Loading story…
Researchers and incident responders linked multiple U.S. intrusions to the Iranian threat actor PHOSPHORUS (also tracked as APT35, DEV-0270, NemesisKitten, and UNC2448), which repeatedly exploited vulnerable Microsoft Exchange servers using the ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). In observed cases, the actor deployed web shells, created local administrator accounts, enabled RDP access, disabled defenses, and used native Windows tools for rapid discovery and credential theft, including LSASS dumping. Investigators also saw Go-based and modified Fast Reverse Proxy (FRP) payloads masquerading as legitimate files such as dllhost.exe, along with newer malware including user.exe, task_update.exe, and Conser.exe, plus the installation of a fake Microsoft-themed root certificate in at least one variant.
The activity escalated beyond espionage-style access into disruptive operations. One DFIR case showed PHOSPHORUS moving from initial Exchange compromise to domain-wide encryption in roughly 42 hours, using BitLocker on servers and DiskCryptor on workstations before leaving an $8,000 ransom demand. Secureworks separately reported COBALT MIRAGE, an Iran-linked cluster associated with the same broader ecosystem, conducting ransomware operations in the United States. Deep Instinct and other researchers said the actor continued to refine mass-exploitation tooling and traffic evasion, including FRP communications that blended connections to legitimate domains with visually similar attacker-controlled infrastructure, while overlaps were also noted with exploitation tied to Fortinet CVE-2018-13379 and Log4Shell.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
Team Cymru reported that PHOSPHORUS-linked exploitation activity associated with C2 IP 107.173.231.114 continued as of 29 November 2022. The telemetry included a likely opportunistically compromised South Asian Exchange victim and additional potential victims in Africa and the Middle East communicating with the C2 and Kaspersky-hosted infrastructure in patterns consistent with prior PHOSPHORUS malware.
In June 2022, Secureworks analyzed a ransomware incident in which COBALT MIRAGE exploited ProxyShell on Microsoft Exchange, deployed multiple web shells and the TunnelFish FRPC variant, enabled DefaultAccount, and encrypted several servers with BitLocker. Recovered artifacts included ransom notes and C2 infrastructure that supported attribution and linked the activity to additional Iranian-associated infrastructure.
In the 2021-10 to 2022-02 campaign, Deep Instinct identified previously unknown variants of user.exe, task_update.exe, and FRPC, along with an additional .NET payload named Conser.exe. The tooling created local admin access, enabled RDP, installed a fake Microsoft-impersonating root certificate in one variant, and established reverse-proxy or SSH tunnels.
Deep Instinct concluded that in early 2022 PHOSPHORUS began using FRPC variants that generated traffic to both legitimate domains and visually similar attacker-controlled domains to hide malicious communications. The technique blended attacker traffic with benign-looking network activity.
Also in December 2021, the attackers used comsvcs.dll to dump LSASS, compressed the dump into ssasl.zip, and exfiltrated it through the web shell. Investigators evicted the actor before additional impact was observed.
In the December 2021 case, the actor created a local DefaultAccount user, added it to Administrators and Remote Desktop Users, enabled RDP, and disabled multiple Windows Defender protections. They also enabled WDigest and disabled LSA protection to facilitate credential theft.
During the December 2021 intrusion, the attackers uploaded Wininet.xml, created a scheduled task named \Microsoft\Windows\Maintenance\Wininet, and downloaded a fake dllhost.exe from 148.251.71[.]182. The Go-based payload communicated with msupdate[.]us subdomains and showed FRP code overlap.
In December 2021, investigators observed a PHOSPHORUS-related intrusion exploiting the ProxyShell chain to gain initial access to a Microsoft Exchange server and deploy multiple IIS-accessible ASPX web shells. The activity occurred in two bursts within a three-day window and appeared automated.
Between 2021-10-30 and 2022-02-12, Deep Instinct observed seven attempts to exploit a Microsoft Exchange server at a U.S. infrastructure and construction company and attributed the activity to PHOSPHORUS. All seven attempts were prevented in the customer environment.
Still in late September 2021, the intrusion culminated in domain-wide encryption: servers were encrypted with BitLocker via setup.bat and workstations with DiskCryptor. The report said time-to-ransom from first successful ProxyShell exploitation was about 42 hours.
In the same late-September 2021 case, the attackers dumped LSASS, packaged the dump, and about 30 minutes later began using a domain administrator account. They then scanned internally and moved laterally, primarily over RDP.
During the late-September 2021 intrusion, the actors enabled the built-in DefaultAccount, added it to Administrators and Remote Desktop Users, and used Plink plus FRP masquerading as dllhost.exe to tunnel RDP and maintain access. They also created a scheduled task for persistence.
In late September 2021, attackers attributed to PHOSPHORUS exploited the ProxyShell chain against an on-premises Microsoft Exchange server, deployed multiple web shells, and began discovery activity. The intrusion unfolded over roughly three days.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 119 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
secureworks.com
Open sourceteam-cymru.com
Open sourcemicrosoft.com
Open sourcedeepinstinct.com
Open sourcesecureworks.com
Open sourcethedfirreport.com
Open sourcetrendmicro.com
Open sourcemicrosoft.com
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026