Loading story…
Researchers tied the long-running Comfoo remote access trojan to broader Chinese-linked cyber-espionage activity after identifying overlaps with the Luckycat campaign and related APT operations. SecureWorks reported that Comfoo had been under continuous development since at least 2006, was previously associated with the 2010 RSA breach, and used encrypted HTTP communications, rendezvous-style command-and-control, and DNS obfuscation with dynamic DNS and bogus IP resolutions to hide active infrastructure. Trend Micro separately described Luckycat as an espionage campaign active since at least 2011 that used spearphishing emails and malicious attachments exploiting vulnerabilities including CVE-2010-3333, along with Adobe Reader and Flash flaws, to compromise targets in India, Japan, and Tibetan organizations.
The combined reporting shows a broad victim set spanning government and private-sector organizations in the United States, Europe, and Asia Pacific, as well as aerospace, energy, engineering, shipping, and military research entities. SecureWorks said it monitored dozens of active Comfoo relays, observed more than 200 malware variants and 64 campaign tags, and found the Comfoo relay server lacked authentication, allowing passive monitoring of victim logins and possible relay takeover by anyone with protocol knowledge and the static XOR key. Trend Micro said Luckycat deployed TROJ_WIMMIE and VBS_WIMMIE backdoors over HTTP port 80 and shared malware or hosting infrastructure with campaigns including ShadowNet, Duojeen, Sparksrv, and Comfoo, reinforcing links between these espionage operations.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Dell SecureWorks CTU researchers Joe Stewart and Don Jackson published an analysis of Comfoo that detailed its persistence, encrypted HTTP communications, rendezvous relay architecture, DNS obfuscation, and unauthenticated relay administration weakness.
Trend Micro published details on the Luckycat campaign, stating it had been linked to about 90 attacks in Japan and India and traced elements of the operation to hackers based in China.
Trend Micro's Luckycat Redux research described the campaign's activity and noted overlaps with Comfoo through shared malware or hosting infrastructure; SecureWorks later cited this paper as briefly mentioning Comfoo.
SecureWorks CTU said it had operated passive monitoring on dozens of active Comfoo command-and-control relays since January 2012, later observing more than 200 variants and 64 campaign tags.
Trend Micro said the Luckycat cyber-espionage campaign had been active since at least June 2011, targeting Indian military research institutions, entities in Japan, and the Tibetan community through spearphishing and exploits.
SecureWorks linked Comfoo to the 2010 RSA breach, identifying the malware family as part of that intrusion.
Dell SecureWorks CTU reported that the Comfoo remote access trojan had been in continuous development since at least 2006, marking the start of the long-running malware family covered in the analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
secureworks.com
Open sourcetrendmicro.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a newly observed Trojan linked by shared code to the **COMpfun** malware family and assessed with medium-to-low confidence as associated with **Turla**. The campaign targeted diplomatic entities in Europe and began with a spoofed visa application used as the initial dropper, apparently obtained from a LAN shared directory. The malware stood out for using unusual HTTP/HTTPS response codes—including `402` and `422` through `429`—as part of its command-and-control channel to queue and trigger attacker commands. Once installed, the Trojan could fingerprint infected hosts, log keystrokes, steal clipboard data, capture screenshots, propagate via USB, enumerate network resources, and maintain persistence through **COM hijacking**. It also used anti-analysis checks to detect virtual machines, debuggers, and monitoring tools, and could inject into Windows, security, or browser processes. Communications and stored data were protected with **RSA**, **AES-128**, **XOR**, and **LZNT1** compression, underscoring the malware’s technically distinctive evolution within the COMpfun toolset.
Aug 14, 2026
Proofpoint reported that activity tied to **TA829** and a separate cluster it tracks as **UNK_GreenSec** used overlapping phishing infrastructure and social-engineering lures, even as the two operations delivered different malware. TA829 continued deploying its established RomCom-related toolset — including `SlipScreen`, `RustyClaw`, `MeltingClaw`, `DustyHammock`, `ShadyHammock`, and `SingleCamper` — while UNK_GreenSec used the newer **TransferLoader**, which researchers linked to Metasploit and **Morpheus ransomware**. Both clusters abused compromised **MikroTik** routers as REM Proxy nodes, used freemail senders and Rebrandly redirects, and relied on landing pages themed around **OneDrive** or **Google Drive**. A follow-on infrastructure review of **109 domains** found additional overlap between the RomCom and TransferLoader ecosystems, including four TransferLoader IoC domains appearing across five typosquatting groups and shared registrar, registrant-country, nameserver, and IP patterns. Researchers said many domains were registered shortly before use, while **27 of 109** had already been flagged as likely malicious **77 to 271 days** before they were later published as IoCs. The broader artifact set also included thousands of email- and string-linked domains, dozens of related malicious domains and IPs, and recurring use of **Tucows** and **U.S.-based registrations**, reinforcing evidence of a meaningful operational relationship without conclusively proving the two clusters are the same actor.
Aug 15, 2026
Researchers tied multiple government-focused espionage campaigns to a shared malware development and logistics ecosystem built around **CMSTAR** and related tooling. FireEye’s analysis of 11 APT campaigns found common malware families, overlapping command-and-control infrastructure, reused code-signing certificates, clustered compile times, and distinctive NSIS manifest artifacts, leading to its assessment that a centralized **“Sunshop Digital Quartermaster”** supplied malware and operational support to otherwise separate intrusion groups. The report linked 110 malware binaries and 54 domains across campaigns that used families such as `Trojan.APT.9002`, **PoisonIvy**, and **Gh0st**, and described a Chinese-language **9002 Builder** that further suggested centralized tooling rather than fully independent operators. Palo Alto Networks later documented how that model appeared in real-world government targeting. In Mongolia, spear-phishing attacks used politically themed Word documents exploiting `CVE-2012-0158` and later `CVE-2014-1761` to deploy the **Cmstar** loader and **BBSRAT**, with some lures sent from compromised or likely compromised government-associated email accounts and one sample aimed at nearly 2,000 recipients. A separate campaign against Belarusian government entities used Zapad-2017-themed phishing emails, malicious RTF and macro-enabled Word files exploiting `CVE-2015-1641`, and a disguised SCR file to deliver updated **CMSTAR** variants alongside newly identified backdoors **PYLOT** and **BYEBY**. Across both cases, researchers highlighted shared infrastructure, malware lineage, and tooling overlaps that support the view that multiple espionage operators were drawing from a common malware supply chain.
Aug 15, 2026