Loading story…
Researchers documented fresh ZeroAccess (also known as Sirefef, 0Access, ZAccess, Max++, and Smiscer) samples that remained in contact with active command-and-control infrastructure and used stealth techniques to persist on infected Windows systems. The malware was distributed through lure filenames posing as free videos, pornography, Flash Player updates, and generic readme executables, then injected a hidden library into Explorer.exe and stored components in concealed paths such as RECYCLER and $Recycle.Bin. Analysts reported that common cleanup tools struggled to expose the infection after compromise, requiring memory extraction of the hidden DLL to recover artifacts tied to filesystem manipulation, cryptographic functions, and peer-to-peer components such as p2p.32.dll.
Reverse-engineering references describe ZeroAccess as an advanced rootkit platform built around a user-mode dropper, a kernel-mode stealth driver, and process injection, with operators using it to silently install additional malware including FakeAV and potentially credential- or finance-theft payloads. Network captures from one infected host showed communications with numerous external IP addresses, including 81.17.26.187 and 67.81.86.2, consistent with the botnet's peer-to-peer activity, while antivirus detections identified the samples under names such as ZAccess, Sirefef, Kryptik, and generic trojan labels. Supporting analysis also linked parts of the malware's hosting and origin infrastructure to Ecatel and alleged ties to the Russian Business Network (RBN).
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
VirusTotal analysis dated 2012-12-26 showed at least two of the December 2012 ZeroAccess samples were each detected by 14 antivirus engines, including one sample with MD5 251a2c7eff890c58a9d9eda5b1391082 and another with MD5 a2611095f689fadffd3068e0d4e3e7ed. The detections labeled the files as ZAccess, Sirefef, Kryptik, or generic trojans.
During analysis of the 2012 samples, the malware was found to inject a hidden library into Explorer.exe, and the analyst used GMER and LordPE to carve the DLL from memory after TDSS Killer, Avast Rootkit utility, and RootRepeal failed to detect or remove it. Strings from the dumped DLL indicated ZeroAccess peer-to-peer functionality and hidden storage paths under RECYCLER and $Recycle.Bin.
A fresh batch of five ZeroAccess/Sirefef samples was analyzed, and the infected host was observed communicating with numerous external IPs consistent with active peer-to-peer command-and-control activity. The malware used lure filenames themed around pornography, free videos, Flash Player updates, and generic readme executables.
The tutorial analysis cited in the Contagio post said further analysis and network forensics linked ZeroAccess hosting and origin infrastructure to the Ecatel Network and associated it with the Russian Business Network. This represented an attribution-related finding about the malware’s supporting infrastructure.
A Contagio post highlighted Giuseppe Bonfa’s four-part reverse-engineering tutorial on ZeroAccess/Max++/Smiscer, covering the user-mode dropper, kernel stealth driver, process injection, and tracing the malware’s origins. The post also stated that ZeroAccess was being used as a stealth platform for FakeAV and potentially credential- or financial-theft payloads.
A 2011 ZeroAccess sample named "MaxRootkit_2011_1.exe" was submitted to VirusTotal and detected by 25 of 43 antivirus engines. Multiple vendors classified it as Sirefef, Trojan, dropper, worm, or FakeAlert malware.
An earlier ZeroAccess/Max++ installer sample, "Max++ downloader install_2010.exe," was submitted to VirusTotal, where it was detected by 40 of 43 antivirus engines. The sample was described as being distributed via FakeAV campaigns including Antivirus2010.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 181 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
contagiodump.blogspot.com
Open sourcecontagiodump.blogspot.com
Open sourceresources.infosecinstitute.com
Open sourceresources.infosecinstitute.com
Open sourceresources.infosecinstitute.com
Open sourceresources.infosecinstitute.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zloader, a **ZeuS-derived banking trojan** that steals browser data, cookies, passwords, screenshots, and other host information, was used in multiple campaigns that combined layered delivery chains with strong evasion and persistence. Researchers documented malspam operations using **MHTML attachments**, password-protected XLS files, VBA and XLM macros, and `rundll32.exe`, as well as a later campaign that used the legitimate RMM tool **Atera** for initial access. In that operation, attackers weakened Microsoft Defender, disabled investigation tools, and abused a weakness in **Microsoft Authenticode** by appending malicious script content to Microsoft-signed DLLs while preserving a seemingly valid signature, then launching the script with `mshta.exe` and executing Zloader through `regsvr32.exe`. Across samples, Zloader commonly injected its core payload into a suspended `msiexec.exe` process, stored encrypted configuration data, and maintained persistence through Startup-folder scripts and Windows Run keys. Technical analyses showed Zloader evolving into a **modular malware platform** with anti-analysis features including encrypted strings, runtime API resolution, filename checks, process injection, and heavy **API hammering** that can generate more than a million file or registry-related calls before payload execution. Newer variants retained RC4-encrypted configuration data but added revised domain-generation logic and network protections using **RSA**, **RC4**, and Zeus BinStorage-style encryption over HTTP POST. Microsoft, ESET, Lumen Black Lotus Labs, Palo Alto Networks Unit 42, and others later disrupted three Zloader botnets by seizing **65 active command-and-control domains** and **319 DGA-generated domains**, while reporting that the malware had been tracked since 2019 across roughly **14,000 unique samples** and more than **1,300 C2 servers**, with some affiliates tied to **DarkSide ransomware**, **Cobalt Strike**, **Raccoon infostealer**, and large victim populations in North America.
Aug 15, 2026
Researchers linked an exposed directory on infrastructure in Kazakhstan to a credential-stealing malware operation built around a heavily obfuscated **SectopRAT**/**ArechClient2** variant. The investigation tied suspicious IP overlap to malware samples that unpacked through a multi-stage chain involving legitimate Microsoft-signed binaries, a QSetup-based installer, an AutoIt stage, and a final obfuscated .NET payload. The malware checked for **Avast** and **AVG** processes, reconstructed and launched a legitimate **AutoIt3** executable, injected code into `jsc.exe`, and communicated with command-and-control infrastructure over TCP port `15647`. Recovered functionality and strings indicated the payload fingerprints infected systems and steals credentials and other sensitive data. The campaign was also linked to fake software download pages promoted through **Google Ads**, including a malicious **OBS** installer archive, and researchers estimated the operation may have affected more than **18,000** victims based on files found in the exposed log directory. Separate analysis of newer SectopRAT samples showed the malware had evolved its evasion and communications methods by moving the real command-and-control address out of the class previously used for static extraction, replacing it with `127.0.0.1`, and adding new configuration fields such as a **build ID** and an encryption key for command-and-control traffic. One analyzed sample identified itself as **Build 3**, indicating continued development of the malware family.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026