Loading story…
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of CVE-2018-8174, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced mshtml.dll to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed SLUB.
Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a GitHub Gist, sent execution results to private Slack channels using embedded API tokens, and uploaded stolen files to file.io. Trend Micro said the downloader also checked for antivirus processes and exploited CVE-2015-1701 for local privilege escalation, while the backdoor persisted via a Run registry key and rundll32.exe. The operation appeared focused on collecting person-related information and communications data, including content from Skype, KakaoTalk, Twitter, bulletin board systems, and HWP documents; GitHub and Slack removed the malicious infrastructure after notification.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Trend Micro found that by 2020 the operators had updated SLUB to replace Slack with attacker-controlled Mattermost infrastructure, creating per-victim channels and uploading command output and screenshots. The report traced older Mattermost-based samples to February 28, 2020, and indicated the malicious Mattermost server was set up on March 10, 2020, as part of Operation Earth Kitsune.
The first victims of the SLUB campaign were observed on February 27 after watering hole attacks redirected visitors into an infection chain exploiting CVE-2018-8174. The malware then gathered host context and began collecting user files and communications data.
Researchers estimated that the attackers compiled the malware on February 22. The campaign used a downloader followed by a custom C++ backdoor dubbed SLUB.
On February 20, the attackers created the Slack workspace used for malware communications and added the first commands to GitHub. SLUB later used embedded Slack API tokens to post results to private channels.
The operators behind the SLUB malware campaign created the GitHub account used for command retrieval on February 19. The campaign later used a GitHub Gist as part of its command-and-control workflow.
The attackers tested the malware on February 23 and 24 before broader victim activity was observed. The campaign used GitHub for commands and Slack for exfiltration and operator communications.
Microsoft had already patched CVE-2018-8174 in May 2018 before the later SLUB campaign used it for initial compromise. The flaw affected VBScript via the Internet Explorer rendering engine.
A malicious sample exploiting CVE-2018-8174 was uploaded to VirusTotal on April 18, 2018. The exploit chain used a Microsoft Word document to fetch remote HTML containing VBScript that triggered the vulnerability.
Kaspersky reported that the CVE-2018-8174 VBScript zero-day was found in the wild in late April 2018 and was reportedly used by an APT actor. Microsoft later confirmed the issue as CVE-2018-8174 after receiving the report.
Trend Micro publicly described the previously unknown multi-stage SLUB malware campaign, including its watering hole delivery, use of CVE-2018-8174 and CVE-2015-1701, and abuse of GitHub, Slack, and file.io for operations. The report also detailed the attackers' focus on person-related information, Skype data, and HWP documents.
After notification from researchers, GitHub and Slack removed the malicious infrastructure used by the SLUB campaign. This disrupted the attackers' communications channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourcesecurelist.com
Open sourceportal.msrc.microsoft.com
Open sourcedocuments.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Zscaler ThreatLabz disclosed a new Rust-based backdoor dubbed **C2Looper** that it assesses is likely tied to a ransomware-related threat actor and used to establish footholds for lateral movement. Older samples beaconed every second over plaintext HTTP using JSON-formatted traffic and supported arbitrary shell execution, file download, and an update mechanism that abused OneDrive DLL sideloading through a malicious `wtsapi32.dll`. Researchers said the malware may be delivered through a multi-stage ClickFix infection chain, though that link is assessed with low to medium confidence. A newer internally labeled **version 2** moves command-and-control activity to **GitHub**, where beacon, tasking, and result data are stored in JSON files, and expands the malware's capabilities with directory listing, drive enumeration, host reconnaissance, and shellcode injection. ThreatLabz observed older C2Looper variants downloading the newer build through their upload functionality, indicating active development and iterative refinement, while the latest version also changes command handling and fixes a task ID parsing bug present in earlier releases.
Aug 18, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026