Loading story…
Researchers detailed the CSHARP-STREAMER remote access trojan as a modular, memory-resident .NET malware used in ransomware intrusions, including cases tied to Metaencryptor, REvil, LostTrust, and ALPHV/BlackCat. In observed incidents, attackers launched the RAT through a heavily obfuscated PowerShell stager that performed an AMSI bypass, derived an XOR key, retrieved a payload disguised as a PNG, and loaded the .NET assembly directly into memory. The malware then communicated with command-and-control servers over WebSockets on multiple ports, with fallback to ICMP, using RC4-encrypted Protobuf packets.
The RAT supports broad post-compromise activity, including command execution, file discovery and exfiltration, keylogging, credential theft, lateral movement, port scanning, process dumping, payload execution, and Veeam credential extraction. Investigators found it was often paired with external persistence such as scheduled tasks or services rather than maintaining persistence itself, and in one ransomware case it was used to relay traffic across segmented networks. Detection guidance highlighted forensic artifacts including Windows Event ID 2004, a netsh firewall rule opening inbound TCP port 6667, PowerShell Script Block Logging evidence, memory-resident indicators, and the user agent string websocket-sharp/1.0, reinforcing assessments that the malware may be customized or provided as a service across multiple ransomware operations.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
HiSolutions released research and detection guidance for CSHARP-STREAMER, including YARA and Sigma rules, memory-resident indicators, PowerShell Script Block Logging recommendations, firewall-rule monitoring, and the user agent string "websocket-sharp/1.0".
cyber.wtf published a technical analysis of the csharp-streamer RAT, describing its obfuscated PowerShell stager, in-memory .NET loading, WebSocket and ICMP command-and-control, and broad post-exploitation capabilities.
HiSolutions reported a significant increase in observed CSHARP-STREAMER usage in Q3 2023 and linked an August 2023 uptick to Metaencryptor victim postings and LostTrust victim activity.
HiSolutions reported that the AMSI memory bypass used in the PowerShell loader was copied from a script posted on GitHub in August 2022.
The cyber.wtf analysis states that csharp-streamer had existed since at least April 2021 and had previously been identified by Fortgale in a ransomware campaign.
HiSolutions said the XOR decryption component later used in the loader was originally published by security researcher GetRektBoy724 in 2021.
HiSolutions stated that the first in-the-wild samples of CSHARP-STREAMER appeared in the second half of 2020 and likely represented early development versions.
HiSolutions analyzed a ransomware incident involving Metaencryptor in which attackers used a PowerShell loader to decrypt and execute CSHARP-STREAMER in memory and used its relay capability to reach a protected network segment.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Security researchers reported a **multi-stage Windows malware campaign dubbed Shadow#Reactor (SHADOW#REACTOR)** that uses a VBScript launcher and **PowerShell** to retrieve **fragmented, text-only payloads** from remote infrastructure, then reconstructs and executes them to ultimately deploy **Remcos RAT**. The infection chain relies on user interaction (e.g., phishing/social-engineering lures or compromised web resources) to execute an obfuscated `.vbs` file via Windows Script Host, after which staged PowerShell downloaders pull encoded payload pieces that are stored as plain text to reduce the likelihood of traditional binary-based detections. Securonix analysis (as reported in both trade and vendor writeups) describes a modular handoff between stages, including obfuscation layers, base64 decoding patterns, and integrity/size checks to ensure successful reassembly of the final components. The technique emphasizes **living-off-the-land** execution and flexible staging (allowing attackers to update individual stages independently), with reconstruction activity leveraging legitimate tooling (e.g., **MSBuild** noted in reporting) before in-memory decoding and retrieval of the final Remcos payload; defenders should treat unusual chains of `wscript.exe`/`cscript.exe` spawning PowerShell and subsequent staged text retrieval/reassembly as high-signal behavior for investigation.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026