Loading story…
Trend Micro reported that the SYSCON backdoor is being delivered through malicious macro-enabled Office documents themed around the Red Cross, the World Health Organization, and North Korea. Once opened, the documents decode embedded payloads and install either 32-bit or 64-bit malware, then use uacme.exe to bypass User Account Control and establish persistence by registering a rogue COMSysApp service with ipnet.dll and ipnet.ini.
Unlike more common malware that relies on HTTP or raw TCP, SYSCON uses an FTP server as its command-and-control channel, reading task files from the server’s /htdocs/ directory and uploading compressed, Base64-encoded results. The malware supports command execution, file theft, configuration changes, payload delivery, and launching downloaded tools including NirSoft's mailpv.exe; Trend Micro also noted coding errors that break some command handling and said the malware shares traits with the earlier Sanny family, indicating a possible link to the same threat actor.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published an analysis of the SYSCON malware family, describing its macro-document delivery, UAC bypass, malicious COMSysApp service installation, and use of an FTP server for command-and-control. The report also noted similarities between SYSCON and the earlier Sanny malware family, suggesting a possible shared threat actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA warned that attackers were distributing **KONNI** malware through phishing emails carrying Microsoft Word documents with malicious VBA macros. The documents altered their appearance to pressure recipients into enabling content, after which the macros checked system architecture and used the Windows command shell and `CertUtil` to download, decode, and execute additional payloads. CISA described KONNI as a remote administration tool capable of file theft, keylogging, screenshot capture, arbitrary command execution, persistence, privilege escalation, and data exfiltration. The activity aligns with multiple **MITRE ATT&CK** techniques across the intrusion lifecycle, including phishing-based initial access, macro execution, discovery, command-and-control, and exfiltration. Among the mapped behaviors are host and network reconnaissance actions such as collecting local configuration details with native utilities, consistent with ATT&CK technique `T1016` for system network configuration discovery. CISA said the alert included ATT&CK mappings, Snort signatures, and mitigation guidance to help defenders detect and block the campaign.
Aug 15, 2026
North Korea-linked **Kimsuky** has been tied to a series of phishing campaigns that delivered malware through files disguised as PDFs, resumes, questionnaires, and North Korea-related consultation documents. Across the observed intrusions, victims were lured into opening password-protected archives, enabling Office macros, or executing VBS and CHM files, after which the malware launched follow-on payloads through tools such as `wscript.exe`, `mshta.exe`, `regsvr32.exe`, and PowerShell. The implants opened decoy documents to reduce suspicion, established persistence with scheduled tasks, Startup-folder copies, or `HKCU\Run` entries, and contacted attacker-controlled infrastructure including `kro.kr`, `webcindario`, and PHP-based command-and-control endpoints. The recovered payloads show Kimsuky broadening from simple downloaders into multi-stage surveillance and theft malware. Reported capabilities include host reconnaissance, browser and email data theft, crypto-wallet artifact collection, file upload and download, keylogging, clipboard capture, active-window monitoring, and registry changes that weaken Microsoft Office security settings. Researchers also linked newer operations to a wider infrastructure ecosystem, including SharpExt-related panels and a compromised site used to deliver browser-extension malware, while one later campaign exfiltrated stolen victim data through the **GitHub API** instead of FTP, indicating continued adaptation in both delivery and collection methods.
Aug 15, 2026
Researchers reported that **Operation SilentCanvas** is using weaponized `.jpeg` files to compromise Windows systems and deploy a trojanized **ConnectWise ScreenConnect** remote access tool. In the campaign, a file such as `sysupdate.jpeg` is actually a PowerShell loader delivered through social engineering, including phishing, deceptive file-sharing, and fake software updates. The malware creates a staging directory at `C:\Systems`, downloads additional payloads from `legitserver.theworkpc[.]com` over TCP port `5443`, and compiles a custom launcher named `uds.exe` on the victim host using `csc.exe`. The intrusion chain includes runtime string reconstruction, in-memory execution of a secondary payload, **AMSI bypass**, and a **UAC bypass** that abuses the `ms-settings` registry path and launches `ComputerDefaults.exe` to gain elevated privileges without a visible prompt. Once installed, the malware enables persistent remote access, credential theft, encrypted command-and-control, screen capture, microphone monitoring, hidden desktop execution, and long-term persistence through a Windows service named **OneDriveServers** and hidden administrator accounts. Defenders were urged to monitor abused Windows binaries, investigate suspicious PowerShell and unexpected ScreenConnect activity, tightly control remote administration tools, isolate affected hosts, and reset privileged credentials after suspected compromise.
Jun 29, 2026