Loading story…
Researchers reported multiple intrusion campaigns adopting Golang-based malware loaders delivered through phishing to improve evasion and persistence. In one campaign, tracked as GO#WEBBFUSCATOR, attackers sent malicious Microsoft Office documents that abused an external template to retrieve a DOTM file, whose VBA macros downloaded a JPEG with appended Base64 data, decoded it with certutil, and launched a Golang executable named msdllupdate.exe. The malware used layered obfuscation including ROT25, XOR-obfuscated Go assemblies, and gobfuscation, then persisted by copying itself into LOCALAPPDATA and creating a Run key under HKCU.
A separate campaign tied to TA416/Mustang Panda used phishing lures themed around Vatican-China relations and spoofed journalist identities to target Catholic, diplomatic, Myanmar, and African organizations. Proofpoint said the actor deployed a Golang-based PlugX loader inside RAR archives, using a legitimate Adobe executable for DLL side-loading of hex.dll, which decrypted adobeupdate.dat and executed the PlugX payload. Across the campaigns, operators relied on stealthy command-and-control methods, including TXT DNS requests via nslookup to attacker-controlled domains such as xmlschemeformat.com, apiregis.com, and updatesagent.com, while TA416 infrastructure included command-and-control IP 45.248.87[.]162, underscoring a broader shift toward Golang tooling in espionage-focused malware operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Securonix reported that subdomains ns1.apiregis.com and ns2.apiregis.com began resolving to 139.28.36.222 on July 16, 2022, associated with the malware’s DNS-based C2 channel.
Securonix said www.xmlschemeformat.com resolved to 185.247.209.255 on May 30, 2022, supporting the malicious Office template delivery chain.
Securonix reported that www.xmlschemeformat.com and nameserver domains for updatesagent.com were registered on May 29, 2022 as part of infrastructure tied to the GO#WEBBFUSCATOR campaign.
After nearly a month of inactivity, TA416 resumed phishing activity on October 10, 2020, continuing espionage-themed targeting related to Vatican-China relations and other diplomatic entities.
Proofpoint said TA416 activity went quiet beginning September 16, 2020, starting a lull that overlapped with China’s National Day and Golden Week period.
Proofpoint reported that PlugX command-and-control IP 45.248.87[.]162, hosted by Anchnet Asia Limited, appeared active from at least August 24 through September 28, 2020.
Securonix Threat Labs disclosed a persistent Golang-based campaign tracked as GO#WEBBFUSCATOR that used phishing documents, malicious Office templates, image-steganography-like payload delivery, and DNS TXT-based command and control.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securonix.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple malware families implemented in **Go**, including a newly analyzed information stealer and a **Sofacy**-linked **Zebrocy** variant. The stealer was designed to harvest data from infected systems, while the Go-based Zebrocy samples preserved the espionage-focused behavior seen in earlier versions, including host reconnaissance, screenshot capture, and command-and-control beaconing over HTTP or HTTPS. The shift to Go mirrors a broader pattern of attackers reworking established tooling in less common languages to complicate detection and analysis. Unit 42 reported that Sofacy delivered the Go Zebrocy malware through spear-phishing chains using a malicious **`.lnk`** file disguised as a Word document and a separate Word document that retrieved a remote template with a macro. Although one LNK-based chain failed because of an incorrect hardcoded filename, the campaign exposed intended payload delivery and infrastructure. In the later chain, the macro dropped a UPX-packed Go downloader, established persistence with a **Run** registry key, and fetched an additional payload, while analysts also noted overlaps with earlier Zebrocy activity, including reused C2 patterns and beacon strings.
Aug 15, 2026
Researchers uncovered multiple malware operations using scalable builder and crypting infrastructure to deliver remote-access trojans and evade detection. Breakglass Intelligence found two unauthenticated **GoLoader** builder panels that had produced **468,349** polymorphic samples across 71 active tasks, while leaking Alibaba Cloud OSS credentials tied to a public bucket containing LNK droppers, polymorphic VBS scripts, steganographic PNG carriers, .NET loaders, and RAT payloads. The reconstructed infection chain ended with **njRAT**, and reversing its custom AES-256-ECB configuration revealed the C2 `laohe1[.]myvnc[.]com:5000`, overlapping with infrastructure previously associated with **XWorm**. The campaign was assessed with moderate confidence as operated by a Chinese-speaking actor using Simplified Chinese cryptocurrency lures. A separate Breakglass report linked **ValleyRAT** samples targeting Chinese-speaking users to a campaign that blended long-lived Hong Kong infrastructure with a likely compromised UK academic relay. One sample connected to `103.215.77[.]17:4488`, a Hong Kong-hosted server linked to dozens of related malware submissions, while another Rust loader masquerading as **Microsoft OneDrive Sync Engine** decrypted and loaded a ValleyRAT core DLL after sandbox checks; its stage-two C2 used a `govroam.cf.ac[.]uk` hostname resolving into Cardiff University space, suggesting temporary relay use through a compromised GovRoam-connected endpoint. In parallel, researchers analyzing the **FUD Crypt** malware-as-a-service platform found it packaged Windows malware with persistence, C2, and evasion features, tracked **200** registered users and **334** confirmed builds, and documented abuse of Microsoft **Azure Trusted Signing** to produce Microsoft-rooted Authenticode signatures for malicious binaries.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026