Loading story…
Cisco and Palo Alto researchers detailed multiple intrusion campaigns that relied on evasive malware to establish persistence and hide command-and-control traffic, including ObliqueRAT, GoldMax, NimzaLoader, and the SUNBURST backdoor tied to the SolarWinds Orion supply-chain compromise. In the SolarWinds intrusion, attackers distributed a trojanized, digitally signed Orion update that deployed SUNBURST, which masked its communications as legitimate Orion Improvement Program traffic and was later used to deliver follow-on payloads such as TEARDROP and customized Cobalt Strike BEACON implants.
Cisco Talos also reported that Transparent Tribe revived ObliqueRAT in campaigns aimed largely at organizations in South Asia, using malicious Office documents to retrieve payloads concealed in BMP image files hosted on hijacked websites. Researchers said newer ObliqueRAT variants added anti-analysis features, screenshot and webcam capture, removable-drive file theft, and updated persistence methods, while Cisco’s broader threat review noted that GoldMax used encrypted per-implant configuration and decoy traffic, and NimzaLoader used phishing emails, fake PDF-preview links, JSON-based communications, and process injection to deliver second-stage access.
Trace attribution and downstream blast radius.
10 events from the most recent confirmed update back to the earliest known activity.
Cisco Umbrella released a threat spotlight covering GoldMax, ObliqueRAT, and NimzaLoader, summarizing their malware behavior, targeting, infrastructure, and indicators of compromise.
Cisco Talos published details of a new ObliqueRAT campaign attributed to Transparent Tribe, highlighting steganography in BMP files, compromised websites for hosting payloads, and updated persistence and anti-analysis techniques.
Cisco Umbrella reported that TA800 had previously used BazaLoader before switching to NimzaLoader in February 2021 for phishing-delivered malware operations.
Talos said the ObliqueRAT campaign that began in April 2020 was still ongoing as of November 2020, continuing to use overlapping infrastructure with CrimsonRAT and possibly RevengeRAT.
Talos reported discovering ObliqueRAT versions 6.1, 6.3.2, 6.3.4, and 6.3.5 during this period, adding anti-analysis checks, removable-drive theft, screenshot and webcam capture, CSV targeting, and a changed mutex naming convention.
Cisco Talos said a new ObliqueRAT campaign attributed to Transparent Tribe started in April 2020, using malicious Office documents and compromised websites to deliver payloads hidden in BMP files.
The report states that FireEye released signatures and indicators to help defenders identify SolarStorm and related SUNBURST activity.
Unit 42 said SUNBURST delivered additional payloads including the TEARDROP memory-only dropper, which was used in at least one case to deploy a customized Cobalt Strike BEACON.
Unit 42 reported that attackers embedded the SUNBURST backdoor in a digitally signed, trojanized SolarWinds Orion update, with SolarWinds stating fewer than 18,000 customers ran the affected version out of more than 300,000 customers.
FireEye disclosed a breach and data exfiltration campaign it attributed to UNC2452, tied to a SolarWinds Orion supply-chain compromise affecting organizations worldwide.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 80 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
umbrella.cisco.com
Open sourceblog.talosintelligence.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The SolarWinds intrusion was carried out through trojanized **Orion** software updates that delivered the **SUNBURST** backdoor to a wide range of victims, including U.S. government agencies and private-sector organizations. FireEye’s disclosure that its own network had been breached helped expose the broader campaign, which investigators and U.S. officials widely linked to Russian state espionage, with the **SVR** cited as the most likely actor. Reported victims included the Departments of State, Treasury, Commerce, Energy, Homeland Security, and the National Institutes of Health, and responders warned that eradication and recovery would take months. Technical analysis showed SUNBURST was engineered for stealth: it could delay execution for up to 14 days, avoid test and lab environments, check for security tools and researcher systems, and even modify Windows service registry settings to weaken some protections after reboot. The malware used domain generation and HTTP(S) command-and-control, then exfiltrated data with encrypted `POST` requests—sending large payloads as compressed, XOR-obfuscated `application/octet-stream` data and hiding smaller payloads inside fake JSON structures with Base64 chunks. In response, defenders published threat-hunting resources, indicators of compromise, Splunk and SQL queries, and tools that emulate SUNBURST’s blacklist logic to identify processes, services, and drivers that would cause the malware to terminate.
Aug 15, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026