Loading story…
Researchers reported a malicious document campaign that delivered the OSTAP JavaScript downloader and ultimately Trickbot by abusing a Windows 10-specific Microsoft Remote Desktop ActiveX control. The lure document used the hidden MsRdpClient10NotSafeForScripting class and, after a user enabled document content, triggered a macro through the OnDisconnected event. The macro relied on a DNS lookup failure condition tied to error code 260, then constructed OSTAP as a BAT file and executed it, showing attackers were exploiting newer operating system functionality rather than a software vulnerability.
Separate analysis of OSTAP showed the loader is heavily obfuscated and has long served as a reliable Trickbot delivery mechanism. Researchers deobfuscated recurring String.fromCharCode patterns, extracted indicators including IP addresses, URLs, and a User-Agent string, and identified roughly 140 related samples through static hunting. One recovered IP address, 185[.]234[.]73[.]125, was tied to a Trickbot campaign that used Coronavirus-themed lures in Italy, underscoring OSTAP's role as a persistent and adaptable staging tool in Trickbot operations.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Morphisec disclosed technical details showing the attackers abused the OnDisconnected event and DNS lookup failure condition with error code 260 to construct and execute OSTAP from a BAT file. The post also published indicators including the domain insiderppe.cloudapp[.]net and multiple sample hashes.
In its analysis of the malicious document campaign, Morphisec said it was correcting a previous misidentification that had attributed the activity to FIN7. The revised assessment kept focus on the campaign because it was delivering the advanced Trickbot malware framework.
Morphisec Labs identified a couple dozen malicious Word documents that delivered the OSTAP JavaScript downloader and ultimately Trickbot. The campaign abused the Windows 10-era MsRdpClient10NotSafeForScripting Remote Desktop ActiveX control and required victims to enable document content to trigger execution.
CERT Intrinsec encountered the OSTAP loader during a ransomware-related investigation, manually analyzed its obfuscation, and built a Node.js deobfuscation script to decode the payload and extract indicators of compromise. The researchers then used static code patterns to hunt for similar samples on VirusTotal and collected about 140 OSTAP samples for further analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and government agencies reported that **TrickBot** continued to evolve from a banking trojan into a modular crimeware platform used for credential theft, lateral movement, data exfiltration, and delivery of follow-on malware including **Ryuk** and **Conti** ransomware. Observed delivery chains included spearphishing lures themed as COVID-19 alerts, invoices, and traffic violations, with victims receiving encrypted Word macro documents or downloading malicious JavaScript from compromised websites. In one campaign, password-protected `.docm` files used an `AutoOpen` macro to extract hidden VBScript, write a `.VBE` file to `C:\ProgramData`, rebuild a TrickBot DLL, decode it with `certutil`, and execute it through `regsvr32.exe`, helping the malware evade static and behavioral detection. TrickBot operators also updated internal tooling and infrastructure to improve stealth and spread. Palo Alto Networks documented the replacement of the older **`mworm`** propagation module with **`nworm`**, which fetched an encrypted payload over HTTP and executed it **in memory** on vulnerable Active Directory domain controllers, reducing forensic artifacts and avoiding persistence after reboot. Other reporting tied TrickBot infrastructure to leaked configuration data and IP addresses associated with **MikroTik** routers, suggesting use of compromised network devices in command-and-control operations. Across the reporting, defenders were urged to hunt for campaign-specific **gtag** identifiers, Office encryption artifacts, characteristic byte-level document changes, suspicious SMB activity including exploitation of **`CVE-2017-0144`**, and phishing-driven execution chains that lead to TrickBot installation.
Aug 15, 2026
**TrickBot** was updated to abuse Windows User Account Control on multiple versions of Windows, letting the malware launch with elevated privileges without showing a visible prompt. Researchers reported that the trojan used the **`fodhelper.exe`** auto-elevation technique on Windows 10 and **CMSTPLUA** on Windows 7, then quickly shifted to a newer Windows 10 bypass that abused **`wsreset.exe`** through registry changes under **`HKCU\Software\Classes`**. The changes allowed TrickBot to run more quietly, evade user suspicion, and weaken host defenses while maintaining administrative access. The malware’s expanded privilege-escalation capability supported a broader credential-theft and post-compromise toolkit already seen in earlier TrickBot campaigns. Fortinet’s analysis of the **`pwgrab`** module showed TrickBot stealing saved passwords, browser data, autofill information, and credentials from applications including **Outlook**, **FileZilla**, and **WinSCP**, while persisting through scheduled tasks and exfiltrating data over HTTP. Reporting also noted TrickBot’s ability to spread laterally, target Active Directory data on domain controllers, and provide access that could later be used to deploy **Ryuk ransomware**.
Aug 15, 2026
Researchers tied multiple malware components to **TrickBot-associated operations**, including a custom loader that fetched encoded payloads from GitHub files disguised as images and launched a 64-bit **Cobalt Strike** beacon directly in memory. The loader manually resolved APIs from `ntdll.dll` and `kernel32.dll`, loaded `wininet.dll`, and used HTTPS command-and-control on port `443`, with beacon configuration pointing to `rainbowmango.info` subdomains and `gpupdate.exe` configured as a spawn-to process. Separate analysis of **TrickLoader**, the TrickBot framework’s loader component, showed years of increasing obfuscation, including hidden resource names, custom Base64 schemes, compressed payloads, function-table reconstruction, and anti-analysis techniques such as UAC bypass and Heaven’s Gate. Additional reporting linked a newer **Krypton/Xenon crypter** and related data-exfiltration malware to the same ecosystem through a distinctive string-encoding pattern ending in `mOrxx` that had previously appeared in TrickBot tooling. Unpacked samples contained references to **Mimikatz**, a proof-of-concept for `CVE-2020-0787`, and downloads from `raw.githubusercontent.com`, while the exfiltration malware used WinINet APIs to upload stolen data to hard-coded `uploadFile.php` endpoints and also enumerated processes and collected desktop and window information. Investigators identified infrastructure including `temp.positiveseca.com`, `se1.buttonrich.com`, `figures.pablotech.info`, and `files.pablotech.info`, reinforcing links between TrickBot loaders, post-exploitation tooling, and data-theft activity.
Aug 14, 2026