Loading story…
Researchers detailed the UPAS Kit malware ecosystem, linking its web-based administration panel to the Rombrast malware family and showing how operators managed infected hosts, stolen data, and botnet activity. The exposed control panel, advertised on an underground forum as version 1.0.1.1, included dashboards for bot statistics, credential and FTP log collection, spreading activity, web inject logs, user management, blacklisting, and login auditing, illustrating a mature command-and-control environment built to support credential theft and bot operations.
Technical analysis of the malware tied to the panel showed that UPAS Kit functioned as a covert downloader with persistence, process injection, userland rootkit features, USB propagation, anti-VM checks, and HTTP-based C2 communications. The malware copied itself into %APPDATA% and %TEMP%, created mutexes and registry run keys derived from the system volume serial number, injected into explorer.exe or 32-bit iexplore.exe, and hooked multiple ntdll.dll functions to hide files, registry keys, and processes. Researchers also noted command support for uninstall, update, and download-and-execute actions, and compared the codebase with Kronos, finding overlapping implementation details but more advanced anti-analysis and hooking techniques in Kronos.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published a technical deep dive comparing UPAS Kit with the Kronos banking Trojan. The analysis described UPAS Kit's persistence, process injection, userland rootkit behavior, USB propagation, anti-VM checks, and HTTP-based C2, while declining to make conclusive authorship claims.
A detailed walkthrough documented Upas Kit version 1.0.1.1, also called the Rombrast C&C panel, including bot statistics, credential and FTP log collection, tasking, user management, blacklisting, and login logs. The post also noted Microsoft recognized the associated bot as part of the Win32/Rombrast family.
A user named "auroras" posted the initial advertisement for Upas Kit version 1.0.0.0 on the underground forum Exploit.in. The malware was presented as a new botnet kit later associated with the Win32/Rombrast family.
According to the referenced analysis, auroras said anti-analysis code was added quickly to evade ThreatExpert. The source states these changes were effective against ThreatExpert.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered **Auraboros C2**, a previously undocumented Brazilian remote access trojan framework whose management panel at `174.138.43[.]25:5000` was exposed on the public internet **without authentication**. The HTTP-based Express.js and Socket.io dashboard, hosted on DigitalOcean and written in Brazilian Portuguese, allowed anyone with network access to view victim metadata, command history, keylogs, browser credential theft results, and real-time operator activity. Investigators said the platform supports extensive surveillance and post-compromise actions, including screenshots, webcam capture, **live audio streaming**, Wi-Fi password extraction, file operations, shell execution, reverse SOCKS5 proxying, and over-the-air malware updates. Analysis indicated the Windows implant likely used **DLL sideloading** via `DiskIntegrityScanner.exe`, decrypted Chrome and Brave credentials with **Windows DPAPI**, and included a cookie impersonation capability alongside a self-destruct function. Despite the broad feature set, researchers found only one registered beacon tied to a Lenovo laptop in Goiânia, Brazil, suggesting the infrastructure was still in development or testing rather than large-scale deployment. The exposed server also listened on ports `1080` and `9000`, believed to support reverse SOCKS5 and beacon or stager traffic, and the operator was assessed as a Brazilian Portuguese-speaking developer whose poor operational security left the entire framework and test telemetry publicly accessible.
Jun 29, 2026
Researchers detailed how **Pikabot** has evolved into a heavily obfuscated malware loader and core backdoor that uses layered string protection, dynamic API resolution, anti-analysis checks, and stealthy process injection. Recent reverse-engineering shows Pikabot decrypts strings through per-string `RC4`, modified `Base64`, and `AES-CBC`, while newer tooling can now automate recovery of keys, IVs, and encrypted arrays from samples. Analysts said the malware disguises itself as **SearchProtocolHost.exe**, walks the PEB to locate `kernel32.dll`, hashes API names, and uses indirect syscalls such as `NtAllocateVirtualMemory`, `NtWriteVirtualMemory`, and `NtResumeThread` to inject its core module into a suspended legitimate process. The recovered functionality shows Pikabot can profile hosts, enumerate processes, execute commands, manipulate files and the registry, and communicate with command-and-control servers over **WinINet** using HTTP POST requests. Earlier loader samples also established persistence with a scheduled task and a registry-stored PowerShell downloader that fetched a DLL, decoded it from Base64, and launched it with `regsvr32`, while newer samples extracted payload components from PNG resources before decryption and injection. Reporting on distribution linked Pikabot to spam thread-hijacking campaigns, malicious attachments and links, and malvertising that impersonated **AnyDesk**, with operators using commands such as `whoami.exe /all`, `ipconfig.exe /all`, and `netstat.exe -aon` to survey compromised systems.
Aug 15, 2026
Researchers detailed **Backdoor.Win32.Plurox**, a modular Windows backdoor that gives attackers remote access, installs cryptocurrency miners and other payloads, and moves laterally across local networks. The malware communicates with hardcoded command-and-control servers over TCP, uses simple XOR obfuscation, and supports commands to download, update, delete, and manage both the core bot and its plugins. Investigators observed separate operational subnets, including one focused on miner delivery and another distributing both miners and additional modules. Plurox’s plugin architecture enabled aggressive internal-network propagation. A **UPnP** module temporarily forwarded router ports **135** and **445** to expose internal Windows services, while an **SMB** module spread using the **EternalBlue** exploit, echoing techniques associated with **UPnProxy/EternalSilence**-style abuse of exposed services. Researchers also found the SMB plugin closely resembled the `wormDll32` component from **Trojan.Win32.Trickster**, suggesting a possible code relationship between the malware families, and published command-and-control infrastructure and file hashes as indicators of compromise.
Aug 14, 2026