Loading story…
Researchers linked a malware campaign to APT31 after attackers used COVID-19 vaccine-themed decoy documents and malicious MSI installers hosted on attacker-controlled GitHub accounts to target victims. The installers deployed a PyInstaller-packed Python backdoor that established persistence, harvested browser credentials, collected host information, and used the Dropbox API for command-and-control and data exfiltration. Attribution was based on shared infrastructure, code overlap, a common AES key, and tactics matching earlier activity associated with the Chinese state-sponsored group.
The campaign was also tied to prior operations aimed at Hong Kong pro-democracy figures, extending a pattern of politically themed targeting. Zscaler said the malware and infrastructure overlapped with earlier Hong Kong-themed attacks from 2019, while Google’s Threat Analysis Group separately reported China-linked activity that shifted from Mandarin-language content focused on Hong Kong and China’s COVID-19 response to broader current-events messaging on Google platforms, underscoring a wider ecosystem of China-linked operations using topical themes and legitimate online services to reach targets.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
In 2019, activity later linked to APT31 used an LNK file to fetch an MSI binary from GitHub and execute it with msiexec.exe in attacks themed around Hong Kong pro-democracy targets. Zscaler later identified overlap between this 2019 activity and the 2020 vaccine-themed campaign.
Zscaler ThreatLabZ analyzed the 2020 campaign and attributed it to APT31 based on shared infrastructure, code overlap, TTPs, a common AES key, and similarities to prior activity. The report described a chain in which email-delivered download links led to GitHub-hosted MSI payloads that dropped a PyInstaller-packed Python backdoor using Dropbox API for command-and-control and exfiltration.
In October 2020, Google Threat Analysis Group attributed a similar payload to the Chinese state-sponsored threat actor APT31. Zscaler later noted code overlap between Google's referenced payload and the Python-compiled malware it analyzed.
Zscaler ThreatLabZ found several malicious MSI installer binaries distributed in the wild in August 2020. The installers were hosted on attacker-controlled GitHub accounts and used COVID-19 vaccine-themed decoy documents to lure victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.google
Open sourceredalert.nshc.net
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Threat researchers reported multiple spear-phishing campaigns targeting Indian government and military personnel with **COVID-19-themed** and investigation-themed decoy documents delivered through disk image files. In one operation attributed with moderate confidence to **Transparent Tribe**, victims received an `IMG` file containing a benign vaccination PDF, a malicious shortcut, and a `VBS` script that launched **PeppyRAT**, a Python-based Windows payload. The malware gathered host and process information, sent it to command-and-control servers over `HTTP`, and established persistence by placing a .NET loader in the Windows Startup folder to await a second-stage DLL, `mscontainer.dll`, which researchers said may be previously undocumented. A separate campaign aimed at Indian government and local institutions used `ISO` files with `LNK` shortcuts and malicious DLLs that were executed through `rundll32.exe` to load **Cobalt Strike** beacons directly in memory. Researchers said the lures referenced cyberattack investigations and COVID-19 precautions, while the infrastructure included the domain `instade.co.in` and compromised systems tied to `comesa.int`, including `covid.comesa.int`. Analysis of the loader showed XOR-encrypted strings, custom API hashing, PEB walking for API resolution, and `LZNT1`-compressed embedded payloads; the beacons also shared the same public key and watermark, suggesting linked operator infrastructure even though attribution remained unconfirmed.
Aug 15, 2026
Researchers reported an active cyber espionage campaign linked with moderate confidence to **APT36** (Transparent Tribe) that is targeting telecom, government, defense, energy, and other critical infrastructure organizations across South Asia, including lures tied to **Afghan Telecom**, government updates, and software installers. The operation uses a malware cluster that includes **HACKERAI C2 Agent**, **PATCHCORD**, and **SHEETCORD**, showing an evolution from earlier custom C/C++ tooling to newer **Go-based implants**. The malware uses legitimate cloud services as covert command-and-control channels, with **HACKERAI** abusing **GitHub Gists** and **SHEETCORD** using **Google Sheets** for command traffic and possible data exfiltration. Researchers said HACKERAI can gather system information, execute remote commands, and maintain persistence by modifying browser shortcuts while still opening the legitimate browser to avoid suspicion; published defensive leads include suspicious GitHub activity, altered browser shortcuts, malicious ZIP or installer files, and a set of reported IOCs including domains, an IP address, and multiple `SHA-256` hashes.
Aug 26, 2026