Loading story…
CISA published a Malware Analysis Report on a successful intrusion that deployed FiveHands ransomware after attackers used the SombRAT remote access trojan and a collection of legitimate administrative and open-source tools. The report analyzed 18 malicious files and identified a new FiveHands variant alongside multiple SombRAT loader and payload components disguised as WwanSvc files, showing a multi-stage attack that moved from initial access to reconnaissance, lateral movement, and encryption.
The artifacts showed attackers conducting network discovery with SoftPerfect Network Scanner, using PsExec for remote execution, applying a PowerShell-based AMSI bypass and in-memory loading techniques, then deleting shadow copies and dropping ransom notes after encrypting files. CISA also released indicators tied to the activity, including the domain feticost.com and IP address 51.89.50.152, to help defenders identify related compromise.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The FBI issued a TLP:WHITE notice detailing tactics, techniques, and indicators associated with Hello Kitty/FiveHands ransomware, including double extortion, possible DDoS pressure, and exploitation of SonicWall vulnerabilities for initial access. The notice also shared malware/tool hashes and mitigation guidance, and said the FBI had first observed the ransomware in January 2021.
On 2021-05-06, CISA published Malware Analysis Report MAR-10324784-1.v1 after analyzing 18 malicious files tied to a recent successful cyberattack. The report identified a new ransomware variant named FiveHands, SombRAT-related components, legitimate tools used in the intrusion, and indicators including feticost.com and 51.89.50.152.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 111 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Ransomware activity is increasingly blending into normal IT operations** by combining exploitation of internet-facing software with the use of legitimate remote access and monitoring tools. Huntress reported multiple intrusions tied to the **Crazy** ransomware gang where attackers deployed *Net Monitor for Employees Professional* and the *SimpleHelp* remote support client to maintain persistence, evade detection, and stage for ransomware deployment. The actors installed the monitoring agent via `msiexec.exe` directly from the vendor site, then used it for interactive control (desktop viewing, file transfer, command execution); they also added redundant access by installing SimpleHelp via PowerShell and disguising binaries with benign-looking names (e.g., `vshost.exe`) and paths such as `C:\ProgramData\OneDriveSvc\OneDriveSvc.exe`. In parallel, ransomware groups have been observed **actively exploiting recently patched SmarterTools SmarterMail vulnerabilities** that enable unauthenticated compromise of mail servers. SC Media reported that CISA added **CVE-2026-24423** to the KEV catalog after it was linked to ransomware campaigns; the flaw enables unauthenticated RCE via SmarterMail’s `ConnectToHub` API by delivering a malicious OS command from a remote server. A second issue, **CVE-2026-23760**, allows authentication bypass through the password reset API (`force-reset-password`) by not validating the old password; ReliaQuest attributed active exploitation of this weakness to a China-based actor tracked as **Storm-2603**, which reportedly chained the bypass with SmarterMail’s *Volume Mount* feature to reach RCE, activity assessed as staging consistent with **Warlock** ransomware operations (even when ransomware was not yet deployed).
Jun 29, 2026
Zscaler ThreatLabz identified **SloppyRAT**, a developing Windows remote-access trojan linked to ransomware-related activity. ClickFix social-engineering lures convince victims to run commands that abuse `finger.exe` to fetch a batch-script downloader, which retrieves IronPython and obfuscated Python stages before deploying CastleLoader, CastleRAT, and a SloppyRAT DLL reflectively loaded into memory. SloppyRAT supports host reconnaissance, authenticated remote command execution, Microsoft Defender configuration changes, WMI-launched shells, CLR-based or PPID-spoofed PowerShell, and reverse SOCKS proxying to pivot through internal networks before encryption. Its HTTPS JSON command-and-control uses certificate pinning, API-key authentication, and RC4-encrypted telemetry, while runtime decryption, obfuscated strings, junk code, API hashing, and Hell's Gate-style indirect system calls hinder detection; an apparent Polygon-based EtherHiding fallback may provide additional C2 resilience. Its observed Run-key and COM-hijacking persistence mechanisms are flawed, but its operational capabilities can still establish and expand ransomware operators' access.
Sep 15, 2026
Researchers tied **ResolverRAT**, **LummaStealer**, and an **Amadey** botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected `.NET` loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, **pat[.]microsoft-telemetry[.]at**, and newly activated infrastructure such as **kampf[.]huehnchenfarm[.]ru** tied to the same ecosystem. A parallel March 2026 investigation linked the **fbf543** Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on **Omegatech LTD (AS202412)** and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from **ConnectWise, DattoRMM, Atera, GoToResolve, and N-able**, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing **AppLaunch.exe**, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.
Jun 29, 2026