Loading story…
U.S. government and private-sector reporting tied a malware family used in intrusions against energy and other critical infrastructure organizations to the Russian-linked Energetic Bear/Dragonfly activity set. A CERT/CC reverse-engineering review of a YARA rule published in CISA Alert TA17-293A found the signature was not a simple string match but a Windows API hashing routine used for manual symbol resolution, allowing the malware to locate kernel32.dll through the TEB/PEB and resolve functions such as VirtualProtect while hindering static analysis.
Using FLARE tooling alongside CERT/CC's own API hashing and UberFLIRT analysis, researchers identified the hashing method as sll1Add, built refined YARA detections, and found 37 related malware exemplars in CERT's MASS repository across 32-bit and 64-bit variants. The samples shared consistent kernel32.dll hashes, with additional ws2_32.dll and wininet.dll hashes indicating networking capability; analysts also recovered 29 unique IP:port indicators from 33 samples and reconstructed HTTP POST traffic from four others carrying headers including X-mode: push and X-mode: pop. A later update linked the tooling to Symantec's Trojan.Heriplor from Dragonfly reporting, strengthening the association with Energetic Bear and indicating the malware remained in active use.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
In fall 2018, the CERT Coordination Center Reverse Engineering Team received a tip about a YARA rule from TA17-293A that was triggering on VirusTotal samples allegedly associated with Energetic Bear. This prompted deeper reverse-engineering of an initial exemplar.
US-CERT released alert TA17-293A describing advanced persistent threat activity targeting energy and other critical infrastructure sectors and associating the activity with Russian-linked operations. A YARA rule from this alert later became the basis for CERT/CC's reverse-engineering analysis.
The reverse-engineering work led to API hashing being added to the MITRE MAEC Malware Behavior Catalog as a method under anti-static-analysis executable code obfuscation. This reflected formal recognition of the technique documented in the analysis.
A later update reported that Matt Brooks of Citizen Lab linked the analyzed API hashing tool to Symantec's Trojan.Heriplor described in Dragonfly reporting. This strengthened the association between the tooling and the Energetic Bear/Dragonfly threat group.
From the identified exemplars, CERT/CC extracted 29 unique IP-and-port pairs from 33 samples and reconstructed outbound HTTP POST traffic from four others. Observed traffic included headers such as "X-mode: push," "X-mode: pop," and "X-type: more" or "X-type: last."
Using refined YARA rules covering 32-bit, variant, and 64-bit implementations of the hashing routine, CERT/CC searched its MASS repository and ultimately identified 37 exemplars using the sll1Add API hashing method. Analysis showed consistent kernel32.dll hashes and additional ws2_32.dll or wininet.dll hashes indicating network capability.
CERT/CC determined that the YARA rule's key string matched a Windows API hashing routine rather than a simple string signature. The team linked the routine to a method similar to FireEye FLARE's sll1AddHash32 and showed the malware used manual symbol resolution through the TEB/PEB to locate kernel32.dll and resolve APIs such as VirtualProtect.
Symantec published reporting on the Dragonfly threat group, describing cyber attacks targeting the Western energy sector. This reporting later became relevant to linking the analyzed API hashing tool to Symantec's Trojan.Heriplor/Dragonfly activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
insights.sei.cmu.edu
Open sourceus-cert.gov
Open sourcesymantec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Taiwanese government agencies were hit by a sophisticated intrusion campaign that deployed **Waterbear** malware after attackers abused a weakness in a trusted data loss prevention (DLP) product for DLL hijacking and high-privilege execution. CyCraft identified dozens of affected endpoints in one environment and linked additional high-risk systems to the compromise, reporting that the attackers also reused access left behind from earlier intrusions, harvested administrative credentials, and expanded through victim networks using lateral movement methods including RDP and `net use`. The operation used **Waterbear Loader**, a malware family previously associated with **BlackTech**, to maintain persistence, evade detection, and covertly control compromised hosts. Researchers said the malware injected shellcode into Windows services including **Winmgmt**, **sens**, **Wuauserv**, and **LanmanServer**, abused the **IKEEXT** service to load `WLBSCTRL.DLL`, and relied on techniques such as **Heaven’s Gate**, API hooking, RC4-encrypted payloads, forced DLL unloading, oversized binaries, and `Kernel32.dll` padding to frustrate analysis and bypass security tools.
Aug 15, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026