Loading story…
Kaspersky reported that the Reductor Trojan, a malware family linked by code similarities to COMpfun and tentatively associated with Turla, compromised victims by patching browser and system pseudo-random number generator functions in memory. That let the malware insert encrypted, victim-specific identifiers into the TLS client_random field without altering packets directly, enabling operators to recognize encrypted sessions and potentially support interception workflows. The campaign primarily targeted users in Russia and Belarus, and Reductor also installed root certificates, supported remote certificate updates, and maintained persistence through an LSA notification package while communicating with command-and-control servers over HTTP POST using AES-128-encrypted host identifiers.
Investigators said victims were infected through trojanized software installers downloaded over HTTP from warez sites or through secondary delivery from systems already compromised by COMpfun. Kaspersky assessed that the attackers likely controlled victims’ network channels and replaced legitimate installers on the fly before delivery. The activity highlighted a stealthy persistence and traffic-marking approach consistent with techniques such as COM object hijacking and other low-visibility Windows persistence methods, underscoring how the operators combined installer tampering, certificate abuse, and in-memory browser manipulation to track and compromise protected web traffic.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky said the Reductor campaign was active from the end of April 2019 through at least August 2019, targeting victims in Russia and Belarus. Infection occurred via trojanized software installers delivered over HTTP and via already infected COMpfun hosts.
Kaspersky discovered the Reductor malware family in April 2019. The malware was later linked by code similarities to the older COMpfun Trojan and tentatively associated with Turla.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a newly observed Trojan linked by shared code to the **COMpfun** malware family and assessed with medium-to-low confidence as associated with **Turla**. The campaign targeted diplomatic entities in Europe and began with a spoofed visa application used as the initial dropper, apparently obtained from a LAN shared directory. The malware stood out for using unusual HTTP/HTTPS response codes—including `402` and `422` through `429`—as part of its command-and-control channel to queue and trigger attacker commands. Once installed, the Trojan could fingerprint infected hosts, log keystrokes, steal clipboard data, capture screenshots, propagate via USB, enumerate network resources, and maintain persistence through **COM hijacking**. It also used anti-analysis checks to detect virtual machines, debuggers, and monitoring tools, and could inject into Windows, security, or browser processes. Communications and stored data were protected with **RSA**, **AES-128**, **XOR**, and **LZNT1** compression, underscoring the malware’s technically distinctive evolution within the COMpfun toolset.
Aug 14, 2026
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026
Windows attackers have used **Component Object Model (COM) hijacking** to gain persistence by altering Registry entries so legitimate applications load attacker-controlled code during normal execution. MITRE documents the technique as `T1546.015`, noting that adversaries can replace COM object references or abuse **TypeLib** keys to redirect execution to malicious DLLs, scripts, or even remotely hosted payloads via the `script:` moniker. The approach is designed to survive reboots while blending into routine system activity, especially when attackers choose COM objects that are invoked often enough to ensure execution but not so critical that failures immediately expose the compromise. Public examples show both proof-of-concept and criminal use. A technical walkthrough demonstrated creating a user-level `HKCU\Software\Classes\CLSID\{...}\InprocServer32` entry so a process such as **Firefox** would load a malicious DLL instead of falling back to system-wide COM registrations, illustrating how COM hijacking can provide persistence and defense evasion. In the wild, the **W32.Silon** banking trojan reportedly replaced a CLSID reference for Microsoft-signed `msimtf.dll` with a malicious `msjet51.dll`, causing **Internet Explorer** to load the payload, steal online banking credentials, hide artifacts, and exfiltrate captured data to command-and-control servers.
Aug 15, 2026