, which unpacked Betabot, injected it into running processes such as Explorer.exe, and established persistence through registry autoruns and in some cases scheduled tasks.
Cybereason reported multiple Betabot infections in customer environments in the weeks preceding its report, delivered through phishing emails with weaponized Word documents that were actually RTF files exploiting CVE-2017-11882.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 38 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026
Researchers and government agencies reported that **TrickBot** continued to evolve from a banking trojan into a modular crimeware platform used for credential theft, lateral movement, data exfiltration, and delivery of follow-on malware including **Ryuk** and **Conti** ransomware. Observed delivery chains included spearphishing lures themed as COVID-19 alerts, invoices, and traffic violations, with victims receiving encrypted Word macro documents or downloading malicious JavaScript from compromised websites. In one campaign, password-protected `.docm` files used an `AutoOpen` macro to extract hidden VBScript, write a `.VBE` file to `C:\ProgramData`, rebuild a TrickBot DLL, decode it with `certutil`, and execute it through `regsvr32.exe`, helping the malware evade static and behavioral detection. TrickBot operators also updated internal tooling and infrastructure to improve stealth and spread. Palo Alto Networks documented the replacement of the older **`mworm`** propagation module with **`nworm`**, which fetched an encrypted payload over HTTP and executed it **in memory** on vulnerable Active Directory domain controllers, reducing forensic artifacts and avoiding persistence after reboot. Other reporting tied TrickBot infrastructure to leaked configuration data and IP addresses associated with **MikroTik** routers, suggesting use of compromised network devices in command-and-control operations. Across the reporting, defenders were urged to hunt for campaign-specific **gtag** identifiers, Office encryption artifacts, characteristic byte-level document changes, suspicious SMB activity including exploitation of **`CVE-2017-0144`**, and phishing-driven execution chains that lead to TrickBot installation.
Aug 15, 2026
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026