Loading story…
Taiwanese government agencies were hit by a sophisticated intrusion campaign that deployed Waterbear malware after attackers abused a weakness in a trusted data loss prevention (DLP) product for DLL hijacking and high-privilege execution. CyCraft identified dozens of affected endpoints in one environment and linked additional high-risk systems to the compromise, reporting that the attackers also reused access left behind from earlier intrusions, harvested administrative credentials, and expanded through victim networks using lateral movement methods including RDP and net use.
The operation used Waterbear Loader, a malware family previously associated with BlackTech, to maintain persistence, evade detection, and covertly control compromised hosts. Researchers said the malware injected shellcode into Windows services including Winmgmt, sens, Wuauserv, and LanmanServer, abused the IKEEXT service to load WLBSCTRL.DLL, and relied on techniques such as Heaven’s Gate, API hooking, RC4-encrypted payloads, forced DLL unloading, oversized binaries, and Kernel32.dll padding to frustrate analysis and bypass security tools.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
CyCraft later published a detailed write-up of the April 2020 attacks, documenting Waterbear Loader tradecraft, malware samples, file paths, hashes, and ATT&CK mappings. The report included indicators such as SQLWVSS.DLL, IGTERM.DLL, OCI.DLL, SECUFILE.DLL, LIBGID.DLL, WLBSCTRL.DLL, SQLWVSS_NT.DLL, and LOG4C.DLL.
In August 2020, CyCraft separately reported that a Chinese APT group had targeted Taiwanese chip manufacturers in 2018 and 2019. The company said at least seven vendors were affected and sensitive semiconductor information including designs, source code, and SDKs was stolen.
In the April 2020 attacks, the malicious DLL injected shellcode into Windows services including Winmgmt, sens, Wuauserv, and LanmanServer, after which Waterbear deployed next-stage payloads and communicated with command-and-control infrastructure. CyCraft also reported abuse of the Windows IKEEXT service to load WLBSCTRL.DLL.
A key step in the April 2020 campaign was exploiting a trusted DLP tool that failed to verify DLL integrity, allowing malicious DLLs to be loaded with high privileges. CyCraft said the attackers modified LOG4C.DLL to force loading of malicious libraries such as SecureFile.dll or LIBDIG.dll.
CyCraft reported that malware and access left behind from an earlier intrusion had not been fully eradicated and were reused in the April 2020 campaign. Attackers leveraged previously compromised endpoints and harvested administrative credentials to reach internal systems.
During the April 2020 intrusions, CyCraft found 30 confirmed infected endpoints in one affected environment and linked 10 additional endpoints as high risk. The findings showed the campaign had established broad footholds inside the victim network.
In April 2020, multiple Taiwanese government agencies were targeted in a campaign that prominently used Waterbear Loader. CyCraft said the attackers exploited a weakness in trusted DLP software, reused remnants of earlier compromises, and moved laterally with stolen credentials.
Trend Micro published research on Waterbear, describing the malware's return and its use of API hooking to evade security product detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcezdnet.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a targeted cyber-espionage campaign delivering **BlackWater** malware through malicious Microsoft Word documents themed around major public events, including the Beirut explosion and COVID-19. The activity targeted government, diplomatic, and defense-related entities, with reporting tying parts of the operation to victims in Bulgaria and Azerbaijan and noting similarities to broader Asia-focused espionage tradecraft seen in campaigns attributed to groups such as **Naikon** and **Vicious Panda**. The infection chain used an obfuscated macro to retrieve an encrypted second-stage payload from hardcoded command-and-control URLs chosen by the victim’s Windows version, then decrypted it with a book-cipher-style method derived from the legitimate font file `C:\Windows\Fonts\cambriab.tff`. The malware established persistence by dropping a malicious Word add-in, `Moon.wll`, into Word’s startup folder, then fetched an encrypted x64 backdoor that communicated over JSON through **Cloudflare Workers** and resolved infrastructure via DNS-over-HTTPS using `cloudflare-dns.com` and `libcurl`. Researchers said the tooling overlaps and advanced operational security point to a capable APT operator tracked as **ReconHellcat**.
Aug 14, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
China-linked espionage group **BlackTech**—also tracked as **Earth Hundun**, **Palmerworm**, and **Red Djinn**—was tied to sustained intrusions across East Asia, with a heavy focus on Taiwan and Japan and victims spanning government, media, telecommunications, defense, academia, technology, semiconductors, manufacturing, and professional services. Reporting describes spearphishing campaigns using password-protected archives and malicious Excel macro files, alongside exploitation of internet-facing systems including **ProxyLogon**, `CVE-2015-5119`, and `CVE-2017-7269`, to gain initial access. In Japanese campaigns, researchers linked tools including **Flagpro**, **BTSDoor**, **LAMICE**, **BUSYICE**, **TELESWORD**, **DELTABEEF**, **SELFMAKE**, and **SPIDERPIG** to the actor, while earlier operations used **PLEAD**, **DRIGO**, **Waterbear**, and **Shrouded Crossbow** malware built around **BIFROST/BIFROSE**, **KIVARS**, and **XBOW** variants. Researchers said BlackTech used modular, multi-stage malware to steal credentials, profile hosts, maintain persistence, and exfiltrate sensitive documents, including government, defense, budget, and foreign-affairs material. **Flagpro** was described as an early-stage downloader and credential stealer that could fetch second-stage payloads such as **BTSDoor**, while **Waterbear** operated as an in-memory backdoor and **DRIGO** exfiltrated data through Google services; separate analysis also identified a Linux **ELF Bifrose** variant, showing the group’s tooling extends beyond Windows. Investigations further uncovered exposed directories and overlapping command-and-control infrastructure tied to BlackTech, including malware controllers and exploit collections for routers, Citrix, MikroTik, VMware vRealize, Cisco RV devices, Hongdian routers, and Oracle WebLogic, while domain-tracking research showed the actor repeatedly reused registrant details, name servers, and tech-themed domains even as registrar choices shifted over time.
Aug 15, 2026