Loading story…
The Wild Neutron threat actor, also tracked as Jripbot and Morpho, was reported to have continued a long-running espionage campaign that began by at least 2011 and evolved from broad watering-hole compromises into more selective intrusions. Earlier operations reportedly hit high-profile technology targets including Apple, Facebook, Twitter, and Microsoft, while later activity focused on law firms, Bitcoin-related businesses, investment firms, IT providers, healthcare organizations, real estate companies, and specific individuals.
Researchers said the group used an unknown Adobe Flash Player exploit in 2015 and deployed a modular toolset built around the Jripbot backdoor, alongside SSH-based exfiltration utilities and a dropper signed with a stolen Acer code-signing certificate. The campaign’s tradecraft included encrypted command-and-control traffic, anti-sandbox techniques, reuse of open-source and leaked malware code, Unix-style tools ported through Cygwin, and victim-specific fallback domain resolution, leading investigators to assess the operation as a sophisticated campaign driven primarily by economic espionage.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
The Securelist report stated that Wild Neutron was still active as of June 2015, continuing to use modular malware centered on the Jripbot backdoor and related tooling.
In 2015, Kaspersky observed exploitation chains involving cryptomag.mediasource[.]ch and find.a-job.today, with evidence indicating use of an unknown Flash Player exploit.
In 2014–2015, Wild Neutron targeted law firms, Bitcoin-related companies, investment firms, large corporate groups involved in M&A, IT companies, healthcare companies, real estate companies, and individual users.
Kaspersky said the actor resumed operations in late 2013 and early 2014, beginning a new phase of targeted intrusions that continued into 2015.
During the 2013 campaign, the group compromised iphonedevsdk[.]com and fedoraforum[.]org, and also targeted other forums including expatforum.com, mygsmindia.com, forum.samdroid.net, emiratesmac.com, forums.kyngdvb.com, community.flexispy.com, and ansar1.info.
In 2013, Wild Neutron compromised high-profile companies including Apple, Facebook, Twitter, and Microsoft through watering-hole attacks using a Java zero-day detected as Exploit.Java.CVE-2012-3213.b.
Kaspersky reported that the Wild Neutron espionage actor, also known as Jripbot and Morpho, had been active since at least 2011.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026
Researchers uncovered compromised **UEFI firmware** images carrying a malicious implant that persisted in SPI flash and deployed a previously unseen malware family dubbed **MosaicRegressor**. The rogue firmware reused and modified components from Hacking Team’s leaked **VectorEDK** UEFI bootkit to drop `IntelUpdate.exe` into the Windows Startup folder and restore it if deleted, giving attackers durable access below the operating system. The finding followed earlier public reporting on **LoJax**, the first UEFI rootkit observed in the wild, underscoring that firmware-level persistence had moved from theory to active operations. The malware framework was used in targeted espionage campaigns from 2017 to 2019 against diplomats and NGO members in Africa, Asia, and Europe, with identified victims linked to North Korea. MosaicRegressor operated as a modular, multi-stage platform using multiple downloaders over HTTP/HTTPS, **BITS**, **WinHTTP**, and even `mail.ru` email accounts to retrieve payloads. Attribution remained low confidence, but researchers cited Chinese-language artifacts, a **Royal Road** weaponized document, and infrastructure overlap with activity associated with the **Winnti umbrella**, suggesting possible ties to a Chinese-speaking threat actor.
Aug 14, 2026