Loading story…
Researchers identified a politically aligned Emmenhtal campaign that used conference-themed lures to target organizations in the European energy sector. Around mid-October, attackers sent .lnk files, likely through spear phishing, themed around the 21st Gas Infrastructure Europe conference in Munich. The shortcut files launched PowerShell and mshta.exe, which retrieved an HTA payload hidden in the padding of a legitimate PE file hosted on attacker-controlled infrastructure. The infection chain then displayed a decoy PDF while deploying a malicious DLL known as Edam Dropper.
Edam Dropper established persistence through a Windows Run registry key and downloaded a final payload from a separate command-and-control server. The infrastructure supporting the operation was hosted on compromised WordPress sites in Ukraine and Poland and disguised as conference-related content. The activity stands out from Emmenhtal’s more common role in financially motivated malware delivery, including commodity infostealers, and researchers said the targeting and tradecraft may link the operation to Sandworm / APT44, which has a known interest in European energy networks.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers monitoring new Emmenhtal activity identified a politically aligned campaign that diverged from the loader's usual commodity-infostealer distribution. The chain delivered a malicious DLL dubbed Edam Dropper and the activity was assessed as possibly linked to Sandworm/APT44.
Orange Cyberdefense published research describing Emmenhtal as a little-known loader used to distribute commodity infostealers on a global scale. This established the loader's more typical financially motivated use prior to the later politically aligned activity.
Around mid-October, attackers used Emmenhtal in a campaign themed around the 21st Gas Infrastructure Europe conference in Munich, likely targeting organizations in the European energy sector. The infection chain used LNK lure files, likely delivered via spear phishing, and infrastructure disguised as conference-related content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported coordinated spearphishing activity targeting energy, oil and gas, electronics, and related supply-chain organizations, with notable focus on South Korean firms and entities in the UAE and Qatar. The lures impersonated legitimate business correspondence using spoofed or typosquatted email accounts and referenced real tenders, RFQs, procurement documents, executives, and major projects such as **ADNOC** and **Doha airport** work to increase credibility. The emails delivered malicious `IMG`, `ISO`, `CAB`, `PDF`, `ZIP`, and .NET loader chains, often hosted through legitimate services including **WeTransfer** and **Mega**, to install information-stealing malware such as **AZORult**, **Agent Tesla**, **Formbook**, **Loki**, and **Snake Keylogger**. Researchers said the malware was used to steal credentials, banking and browsing data, and keystrokes, while some samples used fileless execution, anti-analysis checks, and process hollowing to evade detection; one campaign also appeared to target suppliers as a path to compromise trusted downstream business relationships.
Aug 15, 2026
Attackers turned a single **ClickFix** social-engineering lure into a multi-stage Windows intrusion that abused `pcalua.exe` to launch `mshta.exe`, retrieve an HTA payload, and install malware that progressed through loaders and remote-access tooling. Reporting describes a chain involving **EtherHiding** infrastructure and **GULoader**, while Huntress documented a related intrusion in which an MSI dropped **Potemkin**, a custom x64 loader that used a deterministic 10,000-domain DGA to find command-and-control servers and reflectively load a follow-on DLL called **RMMProject** entirely in memory. RMMProject provided browser credential and cookie theft, a Chrome App-Bound Encryption bypass via helper DLL injection, hidden-desktop remote control, process injection, screenshot capture, and runtime module loading. The operators then established persistence with Run keys, scheduled tasks, and a renamed **Cloudflare Tunnel**, and deployed **EtherRAT**, a Node.js backdoor that resolved its C2 from an Ethereum smart contract. Huntress said the attackers conducted hands-on-keyboard activity, repeatedly battled Microsoft Defender, attempted to deploy **Chisel** reverse SOCKS tunnels, and used **WinRM**, **WMIExec**, and **SMBExec** for lateral movement, spreading EtherRAT to more than 11 hosts including the domain controller. The intrusion showed how an unmonitored initial endpoint allowed hours of attacker activity before defenders had telemetry, enabling a single user action to escalate into a network-wide compromise.
Jul 12, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026