Loading story…
Researchers linked multiple campaigns to the StrongPity espionage group after attackers intercepted software downloads and replaced legitimate installers with trojanized packages. In one campaign, users searching for encryption and privacy tools such as WinRAR and TrueCrypt were redirected to malicious sites including ralrab[.]com and true-crypt[.]com, while compromised or abused distributor sites such as winrar[.]be and winrar[.]it helped deliver infected installers. The activity heavily affected users in Italy, Belgium, and Turkey, with additional victims across Europe, North Africa, and the Middle East.
A later operation reused a man-in-the-middle delivery method previously associated with FinFisher, but served Win32/StrongPity2 instead through an unusual HTTP redirect chain consistent with likely ISP-level interception. ESET reported code and operational overlaps with earlier StrongPity malware, including shared obfuscation, similar configuration structures, use of libcurl 7.45, and comparable file-exfiltration behavior. The malware deployed droppers, backdoors, keyloggers, and data stealers, and showed particular interest in systems running tools tied to encrypted communications, including PuTTY, WinSCP, FileZilla, mstsc, and mRemoteNG.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
ESET reported that Win32/StrongPity2 shared code, configuration structure, obfuscation, libcurl usage, and exfiltration behavior with malware attributed to StrongPity. ESET also published indicators of compromise, malicious infrastructure, persistence details, and cleanup guidance.
On 8 October 2017, ESET observed the campaign reappear in one of the previously affected countries, but now distributing Win32/StrongPity2 instead of FinFisher. The operation used the same unusual HTTP redirect structure to send users seeking legitimate software to fake download sites.
ESET telemetry indicated that the previously documented FinFisher campaigns in two countries terminated on 21 September 2017. ESET said those earlier campaigns showed strong indicators of ISP-level involvement.
From mid-July to early September 2016, visitors from tamindir.com were redirected to the attacker-controlled fake TrueCrypt site true-crypt.com. The redirects were focused mainly on systems in Turkey, with some victims in the Netherlands.
The Belgian WinRAR distributor site winrar.be began redirecting visitors to the typosquatted malicious domain ralrab.com, where StrongPity-hosted installers were delivered. Victims redirected through this path were overwhelmingly located in Belgium.
StrongPity began serving trojanized WinRAR executables directly from the Italian distributor site winrar.it. The activity primarily affected users in Italy.
Deployment of poisoned TrueCrypt installers resumed in May 2016 after earlier sightings in Turkey. The campaign used the fake site true-crypt.com to distribute trojanized installers.
In 2016, StrongPity conducted a broader watering-hole and poisoned-installer campaign targeting users seeking encryption-related software such as WinRAR and TrueCrypt. The operation infected more than 1,000 systems, with major impact in Italy, Turkey, Belgium, Algeria, and France.
A third system was recorded receiving the malicious TrueCrypt file in January 2016. The activity was tied to the fake TrueCrypt distribution infrastructure used by StrongPity.
Telemetry recorded a malicious TrueCrypt file associated with StrongPity on two systems in Turkey in December 2015. This is the earliest dated activity described for the campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **StrongPity** espionage group expanded beyond its established Windows malware operations by deploying Android backdoors for the first time, according to research linking the mobile samples to the actor through shared code structure, modular design, file collection behavior, and command-and-control infrastructure. The Android malware was distributed through repackaged legitimate applications, fake apps, and compromised websites, showing that the group was testing multiple infection paths while broadening its surveillance capability to mobile devices. Researchers reported at least two Android trojan variants, with the newer version adding more message types, accessibility and notification components, SQLite-based local storage, service execution triggered by `ScreenReceiver`, and the ability to invoke root-level access via `su` on compromised devices. Infrastructure tied to domains such as `upn-sec3-msd[.]com` and `networktopologymaps[.]com`, along with earlier reporting on **PROMETHIUM/StrongPity** activity, indicates the group was extending its global reach while building modular tooling designed to collect victim data through downloadable components.
Aug 14, 2026
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
ESET reported that the **StrongPity** espionage group targeted Android users by distributing trojanized versions of legitimate messaging applications, including **Signal** and a modified **Telegram** build, through attacker-controlled websites that mimicked official download pages. The campaign relied on users sideloading the apps outside official stores, allowing the spyware to masquerade as functional software while gaining access to sensitive mobile data. Once installed, the Android malware could collect a wide range of information from infected devices, including SMS messages, call logs, contact lists, and stored files, and it could also record phone calls and ambient audio. The operation extended StrongPity’s long-running espionage activity from Windows into mobile platforms, underscoring the group’s focus on covert surveillance of individuals through fake app distribution and broad device-level data theft.
Jul 12, 2026