Loading story…
Fortinet and SANS researchers detailed a targeted spearphishing intrusion against a Jordanian diplomat and foreign ministry official that was assessed as likely linked to Iranian threat group APT34. The attack delivered a malicious Excel attachment whose macro used unusual tradecraft, including worksheet-visibility toggling, a mouse-presence check, WMI-based state check-ins, and scheduled-task persistence before dropping a .NET backdoor and related files into %LocalAppData%\MicrosoftUpdate\. Researchers said the malware’s command set indicated prior knowledge of the victim environment, supporting the assessment that the operation was a tailored espionage intrusion rather than commodity phishing.
The backdoor, identified as Saitama, used a domain generation algorithm (DGA) and DNS tunneling for command-and-control and data theft. Unlike many DNS-tunneling implants that rely on TXT records, Saitama encoded C2 instructions inside IPv4 addresses returned in DNS responses, while infected hosts split and sent exfiltrated data across multiple DNS requests. Analysis of the malware showed it could perform reconnaissance, execute commands through PowerShell and CMD, and use a mutex to avoid multiple concurrent instances; researchers also published tooling to decode Saitama’s DNS traffic and reconstruct stolen host data such as Windows version information.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
SANS ISC published an analysis of Saitama's DNS tunneling, explaining how the malware encoded commands inside IPv4 addresses rather than TXT records and showing decoded examples of exfiltrated data. The write-up also linked Saitama to the phishing attack against a Jordanian foreign ministry official and to APT34 attribution.
FortiGuard Labs disclosed technical analysis of the phishing campaign, describing the Excel macro, scheduled-task persistence, .NET backdoor, and DNS-tunneling command-and-control. The report highlighted themed domains and victim-environment reconnaissance that supported its APT34 assessment.
Two additional domains tied to the malware infrastructure, asiaworldremit.com and uber-asia.com, were registered on February 27, 2022. The report says they later resolved to 193.239.84.207 and 127.0.0.1 respectively before both were pointed to 127.0.0.1.
The command-and-control domain joexpediagroup.com used in the campaign was created on January 20, 2022. The report says it previously resolved to 45.11.19.47 before later resolving to 127.0.0.1.
After analyzing Saitama's code, Morphus Labs created a tool called saitama_translator to decode or reconstruct messages exfiltrated by infected hosts through DNS queries. The tool was made available through a GitHub repository referenced in the analysis.
A phishing email impersonating an IT colleague targeted a diplomat in Jordan and delivered a malicious Excel attachment named "Confirmation Receive Document.xls." FortiGuard Labs assessed the intrusion as likely linked to APT34 and designed to steal sensitive information from the victim's Windows system.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iranian state-backed threat group APT42, also known as Charming Kitten and Educated Manticore, has launched a sophisticated cyberespionage campaign dubbed SpearSpecter, targeting high-profile defense and government organizations as well as their officials and family members. The campaign leverages weeks-long social engineering lures via WhatsApp to gain initial access, followed by credential theft through redirection to fake meeting pages. For long-term persistence, the attackers deploy a fileless PowerShell-based backdoor named TAMECAT, which enables command execution, reconnaissance, file harvesting, and browser data exfiltration. The campaign demonstrates advanced operational security and agility, with infrastructure designed for prolonged espionage against high-value targets. Researchers note that TAMECAT's capabilities allow attackers to maintain stealth and flexibility, executing further PowerShell code and adapting their operations based on their objectives. The Israel National Digital Agency highlighted that these attacks are distinct from previous APT42 campaigns, reflecting a continuous evolution in tactics. The campaign's focus on defense and government entities underscores the persistent threat posed by Iranian cyber operations to critical infrastructure and sensitive sectors worldwide.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Cisco Talos reported a targeted phishing campaign that impersonated U.S. Securities and Exchange Commission EDGAR notifications to deliver **DNSMessenger**, a multi-stage malware family that used malicious Microsoft Word documents for initial access. Instead of relying on macros, the lure documents abused **Dynamic Data Exchange (DDE)** to trigger obfuscated PowerShell, reflecting the broader macro-less code execution technique documented by SensePost for Microsoft Word. Talos said the campaign selectively targeted organizations and staged payload delivery through attacker-controlled infrastructure, including a compromised Louisiana state government server. Once executed, DNSMessenger established persistence through multiple mechanisms, including registry **Run** keys, scheduled tasks, alternate data streams, and **WMI** event consumers, before shifting command-and-control traffic into DNS. Talos said the malware used DNS **A** and **TXT** record queries as a covert bidirectional channel to retrieve later-stage payloads, launch `cmd.exe`, and exchange commands and output using structured **SYN**, **MSG**, and **FIN**-style messages. Researchers linked the activity to earlier DNSMessenger operations seen in 2017 and highlighted its obfuscation, fileless PowerShell execution, and selective payloading as signs of a sophisticated intrusion set.
Aug 15, 2026