Loading story…
Researchers disclosed SockDetour, a previously undocumented Windows backdoor used against U.S. defense contractors as a stealthy secondary implant for persistence. The malware operates filelessly and socketlessly, hijacking legitimate processes' network sockets with the Microsoft Detours library to create an encrypted command-and-control channel that is difficult to spot through host or network monitoring. Palo Alto Networks Unit 42 said at least four U.S.-based defense contractors were targeted and confirmed compromise at one organization, with compilation artifacts indicating the tool may have been in use since at least July 2019.
Unit 42 linked the activity to the China-linked TiltedTemple cluster, also tracked by Microsoft as DEV-0322, and said the campaign overlapped with late-2021 intrusions involving Zoho ManageEngine exploitation; reporting also noted possible ties to APT27 based on tactics and targeting. In one case, attackers delivered SockDetour from an external FTP server hosted on a compromised QNAP NAS device that had likely been exploited through CVE-2021-28799, the same flaw previously abused to deploy eCh0raix and associated with earlier QLocker ransomware activity, showing how vulnerable internet-facing NAS infrastructure was repurposed to support espionage operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that TiltedTemple conducted a 2021 campaign exploiting ServiceDesk Plus beginning on October 25, 2021, following earlier Zoho-related campaigns.
After first observing SockDetour on July 27, 2021, Unit 42 identified three additional defense organizations targeted with the same backdoor, bringing the total to at least four targeted contractors with one confirmed compromise.
On July 27, 2021, attackers delivered SockDetour from an external FTP server hosted on a compromised QNAP NAS device to a U.S.-based defense contractor's internet-facing Windows server. Researchers assessed the NAS may have been compromised via CVE-2021-28799 and noted it had previously been infected with QLocker ransomware.
Unit 42 observed an attack exploiting CVE-2021-28799 against QNAP HBS 3 on June 21, marking the first instance they knew of where the flaw was used to deliver eCh0raix ransomware.
Victim reports cited by Unit 42 indicated that eCh0raix operators successfully extorted ransom payments as recently as June 16, 2021.
QNAP disclosed CVE-2021-28799, an improper authorization flaw affecting Hybrid Backup Sync 3 that could allow remote attackers to log in to affected devices.
Unit 42 reported that the first sample of a combined eCh0raix ransomware variant capable of targeting both QNAP and Synology NAS devices dates to September 2020.
Unit 42 assessed from compilation timestamp evidence that the previously undocumented SockDetour backdoor may have been in use since at least July 2019, suggesting it evaded detection for more than two and a half years.
Unit 42 disclosed the previously undocumented SockDetour backdoor, describing it as a fileless, socketless implant used against U.S. defense contractors and linking the activity to the China-linked TiltedTemple cluster through overlapping infrastructure.
Unit 42 published research describing a new eCh0raix ransomware variant that targets both QNAP and Synology NAS devices and documented in-the-wild exploitation of CVE-2021-28799.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceunit42.paloaltonetworks.com
Open sourcebleepingcomputer.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Security researchers reported multiple campaigns using trojanized versions of **PuTTY** and other legitimate tools to compromise high-value users, including administrators, engineers, and technical support staff. LevelBlue said a recent malvertising operation pushed fake PuTTY installers through **Bing sponsored ads** and typosquatted domains such as `puttyy[.]org` and `puttysystems[.]com`, with a signed malicious executable creating scheduled-task persistence, dropping `twain_96.dll` and `green.dll`, and communicating with infrastructure linked to **Broomstick/Oyster** malware. In affected environments, the intrusions progressed to hands-on-keyboard activity, reconnaissance via `cmd.exe`, and **Kerberoasting** using an in-memory script derived from PowerSploit’s `Invoke-Kerberoast` to obtain RC4-HMAC Kerberos service tickets for offline cracking. Microsoft previously described a related tradecraft pattern in which North Korean state-backed **ZINC**—now tracked as **Diamond Sleet**—used social engineering on LinkedIn and WhatsApp to deliver weaponized open-source software, including **PuTTY**, **KiTTY**, **TightVNC Viewer**, **Sumatra PDF Reader**, and **muPDF**, to targets in media, defense, aerospace, and IT services across several countries. That activity deployed the **ZetaNile** malware family using DLL search-order hijacking, staged payloads, persistence, lateral movement, and data exfiltration, while separate analysis of Lazarus-linked **BLINDINGCAN** showed the group’s broader capability set for encrypted command-and-control, remote command execution, file transfer, and system discovery. Together, the reporting shows attackers repeatedly abusing trusted admin and open-source tools as malware delivery vehicles to gain persistence, steal credentials, and expand access inside victim networks.
Aug 14, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026