Loading story…
Kaspersky identified DeathStalker, a long-running hacker-for-hire group that targeted European law firms and fintech companies, with additional victims in the Middle East including Israel, Jordan, and Egypt. Researchers said the group appeared focused on stealing business and financial intelligence rather than conducting traditional state espionage, marking it as part of a broader mercenary APT market in which private operators sell intrusion capabilities to paying clients.
The intrusions typically began with spear-phishing emails carrying weaponized .LNK shortcut files that launched PowerShell-based backdoors. Reporting on mercenary threat actors placed DeathStalker alongside groups such as Bahamut, DarkBasin, Candiru, and NSO Group, underscoring how commercial surveillance and hacking services are increasingly used against not only activists and dissidents but also enterprises. Researchers noted that, despite the sophistication associated with mercenary operators, campaigns like DeathStalker’s often still rely on familiar weaknesses such as phishing susceptibility and poor patching.
Get the infrastructure and lures behind it.
17 events from the most recent confirmed update back to the earliest known activity.
In September 2021, the US Department of Justice announced that three former US intelligence employees were fined $1.69 million and barred from receiving security clearances for supporting UAE hacking operations tied to Project Raven.
In November 2020, BlackBerry disclosed CostaRicto, a mercenary APT that targeted organizations worldwide using spear-phishing, stolen credentials, and the custom SombRAT backdoor.
In August 2020, Kaspersky disclosed DeathStalker as a Russian-speaking mercenary APT targeting law firms and financial institutions with custom malware and dead-drop resolvers on public platforms.
On July 29, 2020, Kaspersky disclosed a hacker-for-hire group it initially codenamed Deceptikons, describing its targeting of European law firms and fintech companies for business and financial intelligence.
On July 16, 2020, the UK NCSC published an advisory on malicious activity using WellMess malware to target COVID-19 vaccine research institutions and attributed the activity to APT29.
Kaspersky reported that the domains emro-who[.]in and emro-who[.]org were registered on June 21, 2020 and used as sender domains for spear-phishing.
In June 2020, Citizen Lab disclosed that DarkBasin had targeted thousands of individuals and hundreds of institutions, including advocacy groups, journalists, officials, and nonprofits tied to #ExxonKnew.
On May 28, 2020, the US NSA published an alert describing Hades exploiting CVE-2019-10149 in Exim as part of a potentially large mass-access operation.
On May 15, 2020, EGI-CSIRT published an alert describing two incidents targeting academic data centers for CPU mining and included indicators of compromise.
On May 11, 2020, the UK supercomputing center ARCHER announced it was shutting down network access while it investigated a security incident affecting its facility.
Kaspersky attributed with high confidence a watering-hole campaign in March 2020 that delivered Cobalt Strike via DLL side-loading to the HoneyMyte threat actor.
Kaspersky observed an increase in the number of WellMess command-and-control servers in February 2020, which it cited as part of a cyclical pattern of activity.
Kaspersky described a CactusPete campaign starting in December 2019 that deployed an updated DoubleT backdoor via a malicious dropper placed in the Microsoft Word Startup directory.
Kaspersky said DeathStalker conducted a spear-phishing campaign against European law firms in 2019, using malicious LNK files that launched PowerShell-based backdoors.
WellMess malware was originally described by LAC Co in 2018, establishing an early public reference point for later campaigns discussed by Kaspersky and NCSC.
The earliest compilation timestamps for CostaRicto's custom SombRAT backdoor date to 2017, indicating the group's operations were underway by that year.
In an updated technical report published on August 24, 2020, Kaspersky renamed the mercenary group Deceptikons to DeathStalker.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cyjax.com
Open sourcesecurelist.com
Open sourcezdnet.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the **DeathStalker** threat actor used a new **Janicab** malware variant to target legal entities, financial institutions, and possibly travel agencies across the Middle East and Europe, with activity observed through 2020 and likely continuing into 2021. Victims were concentrated in **Egypt, Georgia, Saudi Arabia, the United Arab Emirates, and the United Kingdom**, and the report noted Saudi legal entities among the targets for the first time. The campaign relied on spear-phishing emails carrying ZIP archives with malicious **`.LNK`** droppers that launched chained **VBE/VBS** stages, unpacked a CAB archive containing Python-based tools, and established persistence on infected systems. The malware resolved command-and-control infrastructure through dead-drop resolvers hosted on public services including **YouTube**, and researchers linked the operation to other DeathStalker toolsets such as **PowerSing**, **EVILNUM**, and **PowerPepper** through shared tactics, infrastructure, anti-analysis logic, and tools including a **Stormwind** keylogger and an **ICMP** shell; the implant supported command execution, screenshots, keylogging, proxying, FTP access, and reverse SSH tunneling.
Aug 14, 2026
Researchers attributed an ongoing cyber-espionage campaign to **DeathStalker** with high confidence, saying the group has targeted foreign exchange and cryptocurrency trading companies since at least Q2 2020 using its **VileRAT** toolchain. The intrusion chain evolved over time from spear-phishing emails carrying malicious Google Drive-hosted shortcut files to email- and chatbot-delivered `DOCX` documents that retrieved macro-enabled `DOTM` remote templates, ultimately deploying **VileDropper**, **VileLoader**, and the Python-based **VileRAT** remote access trojan. The operators repeatedly refined the malware to evade detection and frustrate analysis, using techniques including **VBA stomping**, XOR-encoded data hidden in Office objects, JavaScript anti-analysis checks, multi-stage in-memory loading, and Python bytecode obfuscation intended to break decompilers. Investigators also linked the activity to a large infrastructure footprint involving hundreds of domains and IP addresses, many associated with **AS42159 (DELTAHOST UA)** in the Netherlands from late 2021 onward, and said a rise in related samples and infrastructure from March 2022 pointed to intensified compromise attempts against less mature organizations.
Jul 12, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026