Loading story…
Hancitor resurfaced in large email-driven malware campaigns with updated delivery and execution techniques, moving from malicious Word macro attachments to a brief use of RTF files exploiting CVE-2017-11882. Early campaigns used invoice- and billing-themed lures to deliver Word documents whose VB macros decoded embedded shellcode, allocated executable memory through Windows API calls, extracted an encrypted Hancitor payload hidden inside the document, and installed it with persistence as WinHost.exe. Proofpoint also linked Hancitor’s return to a Vawtrak affiliate using botnet IDs 80, 81, and 82, with campaigns primarily targeting U.S. financial organizations and some victims in Canada and the UK.
Researchers reported that Hancitor’s operators repeatedly refreshed the malware’s internals, including a revised command-and-control protocol, in-memory DLL execution, and delivery of additional payloads such as Pony and Vawtrak. In a later campaign, the malware used shellcode and PowerShell launched via the Office Equation Editor flaw to drop a new packer featuring anti-debugging, anti-disassembly, memory-permission changes, and a custom RC4-like unpacking routine before restoring the standard Hancitor payload. Once active, Hancitor collected host details, checked the victim’s external IP through api.ipify.org, and prepared POST requests to multiple gate.php command-and-control endpoints recovered from encrypted configuration data.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On January 24 and 25, 2018, researchers observed a Hancitor campaign using RTF documents exploiting CVE-2017-11882 instead of the malware family's usual macro-enabled Word documents. The exploit launched shellcode and PowerShell that dropped a PE file containing a new packer before restoring the standard Hancitor payload.
After relative quiet since a major campaign in June 2016, researchers observed a renewed uptick in Hancitor delivery through email-borne Word documents with VB macros. The campaign used invoice, billing, receipt, contract, and overdue-payment lures and generated more than 380,000 observed sessions during the week discussed.
On May 4, the same Vawtrak actor was observed using a new version of the Ruckguv downloader delivered via malicious Word macro documents. The updated Ruckguv downloaded Pony and Vawtrak and changed its payload retrieval and file-writing behavior.
Starting on April 28, a Vawtrak actor associated with botnet IDs 80, 81, and 82 began using an updated Hancitor downloader in malicious Word macro email campaigns. The updated loader downloaded Pony and Vawtrak and introduced changes including a revised C2 protocol and in-memory DLL execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 88 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
0ffset.net
Open sourceresearchcenter.paloaltonetworks.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourceproofpoint.com
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hancitor, also tracked as **Chanitor** and associated with **TA511/MAN1**, remained a persistent Windows malware loader delivered through phishing emails that lured users to malicious Word or Excel documents. The campaign shifted from direct malicious attachments to links hosted on compromised websites, fraudulent hosting accounts, and services such as Google Drive or Google Feed Proxy to evade mail filtering. Once macros were enabled, Hancitor profiled the host, checked external IP information, contacted command-and-control servers over HTTP, and commonly used recurring URI patterns such as `/8/forum.php`; researchers also documented hard-coded fallback C2 infrastructure and second-stage payloads hosted on compromised business websites. Intrusions tied to Hancitor showed it functioning as an initial-access malware that frequently delivered **Cobalt Strike**, **Ficker Stealer**, **Pony**, **NetSupport Manager RAT**, spam bot malware, and other follow-on tools. Incident reports described operators using Hancitor infections for rapid post-exploitation, including network discovery, SMB-based lateral movement, remote service execution, attempted access to `lsass.exe`, and in one case exploitation of **Zerologon** (`CVE-2020-1472`) to reach domain administrator privileges in under an hour. Multiple technical analyses also detailed Hancitor’s layered obfuscation, RC4- and XOR-based decoding, task parsing, and code injection into `svchost.exe`, underscoring its role as a mature malware delivery platform rather than a standalone payload.
Aug 15, 2026
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Researchers reported renewed activity and fresh analysis of **Hworm**—also tracked as **Houdini** and **njRAT**—showing the long-running remote access trojan continuing to evolve from earlier Delphi-based campaigns into newer fileless delivery chains. Earlier campaigns used self-extracting archives with Middle East and Mediterranean political lures and decoy content while the malware ran in the background, and researchers tied some development to semi-public builder tooling and a Delphi rewrite discussed in underground forums. The malware family supports broad remote administration functions including keylogging, screenshot capture, file management, browser password theft, persistence, and process injection. Recent analysis described a VBScript-based injector that uses **DynamicWrapperX**, base64-encoded components such as `DCOM_DATA`, `LOADER_DATA`, and `FILE_DATA`, and forced execution through 32-bit `wscript.exe` on 64-bit Windows systems before injecting the final payload into `msbuild.exe`. Across samples, Hworm/njRAT established persistence through the Windows **Run** registry key and copied itself into user-accessible paths, while command-and-control shifted from older HTTP-style traffic to mixed binary-and-ASCII TCP communications. Analysts also identified embedded configuration data including mutex values, installation paths, ports, and C2 infrastructure such as `chroms.linkpc.net` and `85.26.235.163:7777`, alongside anti-analysis checks for tools including Wireshark, Process Hacker, dnSpy, Sandboxie, and VMware or VirtualBox services.
Aug 15, 2026