Loading story…
A technical appendix on the Moonlight Maze intrusions details how operators used a broad toolkit during attacks routed through the HRTest relay, combining custom malware with modified public exploit code across SunOS SPARC and IRIX MIPS systems. The material catalogs 45 binaries and 9 scripts used for reconnaissance, privilege escalation, covert communications, credential theft, and exfiltration support, showing a mature and adaptable intrusion capability rather than isolated use of single-purpose tools.
The toolkit included LOKI2-derived ICMP backdoors, tcpdump/libpcap-based sniffers, X11 keylogging, and utilities designed to erase evidence by cleaning utmp, wtmp, and lastlog records. Repeated operational patterns included use of /var/tmp task files for command-and-control, while multiple variants—such as ETAR1, SPTAR, LUTAR, IMI, IMTAR, ITDN, STDN, and STR—showed iterative development and porting between Solaris and IRIX environments; the appendix also notes Russian-derived naming and broken-English strings that point to ongoing operator customization of the toolchain.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The report analyzes artifacts from Moonlight Maze intrusions conducted through the “HRTest” relay during 1998–1999. It documents the operators’ use of custom malware, modified public exploit code, and scripts across compromised systems.
The report states that Moonlight Maze intrusions began as early as 1996 and targeted U.S. military and government organizations. Named victims included Wright Patterson Air Force Base, Kelly Air Force Base, the Army Research Lab, Naval Sea Systems Command in Indian Head, NASA, and Department of Energy laboratories.
A forensic analysis of archived Moonlight Maze artifacts concluded that the campaign likely evolved into the modern Turla threat actor through a shared LOKI2-derived Unix/Linux malware lineage, with Storm Cloud as a probable bridge. The report also revised earlier understanding of Penquin Turla, assessing it as derived from LOKI2 rather than cd00r.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026
A series of DFIR case studies documented how attackers are increasingly relying on living-off-the-land techniques, uncommon runtimes, and legitimate administration tools to maintain access while evading detection. On Windows, investigators dissected a PHP backdoor that used `php-win.exe`, a scheduled task named **ClockLauncher**, and a **ClockSystemService** service to fetch and execute second-stage code invisibly; a separate intrusion used mailbombing and Microsoft Teams vishing to deliver a modular **Deno**-based RAT and proxy that persisted via the `HKCU\Run` key and communicated over WebSocket infrastructure hosted behind CloudFront. Another investigation traced a malicious `.lnk` file to a WebDAV-hosted **Remcos** payload cached under `TfsStore\Tfs_DAV`, while repeated compromises of a vulnerable **Kentico CMS** server led to webshell deployment, SEO spam, PowerShell-based payload retrieval, and installation of a malicious IIS module, **HTTPCacheLog**, that accepted commands through HTTP cookies. On Linux and cloud infrastructure, researchers showed how attackers abused both commodity malware and stealthier post-exploitation tooling. TeamTNT-linked activity used **tmate** as a covert backdoor on Linux servers, often without normal login traces, while analysis of the **REPTILE 2.0** rootkit loader showed it bypassing `insmod` by decrypting an embedded kernel module and loading it directly with the `init_module` syscall. A separate **Sysrv** botnet infection established cron persistence, masqueraded as `kthreaddk`, and included exploitation and brute-force features for propagation. In AWS, an extortion actor deleted S3 buckets and supplied a fake Linux “recovery” binary that merely simulated restoration rather than recovering cloud data. Across the investigations, defenders were urged to hunt for recurring artifacts such as scheduled tasks, Run keys, suspicious services, unusual binaries in user-writable paths, outbound SSH or WebSocket traffic, and syscall-level module loading, using telemetry and tools including **Velociraptor**, AutoRuns, Sysmon, and CloudTrail.
Aug 1, 2026
An Iran-linked espionage cluster tracked as **Greenbug** and **OilRig/APT34** targeted telecommunications providers in South Asia while relying on a broader toolkit built for stealthy persistence, credential theft, and covert command-and-control. Symantec reported intrusions spanning at least April 2019 to April 2020 in which attackers used email lures and malicious `CHM` and `HTA` files for initial access, then moved through victim networks with tools including **Covenant**, **Cobalt Strike**, **Mimikatz**, **Plink**, **Bitvise**, **PowerShell**, **BITSAdmin**, and webshells. In one intrusion that lasted about six months, the operators focused on harvesting credentials, maintaining privileged access, tunneling into internal systems, and testing access to database servers inside telecom environments. Multiple reports tie that activity to established OilRig tradecraft, including Exchange-focused `.NET` webshells planted under `/owa/auth/`, scheduled-task persistence, and extensive use of **DNS tunneling** to hide C2 and exfiltration traffic. Unit 42 and IronNet described tools such as **ISMAgent**, **Helminth**, **ALMACommunicator**, **BONDUPDATER**, **QUADAGENT**, and **PoisonFrog**, which encoded tasking and stolen data into crafted DNS subdomains and used `A`, `AAAA`, or `TXT` responses to pass commands. NSFOCUS said a leaked APT34 toolkit exposed PowerShell RATs, webshells, the **Webmask** DNS/HTTP hijacking tool, and more than 12,000 weak passwords, while earlier ClearSky reporting showed Greenbug delivering **ISMAgent** through an Office exploit for `CVE-2017-0199` and `certutil.exe`-decoded payloads, underscoring a long-running pattern of low-profile access operations and intelligence collection.
Aug 15, 2026