Loading story…
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of CVE-2018-8174, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced mshtml.dll to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed SLUB.
Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a GitHub Gist, sent execution results to private Slack channels using embedded API tokens, and uploaded stolen files to file.io. Trend Micro said the downloader also checked for antivirus processes and exploited CVE-2015-1701 for local privilege escalation, while the backdoor persisted via a Run registry key and rundll32.exe. The operation appeared focused on collecting person-related information and communications data, including content from Skype, KakaoTalk, Twitter, bulletin board systems, and HWP documents; GitHub and Slack removed the malicious infrastructure after notification.
Get the actors, campaigns, and ATT&CK mapping behind it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourcesecurelist.com
Open sourceportal.msrc.microsoft.com
Open sourcedocuments.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Zscaler ThreatLabz disclosed a new Rust-based backdoor dubbed **C2Looper** that it assesses is likely tied to a ransomware-related threat actor and used to establish footholds for lateral movement. Older samples beaconed every second over plaintext HTTP using JSON-formatted traffic and supported arbitrary shell execution, file download, and an update mechanism that abused OneDrive DLL sideloading through a malicious `wtsapi32.dll`. Researchers said the malware may be delivered through a multi-stage ClickFix infection chain, though that link is assessed with low to medium confidence. A newer internally labeled **version 2** moves command-and-control activity to **GitHub**, where beacon, tasking, and result data are stored in JSON files, and expands the malware's capabilities with directory listing, drive enumeration, host reconnaissance, and shellcode injection. ThreatLabz observed older C2Looper variants downloading the newer build through their upload functionality, indicating active development and iterative refinement, while the latest version also changes command handling and fixes a task ID parsing bug present in earlier releases.
Aug 18, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026