Loading story…
Attackers compromised IObit’s forum infrastructure and used it to send members a fake promotional email offering a free one-year license, directing recipients to a malicious ZIP archive hosted on an IObit forum domain. The archive bundled legitimate, digitally signed IObit License Manager components with a trojanized IObitUnlocker.dll, causing DeroHE ransomware to execute when License Manager.exe was launched. The malware established persistence, added Windows Defender exclusions, encrypted files with the .DeroHE extension, and dropped ransom notes demanding 200 DERO from victims while also claiming IObit could pay 100,000 DERO to recover all affected systems.
Victim reports described severe damage, including more than 121,000 files renamed with the .DeroHE extension and many files corrupted across images, archives, PDFs, and source code, while some plain-text files were partially recoverable by restoring the .txt extension. Reporting also indicated the forum likely remained compromised after the ransomware campaign, with malicious scripts on the site triggering browser-notification abuse, redirects, and adult-content advertisements; the affected forum was identified as running vBulletin 5.6.1, a version reported to have a known vulnerability that could allow remote takeover.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Reporting stated that the IObit forums still appeared compromised after the ransomware distribution, with missing pages injecting scripts that pushed browser-notification scams and redirected visitors to unwanted or adult content. The articles also noted the forum was reportedly running vBulletin 5.6.1, a version said to have a known vulnerability.
Analysis cited in reporting found that DeroHE established persistence via an autorun entry, added Windows Defender exclusions, encrypted files with the .DeroHE extension, and dropped HTML ransom files on victims' desktops. The ransom note demanded 200 DERO coins from victims and said IObit could pay 100,000 DERO coins to decrypt all affected systems.
A forum user reported that after running the downloaded IObit-linked patch, more than 121,000 files were renamed with the .DeroHE extension and many files, including images, archives, PDFs, and source code, were corrupted. The user also said Windows Defender did not detect the malware and that IObit's website appeared down when they tried to report the incident.
Attackers used IObit's forum infrastructure to send forum members emails offering a free one-year license and linked them to a malicious promo page and ZIP archive hosted on the IObit forum domain. Running the package loaded a trojanized IObitUnlocker.dll and installed the DeroHE ransomware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
malwaretips.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Small businesses across the United States, Europe, Asia, and the Middle East have been targeted with phishing emails impersonating the **“Interpol Cybercrime Investigation Unit”** and claiming the recipient is tied to an investigation. The messages use fear-based social engineering to push victims to a Proton Drive link hosting a password-protected archive, which contains multiple nested archives and a custom ransomware payload disguised as a video file. Bitdefender said the campaign has hit organizations in food and agriculture, legal services, pharmaceuticals, media, technology, and finance. Once launched, the malware encrypts files on available drives and drops a ransom note directing victims to contact the attackers through **Tox** instead of a leak site or negotiation portal. Researchers found no evidence of data exfiltration and said the operation appears to be the work of a less sophisticated actor rather than an established ransomware group. Bitdefender also identified a major implementation flaw: the decryption routine and key are embedded in the payload, allowing victims to recover files without paying, while defenders were urged to isolate infected systems, scan endpoints, maintain backups, train employees, and enable visible Windows file extensions.
Jul 2, 2026
Cybercriminals have been sending phishing emails that impersonate **Interpol** and other international law-enforcement bodies to trick recipients into installing ransomware. The messages, framed as notices from an alleged “Cybercrime Investigation Unit,” accuse targets of suspicious or fraudulent activity and pressure them to review supposed evidence. Reports indicate the campaign has targeted small businesses across **Europe, Asia, the Middle East, and North America**, using fear and urgency to drive victims to open attacker-controlled files. The emails direct recipients to a password-protected archive hosted on **Proton Drive**, where the lure file is presented as evidence but ultimately leads to an executable disguised as a video. Once launched, the malware encrypts systems and drops a ransom note instructing victims to contact the operators via **Tox** rather than pay a fixed amount, indicating case-by-case extortion. Researchers said the payload appears to be a **simple custom-built ransomware strain** that does not match known families and relies on hardcoded values instead of more advanced infrastructure.
Aug 11, 2026
Researchers reported a malware campaign that used fake installers and plugins on **GitHub** and **SourceForge** to impersonate popular software including **ChatGPT**, **Claude**, **AutoTune**, **Kontakt**, and **Ableton Live**, ultimately delivering the Deno-based backdoor **DinDoor**. The operation was promoted through compromised YouTube channels that posted AI-generated videos linking to malicious repositories; those videos reportedly drew more than **50,000 views** before takedowns. Infection chains typically relied on malicious MSI installers or PowerShell-based loaders that installed **Scoop** and **WinGet**, then deployed the **Deno** runtime to fetch and execute staged JavaScript payloads from attacker-controlled infrastructure. Once installed, DinDoor established persistence, profiled infected systems, and fetched additional malware including a Deno-based RAT capable of **remote execution**, **data theft**, **screenshot capture**, **SOCKS5 proxying**, and browser credential theft. Researchers said the malware also targeted **Telegram**, **Discord**, **Lightcord**, more than **50 crypto wallet extensions**, and at least **10 crypto wallet applications**. A standout capability used **Microsoft Edge**, the **Chrome DevTools Protocol**, and **WebRTC** to stream victim screens peer-to-peer while blending malicious traffic with legitimate browser activity. GitHub removed the identified repositories, but researchers warned the operators are likely to keep recreating malicious accounts and projects on trusted platforms.
Jun 29, 2026