Loading story…
The Morto (Worm:Win32/Morto.A) malware spread by brute-forcing administrator credentials over Remote Desktop Protocol on port 3389, allowing it to move laterally across Windows systems on the same subnet. After gaining access, it installed a malicious clb.dll in the Windows directory, abused DLL search order hijacking through regedit and service DLL loading, stored encrypted code under HKLM\SYSTEM\WPA, and imported registry changes designed to weaken UAC protections and force rundll32.exe to run with elevated privileges.
Analysis of samples showed the worm contacting domains including jifr.info, jifr.co.cc, jifr.co.be, qfsl.net, qfsl.co.cc, and qfsl.co.be, as well as IP addresses such as 210.3.38.82 and 111.68.13.250, to retrieve additional components including a file identified as 160.rar. The malware created temporary executables in C:\WINDOWS\Temp using the ~MTMP####.exe pattern, performed DNS lookups through numerous external resolvers, terminated security-related processes, cleared Windows event logs, and could be instructed to launch denial-of-service attacks against attacker-selected targets.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
The analysis recorded qfsl.net resolving to 111.68.13.250 in Hong Kong and stated that this infrastructure issued orders for a DDoS test, with observed traffic to Google infrastructure returning HTTP 400 errors.
An analysis of a Morto/Tsclient sample described its dropped clb.dll payload, use of external DNS resolvers, contact with jifr and qfsl infrastructure, and retrieval of additional components including 160.rar from 210.3.38.82.
Microsoft documented Worm:Win32/Morto.A as an RDP-brute-forcing worm that installs clb.dll, spreads laterally over TCP 3389, downloads updated components, and can perform attacker-directed denial-of-service attacks.
A DLL analyzed as part of the Morto malware chain carried a PE compile timestamp indicating it was built on 2011-08-23 08:34:14.
The domain jifr.net, later associated with Morto infrastructure, was registered through Jiangsu Bangning Science & Technology Co. Ltd.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **XWorm**, a .NET-based Windows remote access trojan, has been both actively deployed in phishing attacks and marketed online as a builder for criminal operators. The malware has been advertised with modules for **RAT control, ransomware, HVNC, hidden RDP, DDoS, keylogging, credential theft, clipper functions, and persistence**, while incident analysis found live samples communicating with command-and-control servers such as `system6458[.]ddns[.]net` over port `6666`. Reverse engineering also showed that XWorm uses anti-analysis checks to terminate in virtualized or sandboxed environments and can persist through startup-folder copies, scheduled tasks, AppData placement, and registry autorun entries. Separate investigations tied XWorm to ongoing delivery campaigns, including the **MEME#4CHAN** phishing operation, which used fake hotel reservation lures and Microsoft Word documents exploiting `CVE-2022-30190` to launch multi-stage infection chains involving PowerShell, JScript, and in-memory .NET loading. Analysts found XWorm variants capable of **PowerShell execution, in-memory .NET execution, screenshots, plugin retrieval, USB spreading, uninstall functions, and DDoS**, with configuration fields such as `Host`, `Port`, and `KEY` encrypted using AES and derived keys. In some intrusions, the malware disabled **AMSI**, weakened Microsoft Defender, created a local administrator account named **System32**, disabled the Windows Firewall, and injected the final payload into processes including `RegSvcs.exe` and `Msbuild.exe`, with observed C2 infrastructure including `212.87.204[.]83:3000` and `port3000newspm.duckdns[.]org`.
Aug 15, 2026
Researchers from CloudSEK Threat Intelligence (TRIAD) have uncovered a rapidly expanding Loader-as-a-Service (LaaS) campaign, known as the Morte botnet, which systematically compromises SOHO routers, IoT devices, enterprise applications, and CMS platforms. The campaign has been active for at least six months and has demonstrated a significant 230% increase in attack volume between July and August 2025. Attackers exploit web-based command injection vulnerabilities, particularly through unsanitized POST parameters such as ntp, syslog, and hostname fields, allowing them to execute arbitrary shell commands on targeted devices. The botnet also leverages default credentials, such as admin:admin, using brute force and credential spraying techniques to gain unauthorized access. Key targets include Oracle WebLogic servers, WordPress sites, vBulletin forums, and other Linux-based systems, with exploitation of known vulnerabilities like CVE-2019-16759 (vBulletin), CVE-2019-17574 (WordPress Popup Maker), and CVE-2012-1823 (PHP-CGI RCE). Once access is obtained, attackers deploy small shell scripts as droppers, which then deliver native binaries such as the Morte malware and cryptomining payloads. The infrastructure supporting the botnet is highly dynamic, rotating across dozens of IP addresses to evade detection and takedown efforts. The campaign has also been observed distributing Mirai-like bots, further expanding its reach and impact. Post-exploitation, the botnet uses commands like [ReplyDeviceInfo] for reconnaissance and [ConfigSystemCommand] for command injection, enabling persistent control over compromised devices. Security researchers gained insight into the operation by accessing exposed command-and-control (C2) logs, which detailed the attackers' methods and infrastructure. Organizations are advised to mitigate risk by blocking egress traffic, enforcing strong and unique credentials, updating device firmware, segmenting IoT and embedded devices, and replacing end-of-life hardware. Additional recommendations include adopting Sigma rules to detect suspicious POST parameter activity and collecting forensic artifacts for incident response. The campaign's use of multi-architecture malware and BusyBox tools allows it to target a wide range of devices, increasing its effectiveness and threat level. The loader-as-a-service model enables other threat actors to leverage the botnet's infrastructure for their own payloads, further complicating defense efforts. The rapid growth and sophistication of the Morte botnet highlight the ongoing risks posed by insecure web interfaces and outdated devices in both enterprise and home environments. The campaign's ability to exploit both known and zero-day vulnerabilities underscores the importance of timely patching and proactive security measures. CloudSEK's findings emphasize the need for continuous monitoring and threat intelligence sharing to counter evolving botnet threats. The exposure of C2 logs has provided valuable intelligence, but the botnet's operators continue to adapt their tactics to maintain operational resilience. The Morte botnet campaign represents a significant and ongoing threat to organizations relying on internet-exposed devices and applications.
Jun 29, 2026
Researchers reported that **DBatLoader**—also tracked as **ModiLoader** and **NatsoLoader**—has been used in multiple malware delivery campaigns that start with social engineering and end with remote-access trojans such as **Remcos RAT** and **Warzone RAT**. In one observed intrusion, a purchase-order themed malspam message carried an ISO attachment containing a Windows executable disguised with an Excel icon; after execution, the loader retrieved a **4.3 MB** base64 text file from **OneDrive**, decoded additional components on the host, and led to **TLSv1.3** command-and-control traffic with `146.70.158[.]105` over TCP `9138`, consistent with Remcos activity. Another sample abused **Discord** attachment URLs to fetch a second Delphi-based stage and ultimately deploy Warzone RAT, which communicated over TCP `1990`. Technical analyses describe DBatLoader as a **Delphi-based loader** that uses multilayer obfuscation, image steganography, and in-memory decoding before dropping batch scripts, DLLs, and executables into `C:\Users\Public\Libraries`. It establishes persistence through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, malicious shortcuts, and copied binaries, while some variants also abuse a **Mock Trusted Directories UAC bypass** and a relative-path DLL hijack involving `easinvoker.exe` and `netutils.dll` to gain elevated execution without a UAC prompt. Researchers said the malware commonly pulls later-stage payloads from public cloud services including **OneDrive**, **Google Drive**, and **Discord**, and has been seen distributing **Formbook**, **Netwire RAT**, **Remcos RAT**, and **Warzone RAT** against business users, including targets in Europe.
Aug 15, 2026