Loading story…
Securonix reported that a targeted campaign tracked as STARK#VORTEX, likely linked to UAC-0154, used malicious Microsoft Compiled HTML Help (.chm) files to infect Ukrainian military personnel. The operation initially relied on drone manual lures and later shifted to business-themed documents, with execution triggering embedded obfuscated JavaScript that launched heavily obfuscated PowerShell. That chain downloaded, decoded, and executed a MerlinAgent payload hosted on catbox[.]moe, after which the malware beaconed over HTTPS to attacker-controlled command-and-control infrastructure.
Researchers said the malware established persistence through a Windows Run registry key and provided operators with full remote access to compromised systems. Securonix later observed the campaign evolve with a new lure named "Confidential Offers.chm", a Minecraft-themed payload called "minecraft.exe", and a new C2 domain, while the broader infection flow and tradecraft remained largely unchanged. Separate CrowdStrike guidance on PowerShell command and script logging underscores the value of telemetry for detecting the kind of obfuscated PowerShell activity used in this intrusion chain.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
In a later phase of the same campaign, Securonix observed attackers switch to a new CHM lure named "Confidential Offers.chm" with business-themed content. The updated infection chain downloaded a payload named "minecraft.exe" from a new staging URL and used a new command-and-control domain while keeping the broader TTPs largely unchanged.
Securonix reported that a campaign it tracks as STARK#VORTEX was targeting Ukraine’s military using a malicious CHM file themed as UAV training material for soldiers. The lure executed obfuscated JavaScript and PowerShell to download and run a MerlinAgent payload, which established persistence and beaconed to attacker-controlled infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented a malware campaign that used a malicious Microsoft Compiled HTML Help (`.chm`) file packaged inside a 7zip archive to deliver **Agent Tesla**. When opened, the CHM launched embedded, obfuscated JavaScript that invoked PowerShell to verify internet connectivity and retrieve a second-stage payload disguised as a JPEG from `pk-consult[.]hr`, showing how CHM files can serve as a less-scrutinized initial access vector. The downloaded stage unpacked a loader DLL and a gzip-compressed Agent Tesla payload directly in memory, then injected or loaded the malware into `RegAsm.exe` for execution. The final payload used FTP for data exfiltration and communicated with `ftp.videoalliance[.]ru`, underscoring a multi-stage infection chain designed to evade detection while stealing victim data.
Aug 15, 2026
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026