Loading story…
Researchers described TA410 as a distinct cyber-espionage umbrella cluster, separate from APT10, operating through at least three subgroups: FlowingFrog, LookingFrog, and JollyFrog. The group has targeted victims through spearphishing with Royal Road lure documents and by exploiting public-facing Microsoft SharePoint and Exchange servers, then deploying a broad malware arsenal that includes FlowCloud, LookBack, Tendyron, X4, QuasarRAT, and Korplug to maintain access and conduct intelligence collection.
Proofpoint’s analysis of FlowCloud RAT v4.1.3 showed the malware remained active with a live command-and-control server and provided extensive remote access features, including filesystem and service control, screenshots, shell access, keylogging, plugin support, port mapping, and Nmap-assisted lateral movement. The sample used Protocol Buffers for configuration and C2 messaging, stored encrypted settings in winver.dat, and downloaded components such as SQLite and Nmap from attacker infrastructure; researchers also highlighted detection opportunities tied to certutil-based payload delivery, suspicious w3wp.exe process trees, and LookBack network signatures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
ESET added a ta410.yar file to its malware IOC repository containing YARA rules for detecting TA410-associated malware including Tendyron, X4, LookBack, FlowCloud, fcClient, and a rootkit. The defensive release provided technical detection logic and resource-pattern signatures for multiple TA410 toolsets.
The TA410 presentation stated that LookingFrog and JollyFrog also exploited Microsoft Exchange ProxyShell vulnerabilities for initial access.
The TA410 presentation stated that LookingFrog and JollyFrog exploited Microsoft Exchange ProxyLogon vulnerabilities for initial access.
Proofpoint published technical analysis of a TA410-linked FlowCloud RAT variant, detailing its Protocol Buffers-based configuration, command families, exfiltration managers, and lateral movement features.
Proofpoint said the analyzed FlowCloud 4.1.3 sample was uploaded to VirusTotal by a submitter from Taiwan on May 12, 2020.
Proofpoint reported that metadata in a TA410-associated FlowCloud RAT sample identified as version 4.1.3 showed a compile date of March 21, 2019, while noting the timestamp could have been forged.
ESET's TA410 overview said LookingFrog and JollyFrog used exploitation of public-facing applications for initial access, including CVE-2019-0604 against Microsoft SharePoint.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
developers.google.com
Open sourcegithub.com
Open sourceproofpoint.com
Open sourcebotconf.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026
TA428 conducted **Operation LagTime IT**, a cyber-espionage campaign targeting government organizations in East Asia and defense- and aviation-related entities in Russia and Mongolia. The intrusions used Royal Road-generated malicious RTF documents exploiting **`CVE-2018-0798`** in Microsoft Word, including lures themed around **Qasem Soleimani** and **COVID-19**, to deliver **Poison Ivy**, **Cotx RAT**, and the malware later identified as **nccTrojan** or **MsmRAT**. Researchers said the activity was observed from at least March 2019 through 2020 and showed overlap with Chinese intrusion clusters including **Tick**, **Tonto**, and possibly **DragonOK/Danti**. After initial compromise, the operators stole credentials from Outlook and **`lsass.exe`**, scanned victim networks, and moved laterally using **`MS17-010`** tooling including EternalBlue-related exploitation. TA428 also used **NBTScan**, DLL side-loading with legitimate Intel and PotPlayer binaries, malicious **`.wll`** files for persistence, and follow-on malware such as **Tmanger**, **Poison Ivy-B**, and multiple **nccTrojan** variants. Researchers found that **nccTrojan** had at least two major branches: an initial-access version with standard RAT functions and XOR-obfuscated traffic, and a later-stage version installed as a Windows service that used a custom TCP protocol with **AES-encrypted** payloads and an activation code for command handling.
Aug 15, 2026