Loading story…
Proofpoint reported that phishing campaigns spoofing financial and payment brands including Interkassa, SEPA, Alfa Bank, and Raiffeisen Bank delivered the CobInt modular downloader, which it linked to the financially motivated Cobalt Gang. The lures used malicious Word documents, direct download links, and exploit documents abusing CVE-2017-8570, CVE-2017-11882, CVE-2018-0802, and CVE-2018-8174 to infect targets.
Researchers said CobInt was built as a three-stage malware framework designed to keep its initial footprint small while enabling selective follow-on compromise. A lightweight first-stage downloader fetched a main component that polled command-and-control servers over HTTPS, then loaded additional modules as shellcode decrypted into DLLs. The malware used API hashing, XOR-based obfuscation, dynamically generated URIs, and encrypted HTML-like C2 responses to frustrate analysis, while reconnaissance modules captured screenshots and collected running process names so operators could decide whether to deploy additional payloads on systems of interest.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Proofpoint published an analysis of CobInt on September 11, 2018, detailing its three-stage architecture, obfuscation methods, HTTPS command-and-control, and reconnaissance modules that captured screenshots and running process names.
On September 4, 2018, phishing emails spoofing Raiffeisen Bank used the lookalike domain ralffeisen[.]com. The campaign used a Word attachment with a relationship object to download an external VBScript containing an exploit for CVE-2018-8174, leading to execution of CobInt stage 1.
On August 16, 2018, phishing emails spoofing Alfa Bank used the lookalike domain aifabank[.]com. The campaign linked to a hosted ThreadKit exploit document that exploited CVE-2017-8570, CVE-2017-11882, or CVE-2018-0802 to execute CobInt stage 1.
On August 14, 2018, phishing emails spoofing the Single Euro Payments Area used lookalike domains sepa-europa[.]com and sepa-europa[.]info. The messages delivered a Word attachment named "sepa rules.doc" using ThreadKit exploits for CVE-2017-8570, CVE-2017-11882, or CVE-2018-0802, and some also linked directly to the CobInt downloader.
On August 2, 2018, phishing emails spoofing Interkassa used the lookalike domain inter-kassa[.]com. The campaign included one URL leading to a macro document that installed More_eggs and another linking directly to the CobInt stage 1 executable.
According to Proofpoint, Cobalt Gang appeared to stop using CobInt as a first-stage downloader around the time of Group-IB’s publication and then resumed using it in July 2018. Arbor Networks also reported renewed CobInt activity before Proofpoint’s analysis.
Proofpoint states that Group-IB released a report in May 2018 that named the malware CobInt and linked it to the financially motivated threat actor Cobalt Gang.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 76 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers reported renewed activity involving **Matanbuchus**, a **malware-as-a-service** loader sold on Russian-speaking cybercrime forums, where it has been advertised for rent at roughly **$2,500**. In observed campaigns, attackers used phishing emails carrying ZIP attachments that led victims through a multistage infection chain: an HTML file dropped another ZIP archive containing an MSI installer, which wrote a DLL and VBS file to disk and invoked `regsvr32.exe` to execute the malicious DLL. The loader then performed anti-analysis checks, created persistence through a scheduled task, and contacted command-and-control infrastructure to retrieve its next-stage payload directly in memory. Technical analyses showed that Matanbuchus uses obfuscated and encrypted strings, API hashing based on **FNV1a**, and HTTP communications to download follow-on malware while minimizing disk artifacts. Researchers linked the loader to deployments of **Cobalt Strike Beacons** and noted overlap with phishing operations involving other malware such as **Qakbot**. Reverse-engineering work also identified multiple infrastructure domains, sample hashes, and distinct loader and payload components, while updated **YARA** rules and configuration extractors improved detection of newer variants.
Aug 15, 2026
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026