Loading story…
Securelist’s analysis of Trojan.Heloag found that the malware does not use peer-to-peer command-and-control as previously suspected. Instead, the examined samples rely on a straightforward TCP-based C2 protocol that lets operators launch multiple DDoS attack modes, download and execute payloads from a URL, send the infected host’s computer name, stop an active attack, and redirect bots to a new command server.
The report says the presence of multiple C2 servers is more consistent with server hand-off, load balancing, or bot rental than with decentralized resilience. Researchers also noted code inconsistencies that may indicate collaboration between two developers or reuse of external code, and assessed the malware as likely originating from China, citing coding traits and a hardcoded Chinese IP address that the bot is explicitly configured not to attack.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The same analysis assessed Heloag as very likely originating from China, citing coding characteristics and a hardcoded Chinese IP address that the malware is explicitly prevented from attacking. The author also noted code inconsistencies suggesting either collaboration between developers or reuse of purchased source code.
A Securelist analysis of Trojan.Heloag concluded that the examined samples do not implement peer-to-peer command-and-control. Instead, the malware uses a simple TCP-based command protocol with DDoS, download-and-execute, host identification, stop, and C2 hand-off functions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Hoaxcalls** malware family has been observed building a DDoS botnet by exploiting remote code execution flaws in internet-exposed **DrayTek** and **Grandstream UCM** devices. Palo Alto Networks Unit 42 reported that the malware targets **`CVE-2020-8515`** in DrayTek equipment and **`CVE-2020-5722`** in Grandstream UCM systems, allowing infected devices to be enrolled into a botnet that supports multiple flood techniques, including **UDP**, **HEX**, and **DNS** attacks. Researchers identified several Hoaxcalls variants with broadly similar capabilities but different propagation behavior: some begin exploiting vulnerable systems immediately after execution, while others wait for operator commands. The malware communicates with command-and-control servers over **IRC**, including infrastructure at **`178[.]32[.]148[.]5:1337`**, and joins the **`#hellroom`** channel using randomized nick, ident, and user strings prefixed with **`XTC|`**. The activity shows active weaponization of widely exposed edge-device vulnerabilities, increasing the urgency for organizations to patch affected systems and review exposed voice and networking appliances.
Aug 14, 2026
Researchers uncovered multiple malware operations using scalable builder and crypting infrastructure to deliver remote-access trojans and evade detection. Breakglass Intelligence found two unauthenticated **GoLoader** builder panels that had produced **468,349** polymorphic samples across 71 active tasks, while leaking Alibaba Cloud OSS credentials tied to a public bucket containing LNK droppers, polymorphic VBS scripts, steganographic PNG carriers, .NET loaders, and RAT payloads. The reconstructed infection chain ended with **njRAT**, and reversing its custom AES-256-ECB configuration revealed the C2 `laohe1[.]myvnc[.]com:5000`, overlapping with infrastructure previously associated with **XWorm**. The campaign was assessed with moderate confidence as operated by a Chinese-speaking actor using Simplified Chinese cryptocurrency lures. A separate Breakglass report linked **ValleyRAT** samples targeting Chinese-speaking users to a campaign that blended long-lived Hong Kong infrastructure with a likely compromised UK academic relay. One sample connected to `103.215.77[.]17:4488`, a Hong Kong-hosted server linked to dozens of related malware submissions, while another Rust loader masquerading as **Microsoft OneDrive Sync Engine** decrypted and loaded a ValleyRAT core DLL after sandbox checks; its stage-two C2 used a `govroam.cf.ac[.]uk` hostname resolving into Cardiff University space, suggesting temporary relay use through a compromised GovRoam-connected endpoint. In parallel, researchers analyzing the **FUD Crypt** malware-as-a-service platform found it packaged Windows malware with persistence, C2, and evasion features, tracked **200** registered users and **334** confirmed builds, and documented abuse of Microsoft **Azure Trusted Signing** to produce Microsoft-rooted Authenticode signatures for malicious binaries.
Jun 29, 2026
Researchers identified **Godlua**, a Lua-based backdoor for Linux and Windows, as one of the first malware strains observed abusing **DNS over HTTPS (DoH)** to hide command-and-control activity. The malware was linked in part to exploitation of **Atlassian Confluence** vulnerability `CVE-2019-3396` on unpatched servers, and some early samples were initially mislabeled as cryptocurrency miners before investigators tied them to distributed denial-of-service activity. Netlab reported that Godlua had already been used in attacks, including HTTP flood operations targeting **liuxiaobei.com**. Godlua uses a layered, redundant control architecture that pulls staged payloads and C2 data from hardcoded domains, **GitHub**, **Pastebin**, DNS TXT records, and encrypted DoH queries, reducing visibility for tools that rely on passive DNS monitoring. Researchers said the malware downloads files disguised as PNG images, decrypts them with **AES-CBC**, loads modified Lua bytecode directly into memory, and then executes commands that support shell access, file execution, upgrades, proxying, and further Lua-based attack logic. The use of DoH to retrieve TXT-record-based C2 locations marked a notable escalation in malware tradecraft because it can blend malicious DNS lookups into normal encrypted web traffic.
Aug 15, 2026