Loading story…
A MirrorBlast phishing campaign targeted financial services firms and other organizations across multiple regions using weaponized Excel attachments and SharePoint- or OneDrive-themed lures. Researchers said the infection chain relied on extremely lightweight macros, anti-sandbox checks, and the Windows binary msiexec.exe to retrieve MSI installers while minimizing detection. The MSI files then deployed REBOL- or KiXtart-based loaders that profiled infected hosts, contacted command-and-control infrastructure, and waited for follow-on payloads.
Security researchers linked the activity to TA505 with high confidence based on overlapping tactics, infrastructure, and malware staging patterns. Reported similarities included domain naming conventions, registrar usage, lure formatting, selective victim filtering, and shared infrastructure such as 169.239.128[.]11, alongside parallels with TA505's historical Get2/GetandGo and SDBBot operations. The campaign's use of staged reconnaissance and reported ties to FlawedGrace/GraceWire further strengthened the assessment that MirrorBlast is part of, or closely aligned with, TA505's financially motivated operations.
Get the infrastructure and lures behind it.
11 events from the most recent confirmed update back to the earliest known activity.
HP Wolf Security published an analysis on 19 October 2021 concluding that similarities between MirrorBlast and TA505 Get2/SDBBot operations significantly strengthened the hypothesis that they were linked, though not definitively proven. The assessment cited overlaps in domains, infrastructure, cadence, lure formatting, and staged reconnaissance behavior.
HP reported that a MirrorBlast campaign on 14 October 2021 used the same test document previously seen in a 2020 TA505 campaign. This reuse was presented as another similarity strengthening the TA505 linkage hypothesis.
On 7 October 2021, a MirrorBlast campaign used a download website whose design was almost identical to websites used in TA505 campaigns. HP also noted similar user-agent filtering behavior and lure-document styling.
A MirrorBlast campaign on 4 October 2021 used the domain fidufagios[.]com with command-and-control IP address 169.239.128[.]11. HP identified this as infrastructure overlap with a 2019 TA505 campaign.
Proofpoint reported that TA505's renewed campaigns, which began in early September 2021, grew from several thousand messages per wave to tens or hundreds of thousands of emails by late September and early October. The actor also expanded targeting beyond primarily North America to German-speaking countries including Germany and Austria.
Morphisec reported that the new MirrorBlast campaign it tracked began in early September and targeted financial organizations and other sectors across multiple regions. The campaign used phishing emails with malicious Excel attachments and later SharePoint- and OneDrive-themed lures.
HP reported that MirrorBlast was first observed at the end of September 2021 and that activity increased around that time, with new domains appearing almost daily. Proofpoint Emerging Threats Labs named the malware MirrorBlast based on its command-and-control traffic signatures.
Morphisec said it observed activity related to the MirrorBlast campaign in April 2021. The reference presents this as earlier activity connected to the later campaign cluster.
HP reported that TA505 used a specific test document in a 2020 campaign. The same document was later seen in a MirrorBlast campaign, supporting the suspected linkage between the two.
A TA505 campaign on 9 October 2019 used the domain onedrive-sdn[.]com and the IP address 169.239.128[.]11 for command and control. This infrastructure was later cited as an overlap with MirrorBlast activity.
Morphisec attributed the MirrorBlast campaign to TA505 with high confidence based on the email-to-XLS-to-MSI infection chain, SharePoint/OneDrive lure themes, domain naming patterns, a reused MD5 tied to a prior TA505 intrusion, and reporting that later stages led to FlawedGrace. The campaign used KiXtart- and REBOL-based MSI payloads that profiled victims and awaited further instructions from command-and-control infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 148 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourcethreatresearch.ext.hp.com
Open sourceproofpoint.com
Open sourcelolbas-project.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
Threat researchers and incident responders linked **TA505** to a years-long progression from massive malspam operations delivering **Dridex**, **Locky**, **Jaff**, **GlobeImposter**, and other payloads to more targeted intrusions aimed at full-network compromise and ransomware deployment. Early campaigns relied heavily on the **Necurs** botnet and phishing lures with malicious PDFs, macro-enabled Word documents, ZIP archives, `.url` shortcuts, and `.iqy` files, while later operations introduced loaders and remote-access malware including **FlawedAmmyy**, **Marap**, **FlowerPippi**, and **Gelup**. Researchers reported that these tools supported host fingerprinting, encrypted command-and-control, persistence, privilege escalation, and delivery of follow-on payloads, showing a shift from simple malware distribution to modular access operations. The group’s later activity culminated in enterprise-wide attacks associated with **Clop** ransomware, including the compromise of **Maastricht University**, where attackers reportedly entered through phishing, escalated privileges on an unpatched system, mapped the network, harvested credentials, and encrypted **267 Windows servers**, leading the university to pay a **30 bitcoin** ransom. Separate reporting on 2020 **Dridex** campaigns showed continued use of macro-enabled documents, PowerShell downloaders, `rundll32.exe`, HTTPS command-and-control, and multiple persistence mechanisms, underscoring that TA505 maintained high-volume delivery tactics even as it adopted tools such as **Mimikatz**, **Cobalt Strike**, **WMIC**, **RDP**, **PowerSploit**, **PingCastle**, and **AdFind** to move laterally, disable defenses, and prepare domain-wide ransomware deployment and, in some cases, extortion through stolen data.
Aug 15, 2026
Researchers detailed a **MetaStealer** infection chain delivered through malicious email attachments and links, including Excel macro documents and OneNote files, that infected Windows systems and established persistence for follow-on payload delivery. In the observed campaigns, enabling macros or opening the lure file launched scripts that retrieved components from **GitHub** and **transfer.sh**, built a persistent executable on the host, and modified `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` so the malware would restart after reboot. Analysts said the infrastructure remained active near the time of publication, and network traffic to `193.106.191.162:1775` matched **EmergingThreats Pro** detections for Win32/MetaStealer activity. Separate reverse engineering showed MetaStealer used **XOR-based string decryption** and a **domain generation algorithm (DGA)** to supplement or replace static command-and-control infrastructure by generating multiple `.xyz` domains for beaconing. Decrypted strings and observed behavior indicated capabilities beyond credential theft, including **SOCKS proxying, backconnect access, firewall rule manipulation, shellcode execution, and tasking endpoints**, underscoring that MetaStealer functioned as a flexible post-compromise stealer and access tool rather than a simple infostealer.
Aug 15, 2026