Loading story…
Researchers documented Opachki as a Russian-focused trojan that arrived through a dropper, installed a malicious DLL, and used packers including Mystic Compressor and UPX to complicate analysis and removal. The malware disabled Windows Safe Mode by deleting the SafeBoot registry key, checked infected hosts for Zeus components, and in some cases renamed Zeus-related files, suggesting it competed with or attempted to take over systems already compromised by other banking malware. Public sample reporting later tied the campaign to a dropper and dropped DLL widely detected by antivirus vendors as Opachki or related packed trojan families.
The trojan’s core capability was to hook Windows networking functions in memory, including recv(), WSARecv(), WSASend(), and send(), allowing it to intercept traffic for ports 21, 25, 80, and 110 and steal credentials from FTP, web, and email sessions. It also hooked browsers such as Firefox, Internet Explorer, and Opera, as well as the Russian ICQ client QIP, then injected malicious JavaScript into web responses to redirect victims through attacker-controlled infrastructure, hijack links, and capture search queries—particularly when users arrived from search engines, enabling Google-style redirection fraud and traffic monetization.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Contagio published an update on Opachki that shared the dropper.exe and rundll32.dll sample hashes and linked the sample to prior public reporting on Opachki's web-link hijacking and Google redirections. The post noted that newer variants might have lower detection rates and slightly different names.
The dropped Opachki payload rundll32.dll was submitted to VirusTotal and also detected by 37 of 42 antivirus engines. Microsoft, McAfee, and NOD32 identified the DLL as Opachki or a closely related variant.
The Opachki dropper.exe sample was submitted to VirusTotal, where it was detected by 37 of 42 antivirus engines. Vendors including Microsoft, McAfee, and Trend Micro classified it as Opachki or a related trojan family.
A SANS ISC diary analyzed Opachki as an actively spreading link-hijacking trojan that disabled Safe Mode, hooked browser and QIP network APIs, injected malicious JavaScript into web responses, and redirected users through attacker-controlled infrastructure. The report also noted Opachki checked for Zeus infections and renamed Zeus-related files, suggesting competition for infected hosts.
A later Contagio post stated that an Opachki sample consisting of dropper.exe and a dropped rundll32.dll dated to October 2009. The sample was identified as part of the Opachki link-hijacking trojan family.
A Habr analysis described the malicious DLL ftp34.dll, a descendant of an earlier trojan, detailing how it hooked Windows socket APIs to intercept traffic on ports associated with email, web, and FTP sessions. The write-up documented inline hooks on recv(), WSARecv(), WSASend(), and send(), indicating theft of credentials directly from network traffic.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
contagiodump.blogspot.com
Open sourceisc.sans.edu
Open sourcecontagiodump.blogspot.com
Open sourcehabr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
The **Win32/Caphaw** banking trojan, also known as **Shylock**, targeted major European banks with a webinject plugin that altered online banking sessions in real time and enabled fraudulent transactions. Researchers said the malware had been active since at least 2011 and was especially prevalent in the **United Kingdom, Italy, Denmark, and Turkey**, with spread peaking in late 2012. Its webinjects could replace phone numbers shown on banking sites and use an **autoload** feature to initiate theft while victims were actively logged in, helping attackers bypass one-time-password protections. Caphaw combined several evasion and persistence techniques, including **process injection**, inter-process communication through **named pipes**, **anti-VM checks**, **polymorphic repacking**, and encrypted configuration delivery. The malware also supported a broad plugin ecosystem that expanded its capabilities beyond banking fraud, including **SOCKS proxying**, credential theft, **VNC** remote access, **Skype propagation**, removable-media spreading, video capture, and an **MBR bootkit** component tracked as **Win32/Wolcape**.
Aug 14, 2026
The **Sticky Werewolf** cyber-espionage group has been linked to phishing attacks against Russian scientific, industrial, and government organizations, with later reporting also identifying targets in Belarus. In one campaign, attackers impersonated Russia’s Ministry of Industry and Trade in emails carrying decoy documents and a password-protected archive; another wave used phishing links generated through **IP Logger** to disguise delivery URLs while collecting victim profiling data such as IP address, location, browser version, and operating system. Researchers also tied the activity to earlier spoofed-email operations themed around Russian state bodies including **EMERCOM**, the Ministry of Construction, and the **FSB**. The intrusions ultimately deployed **Ozone RAT**, and in some cases **Darktrack RAT**, while showing victims decoy files to mask the infection. Analysts said the Ozone RAT loader was copied into `%TEMP%` under names such as `utorrent.exe`, established persistence through a shortcut in the Windows Startup folder, and used a modular chain in which it downloaded an encrypted DLL from a command-and-control server, saved it as `data.dbf`, decrypted it, and loaded it reflectively into memory via the Delphi API function **BTMemoryModule**. The malware was reported to support remote command execution, file and process management, registry changes, keylogging, screen, webcam, and microphone capture, password theft from browsers and mail clients, hidden virtual network computing (**HVNC**) control, reverse proxying, payload delivery, and self-deletion.
Aug 15, 2026