Loading story…
Palo Alto Networks Unit 42 reported that attackers used an updated Cardinal RAT in targeted intrusions against Israel-based financial technology companies, particularly firms involved in forex and cryptocurrency trading. The malware sample identified as version 1.7.2 kept core remote-access functions including command execution, reverse proxying, password recovery, screenshot capture, and the ability to download additional payloads, giving operators broad post-compromise control over victim systems.
Researchers said the newer Cardinal RAT variants added stronger obfuscation, including steganography through an embedded BMP file, XOR decryption, and renaming of functions and variables with MD5 hashes. Unit 42 also found possible links to the EVILNUM malware family after both threats appeared at the same customer and in another overlapping submission tied to similar finance-sector lure themes, although differences in delivery methods and infrastructure prevented confirmation that the same operator was behind both campaigns.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported on Cardinal RAT in 2017, describing it as a low-volume malware family delivered via Carp Downloader.
Researchers found EVILNUM samples submitted by the same customer in a similar timeframe as Cardinal RAT, and another case where both malware families were submitted by the same organization on the same day. Based on overlapping victimology and these submission links, Unit 42 assessed a possible relationship between Cardinal RAT and EVILNUM, while noting a common operator could not be confirmed.
Unit 42 later discovered a series of attacks using an updated version of Cardinal RAT. The observed campaigns targeted financial technology organizations, primarily Israel-based firms involved in forex and cryptocurrency trading.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 145 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers ran a large-scale cryptocurrency theft campaign built around **ElectroRAT**, a custom Golang remote access trojan hidden inside trojanized apps branded as **Jamm**, **eTrade**, and **DaoPoker**. The malware was distributed through dedicated websites, fake company fronts, forum accounts, social media personas, and paid promotion, targeting users on **Windows, Linux, and macOS**. Researchers said the operation had been active since at least January 2020 and likely reached thousands of victims, based in part on roughly **6,500 unique visitors** to Pastebin pages used to retrieve command-and-control details. Once installed, ElectroRAT ran covertly in the background as **`mdworker`** and gave operators broad surveillance and theft capabilities, including keylogging, screenshot capture, file upload and download, and remote command execution. The campaign’s infrastructure also showed ties to **Amadey** and the **KPOT** stealer, suggesting overlap with established criminal tooling, while the custom malware itself reportedly evaded antivirus detection for nearly a year. The operation highlights how convincing crypto-themed brands and cross-platform Electron applications were used to lure investors into installing malware that enabled wallet compromise and broader system access.
Aug 15, 2026
Cisco and Palo Alto researchers detailed multiple intrusion campaigns that relied on evasive malware to establish persistence and hide command-and-control traffic, including **ObliqueRAT**, **GoldMax**, **NimzaLoader**, and the **SUNBURST** backdoor tied to the SolarWinds Orion supply-chain compromise. In the SolarWinds intrusion, attackers distributed a trojanized, digitally signed Orion update that deployed **SUNBURST**, which masked its communications as legitimate Orion Improvement Program traffic and was later used to deliver follow-on payloads such as **TEARDROP** and customized **Cobalt Strike BEACON** implants. Cisco Talos also reported that **Transparent Tribe** revived **ObliqueRAT** in campaigns aimed largely at organizations in South Asia, using malicious Office documents to retrieve payloads concealed in BMP image files hosted on hijacked websites. Researchers said newer ObliqueRAT variants added anti-analysis features, screenshot and webcam capture, removable-drive file theft, and updated persistence methods, while Cisco’s broader threat review noted that **GoldMax** used encrypted per-implant configuration and decoy traffic, and **NimzaLoader** used phishing emails, fake PDF-preview links, JSON-based communications, and process injection to deliver second-stage access.
Aug 15, 2026
Researchers attributed an ongoing cyber-espionage campaign to **DeathStalker** with high confidence, saying the group has targeted foreign exchange and cryptocurrency trading companies since at least Q2 2020 using its **VileRAT** toolchain. The intrusion chain evolved over time from spear-phishing emails carrying malicious Google Drive-hosted shortcut files to email- and chatbot-delivered `DOCX` documents that retrieved macro-enabled `DOTM` remote templates, ultimately deploying **VileDropper**, **VileLoader**, and the Python-based **VileRAT** remote access trojan. The operators repeatedly refined the malware to evade detection and frustrate analysis, using techniques including **VBA stomping**, XOR-encoded data hidden in Office objects, JavaScript anti-analysis checks, multi-stage in-memory loading, and Python bytecode obfuscation intended to break decompilers. Investigators also linked the activity to a large infrastructure footprint involving hundreds of domains and IP addresses, many associated with **AS42159 (DELTAHOST UA)** in the Netherlands from late 2021 onward, and said a rise in related samples and infrastructure from March 2022 pointed to intensified compromise attempts against less mature organizations.
Jul 12, 2026