Loading story…
Researchers linked a supply-chain compromise of the Chinese-language chat application MìMì to the China-nexus LuckyMouse/Iron Tiger intrusion set, which distributed trojanized versions for Windows, macOS, and Linux. On macOS, malicious builds starting with version 2.3.0 downloaded and executed the RShell Mach-O backdoor, while related Windows activity used HyperBro and Linux variants also deployed RShell, indicating a coordinated cross-platform operation delivered through the same messaging software.
The campaign reused infrastructure previously associated with LuckyMouse, including overlaps between RShell command-and-control servers and hosting tied to HyperBro, strengthening attribution to the group also tracked as TA428. RShell was described as a C++ implant that communicated over unencrypted BJSON over TCP and supported remote shell and file-management functions, while published indicators included malware hashes, command-and-control servers, and download URLs used to deliver the poisoned application, suggesting a targeted surveillance-focused intrusion via compromised corporate software.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Sekoia published findings with high confidence linking the trojanized macOS MìMì application to the China-nexus LuckyMouse intrusion set. The report also said this was the first time Sekoia had observed LuckyMouse targeting macOS and documented infrastructure overlap with HyperBro operations.
Sekoia determined that the macOS version of the MìMì messaging app had been trojanized since version 2.3.0, which was published on May 26, 2022. The malicious app downloaded and executed the RShell backdoor from 139.180.216.65.
Sekoia noted that LuckyMouse had previously used a compromised messaging application, Able Desktop, in the 2020 StealthyTrident operation documented by ESET. This establishes earlier tradecraft involving trojanized chat software.
Trend Micro reported that the MìMì chat application had been compromised in a campaign targeting Windows, macOS, and Linux users. The operation used HyperBro on Windows and RShell on Linux and macOS, and Trend Micro published associated hashes, C2 infrastructure, and download URLs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
blog.sekoia.io
Open sourcewelivesecurity.com
Open sourcesecurelist.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **Mokes**, a cross-platform desktop backdoor family with Linux and Windows variants, later also linked to an OS X sample. The malware was designed for surveillance and data theft, supporting screenshots, keylogging, audio capture, and exfiltration of collected information. The Linux sample, detected as `Backdoor.Linux.Mokes.a`, was described as a UPX-packed `C++/Qt` implant statically linked with Qt, `xkbcommon`, and `OpenSSL 1.0.2c`, while the Windows samples were tracked as `Backdoor.Win32.Mokes.imv` and `Backdoor.Win32.Mokes.imw`. Both variants used similar persistence and command-and-control logic, indicating a shared code base and operator playbook. On Linux, Mokes established autostart persistence; on Windows, it used `Run` registry keys and added active keylogging, with code also present for webcam capture. The malware beaconed every minute to hardcoded HTTP command-and-control servers and used TCP port `433` with a custom encrypted protocol for commands and data transfer. Researchers also noted that one Windows sample was signed with a trusted certificate chaining to **COMODO RSA Code Signing CA**, a tactic that could help the malware appear legitimate and evade scrutiny.
Aug 14, 2026
Researchers linked multiple Linux intrusions to suspected Chinese state-sponsored activity using the open-source **Reptile** kernel rootkit and a custom implant known as **Mélofée**. ExaTrack reported that Mélofée targeted Linux servers with capabilities for file and directory operations, shell execution, persistence, and command-and-control over **TCP**, **TLS**, and **UDP/KCP**, while one 2022 sample embedded a kernel-mode rootkit derived from Reptile. The installer deployed components under the disguised path `/etc/intel_audio/`, loaded the malicious kernel module with `insmod`, and established persistence through startup files such as `/etc/rc.modules`, tying the activity to infrastructure and tooling associated with **Winnti**, **ShadowPad**, **PlugX**, **Spark**, **HelloBot**, **StowAway**, and **Cobalt Strike**. AhnLab later documented a Korean intrusion that used Reptile in a nearly identical way, including installation under `/etc/intel_audio/`, manual kernel-module loading instead of the default loader flow, persistence via `rc.local`, and deployment alongside an **ICMP** backdoor called **ISH**. Reptile provides stealth features for files, directories, processes, file contents, and network traffic, and can activate a reverse shell through a **Port Knocking** mechanism using Magic Packets. The overlap in installation path and deployment method matched patterns previously highlighted by ExaTrack and reinforced assessments that Reptile-derived Linux rootkits were being operationalized in broader Chinese espionage campaigns, including activity Mandiant associated with exploitation of **Fortinet** zero-days and custom malware.
Aug 15, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026