Loading story…
Cisco Talos and Silent Push linked an expanded LodaRAT espionage campaign to the actor Talos tracks as Kasablanka, tying updated Windows malware and a new Android variant, Loda4Android, to the same infrastructure and command-and-control design. The operation focused heavily on Bangladesh, targeting banks, carrier-grade VoIP vendors, and users reached through Bangladesh-themed lure sites such as fake COVID-19 vaccine registration and IMEI-check pages. Researchers also identified additional domains themed around Bangladeshi political, telecom, financial, and ecommerce brands, suggesting broader targeting and campaign preparation.
The malware family evolved from the earlier AutoIt-based Loda RAT documented by Proofpoint, retaining surveillance and remote-control features while adding new capabilities and delivery methods. Talos reported that newer Windows variants shifted between phishing archives and malicious RTF documents exploiting CVE-2017-11882, used regsvr32 to retrieve scriptlets, and added stronger audio recording, browser credential theft, cookie theft, and RDP enablement; operators were also seen interacting directly with infected hosts. The Android implant supported data exfiltration, SMS and call abuse, phishing, and script execution, while campaign infrastructure overlapped across domains and IPs including info.v-pn[.]co, lap-top[.]xyz, 107.172.30[.]213, and 160.178.220[.]194, with some variants also abusing tunneling services such as ngrok.io and portmap.io for command and control.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Silent Push reported additional infrastructure tied to the Bangladesh-targeting LodaRAT campaign, including fake COVID-19 vaccine registration and IMEI-checker sites that delivered ZIP archives containing LodaRAT variants. The report also identified related lure domains themed around Bangladeshi political, telecom, financial, and ecommerce brands.
Cisco Talos analyzed an evolved campaign featuring an updated Windows LodaRAT version 1.1.8 and a new Android variant, Loda4Android, and attributed both to the same group it calls Kasablanca. Talos said the campaign used shared command-and-control design, code similarities, signing artifacts, and overlapping infrastructure, and was still active at the time of reporting.
Talos identified the hybrid LodaRAT campaign targeting Bangladesh-based organizations as starting in October 2020. Observed targets included banks and carrier-grade VoIP software vendors.
During analysis of LodaRAT version 1.1.1, Talos observed the operator repeatedly issuing the "Screen" command to capture screenshots and sending a custom message box to the analysis machine. This indicated the threat actor was actively monitoring infected hosts.
Cisco Talos reported multiple new in-the-wild LodaRAT versions, including builds labeled 1.1.1 and 1.1.7, with changes such as a PowerShell keylogger, a VBScript single-instance check, and increased focus on browser credential theft. Talos also observed the malware using ngrok.io and portmap.io for command-and-control communications.
The domain info.v-pn[.]co, later used as Loda command-and-control infrastructure, was registered and first observed in malicious activity on July 2, 2020. Talos later tied this infrastructure to the Kasablanka-linked campaign.
Proofpoint published analysis of Loda, describing versions 1.0.0 and 1.0.1 in the wild and multiple email-based delivery methods, including at least one document exploiting CVE-2017-0199. The report also noted Loda had been used as an intermediate loader for additional malware such as ISR Stealer.
Proofpoint first observed the previously undocumented AutoIt-based Loda malware family in September 2016. The malware was used as a keylogger and remote access trojan and was distributed by multiple cybercrime actors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 115 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
silentpush.com
Open sourceblog.talosintelligence.com
Open sourceblog.talosintelligence.com
Open sourceproofpoint.com
Open sourceti.qianxin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported several unrelated **RAT-focused malware campaigns** using different delivery channels and evasion techniques. **DEAD#VAX** was described as a Windows phishing operation that delivers **AsyncRAT** via purchase-order lures, abusing **IPFS-hosted VHD** files disguised as PDFs; the mounted VHD drops a multi-stage chain using **WSF**, heavily obfuscated batch scripts, and PowerShell loaders to decrypt and execute x64 shellcode **in memory** by injecting into trusted Windows processes, minimizing on-disk artifacts. Separately, analysis of **Pulsar RAT** activity described persistence via the per-user Run key (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`), an obfuscated batch dropper in *AppData*, PowerShell-based staging, and **Donut-generated shellcode** injection into processes such as `explorer.exe`, with anti-analysis features and data theft (credentials, wallets, tokens) exfiltrated via **Discord webhooks**. On Android, two distinct campaigns were highlighted. **Anatsa** banking malware was found distributed through **Google Play** in a trojanized “document reader” app that exceeded **50,000 downloads** before detection; the initial app acts as a loader that retrieves the full banking trojan and supports credential theft and C2-driven actions, with reporting attributing discovery and tracking to **Zscaler ThreatLabz**. **Arsink RAT** was reported spreading primarily via **Telegram/Discord** and file-sharing sites (e.g., MediaFire) through fake “mod/pro” apps impersonating major brands; research attributed to **Zimperium** cited **~45,000** victim IPs across **143 countries**, **1,216** malicious APKs, and **317** Firebase Realtime Database C2 endpoints, with capabilities including SMS/OTP theft, call log and contact harvesting, location tracking, and microphone audio capture.
Jun 29, 2026
Multiple Android malware operations have been documented using remote access trojans to seize control of victims’ phones, steal sensitive data, and support financial fraud. Reporting on **CraxsRAT** describes a malware family built to give operators broad device access, while separate research identified **Klopatra**, an Android RAT disguised as the IPTV and VPN app **“Modpro IP TV + VPN,”** infecting more than 3,000 devices in Europe and enabling hidden remote control through a black-screen VNC feature. Klopatra also supports banking overlay attacks, gesture simulation, clipboard theft, keystroke capture, and screen monitoring, allowing attackers to conduct credential theft and fraudulent transactions while the device appears inactive. A third investigation found attackers targeting high-value individuals in South Asia with Android malware built on **SpyNote**, delivered through WhatsApp under multiple app names and tied to shared command-and-control infrastructure. That malware was designed to hide itself after installation and collect location data, contacts, SMS messages, call records, device information, files, screenshots, and keystrokes, particularly when accessibility permissions were granted. Across the reported cases, the malware showed strong evasion and persistence features, including obfuscation, anti-debugging, emulator detection, and attempts to disable security tools, underscoring how modern Android RATs are being adapted for espionage, credential theft, and banking abuse.
Jun 29, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026