Loading story…
Researchers linked multiple targeted intrusions in Russia, South Korea, and Japan to the Bisonal backdoor family, also referred to in some analysis as Korlia and associated with the Operation Bitter Biscuit cluster. Unit 42 reported a previously undocumented Bisonal variant used against a defense-related company in Russia and an organization in South Korea, delivered through spear-phishing emails carrying document-themed decoys such as spoofed Rostec material and Korean Coast Guard employment files. The malware used hard-coded dynamic DNS infrastructure, HTTP POST communications over port 443, campaign tracking codes including 0425god and pmo, and backdoor functions for reconnaissance, process control, shell access, file download, execution, and file creation.
Pull IOCs and campaign context straight into your stack.
13 events from the most recent confirmed update back to the earliest known activity.
Unit 42 publicly reported the Russia and South Korea campaign, detailing the previously undocumented Bisonal variant, its RC4-encrypted C2 traffic, decoy documents, and links to a likely single long-running threat group.
Rostec published an article about housing plans for defense industry workers that attackers later copied into a decoy PDF used in the Russia-targeted phishing attack.
A public reverse-engineering writeup documented the Korlia backdoor, noted its "bisonal" marker, described its XOR-based decoder and RAT capabilities, and published related sample configuration data and YARA guidance.
Unit 42 assessed that the newer Bisonal variant later seen in attacks against Russia and South Korea had been active since at least 2014.
After confirming the vulnerability, the attackers used tools.exe to exploit MS17-010 and upload Acrobat.exe to c:\windows\tasks\conhost.exe on the Active Directory server.
At 14:26, the attackers used checkers.exe against an Active Directory server at 192.168.66.50 and determined the Windows Server 2012 R2 host was unpatched for MS17-010.
At 13:56, the attackers downloaded and ran conhost.exe to steal operating system account passwords, but the attempt failed and the tool was deleted.
At 13:51, the attackers used getwebpass.exe to try to steal credentials from Internet Explorer, Firefox, Thunderbird, Chrome, and Yandex, but no saved passwords were recovered from the infected host.
At 12:32, the attackers mapped a network drive with net use, compressed stolen files into 2 MB WinRAR archives, and uploaded them to command-and-control infrastructure.
The intrusion timeline shows attacker interaction beginning at 11:55, shortly after csrcc.exe executed on the compromised system.
The attacker dropper executed csrcc.exe on the victim host, establishing persistence via the current user's Run registry key and beginning HTTP-based command-and-control activity.
A spearphishing email carrying an ACE archive and two Word documents exploited CVE-2018-20250 to place a malicious Word add-in named word.wll in Word’s add-in folder, initiating a targeted intrusion attributed to the Operation Bitter Biscuit cluster.
In early May, attackers targeted at least one defense-related company in Russia and one unidentified organization in South Korea with a previously undocumented Bisonal variant delivered via document-themed lures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcegithub.com
Open sourcejsac.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cavalry Werewolf, an advanced persistent threat (APT) group with reported overlaps to YoroTrooper and other clusters such as SturgeonPhisher, Silent Lynx, Comrade Saiga, ShadowSilk, and Tomiris, has been actively targeting Russian state agencies and critical industries. The group has been observed deploying custom malware families, notably FoalShell and StallionRAT, in a series of sophisticated cyberattacks. According to cybersecurity vendor BI.ZONE, the attackers initiated their campaigns by sending highly targeted phishing emails that masqueraded as official correspondence from Kyrgyz government officials. These emails were crafted to deceive recipients within Russian government agencies, as well as organizations in the energy, mining, and manufacturing sectors. In some instances, the attackers compromised legitimate email accounts belonging to the Kyrgyz Republic's regulatory authority, increasing the credibility and effectiveness of their phishing attempts. The phishing emails typically contained RAR archive attachments, which, when opened, delivered the FoalShell or StallionRAT malware payloads to the victims' systems. FoalShell is a lightweight reverse shell available in Go, C++, and C# versions, enabling attackers to execute arbitrary commands via cmd.exe on compromised machines. StallionRAT, written in Go, PowerShell, and Python, provides similar capabilities, including command execution, file loading, and data exfiltration. The campaign was observed between May and August 2025, indicating a sustained and coordinated effort to infiltrate Russian public sector networks. The technical sophistication of the malware, including its multi-language implementations, suggests a well-resourced and adaptable threat actor. The use of Telegram as a command-and-control (C2) channel has also been reported, allowing the attackers to maintain covert communications and control over infected hosts. The group’s ties to Tomiris, which Microsoft has linked to a Kazakhstan-based actor known as Storm-0473, further suggest a regional nexus and possible state sponsorship. Previous related attacks by ShadowSilk targeted government entities in Central Asia and the Asia-Pacific region, using similar remote access trojans and reverse proxy tools. The ongoing campaign highlights the persistent threat posed by Cavalry Werewolf to Russian governmental and industrial targets, as well as the broader regional implications of their operations. Security researchers emphasize the importance of monitoring for phishing attempts impersonating government officials and the deployment of custom malware families like FoalShell and StallionRAT. The attacks underscore the need for robust email security, user awareness training, and advanced endpoint detection to mitigate the risk from such sophisticated APT campaigns. The incident also demonstrates the evolving tactics of threat actors in leveraging both social engineering and technical innovation to achieve their objectives. Organizations in the targeted sectors are advised to review their security postures and implement proactive threat hunting measures. The campaign serves as a reminder of the complex and dynamic nature of cyber threats facing government and critical infrastructure entities in the region.
Jun 29, 2026
North Korea-linked **Kimsuky**—also tracked as **Black Banshee**, **Thallium**, and in some reporting **APT37/CloudDragon**—has been tied to a broad espionage effort spanning credential theft, malware delivery, and infrastructure compromise. Research correlates multiple malware families including **BabyShark**, **AppleSeed**, **FlowerPower**, **GoldDragon**, **WildCommand**, **MyDogs**, and **JamBog**, linking them through shared phishing themes, command-and-control patterns, encoding routines, and overlapping infrastructure. The activity targeted South Korea most heavily, while also reaching Japan, U.S. policy and national security organizations, academia, media, defense, finance, and international bodies; separate reporting also described continued targeting of South Korean science, technology, and defense sectors through the actor’s **Blue Estimate** campaign and newly observed DLL malware and domains.
Aug 15, 2026
Russia-linked **Gamaredon**—also tracked as **Shuckworm**, **Primitive Bear**, **Trident Ursa**, and **STEADY#URSA**—conducted sustained cyber-espionage operations against Ukrainian government, military, and other public- and private-sector organizations, while also probing at least one petroleum refining company in a NATO member state. Researchers reported a sharp rise in email-borne attacks tied to the group, including a late-2022 surge against `gov.ua` subdomains and broader targeting of energy, media, financial, business, and non-profit entities. The actor increasingly used both Ukrainian- and English-language lures delivered through spearphishing emails, malicious attachments, phishing pages, and archive files to gain initial access and support intelligence collection. Across multiple campaigns, Gamaredon deployed evolving malware chains that included the **Pteranodon** backdoor, the **SUBTLE-PAWS** PowerShell backdoor, and at least eight additional custom payloads, alongside legitimate tools such as **UltraVNC** and **Process Explorer**. Intrusions used macro-enabled Word documents, remote template injection, `.lnk` shortcut files, VBS droppers, scheduled tasks, startup-folder persistence, registry `Run` keys, and repeated HTTP/HTTPS command-and-control callbacks, with some infrastructure hosted through Dynamic DNS, Telegraph pages, DNS-based retrieval, and network space linked to **AS9123 TimeWeb Ltd.** Researchers also observed USB propagation behavior, exploitation attempts for `CVE-2021-3438`, and suspicious `msiexec` activity, underscoring the group’s continued adaptation of tradecraft for long-term access and espionage in support of Russia’s war-related objectives.
Aug 15, 2026