Loading story…
Security researchers reported the emergence of Win32/Napolar—also marketed by its author as solarbot—as a new bot malware family used in the wild for credential theft, DDoS, SOCKS proxying, and remote payload execution. The malware was observed infecting victims primarily in South America, with notable concentrations in Peru, Ecuador, and Colombia, and it communicated with command-and-control servers over HTTP while encrypting commands with RC4 keyed to the bot identifier.
Analysis showed Napolar included advanced anti-analysis and evasion techniques uncommon for a newly surfaced crimeware family, including staged TLS decryption, runtime API resolution by hash, use of undocumented NTDLL functions, position-independent code, and self-debugging through code injection into a child process. Researchers also found browser-hooking capabilities for web-form theft and logic to detect and terminate processes containing trusteer, indicating attempts to bypass banking-browser protections; meanwhile, the malware was openly advertised online with builds reportedly sold for $200, along with changelogs, C2 server code, and plugin examples that pointed to a professionalized malware-for-sale operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
By mid-August, the malware had come to researchers’ attention because of its anti-debugging and code-injection techniques. ESET identified the family as Win32/Napolar and documented its HTTP-based C2, credential theft, SOCKS proxy, DDoS, and anti-analysis features.
Win32/Napolar was observed infecting systems in the wild starting in mid-August. Reports indicated thousands of infections, many concentrated in South America, especially Peru, Ecuador, and Colombia.
Researchers reported that the Win32/Napolar malware family became active at the end of July. The malware was marketed by its author as "solarbot" and offered multiple criminal capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Necro** botnet—also tracked as **N3Cr0m0rPh**, **FreakOut**, and **Necromorph**—rapidly evolved from an older Python malware family into an active cross-platform campaign targeting both Linux and Windows systems. Multiple reports tied the operation to exploitation of public-facing flaws including `CVE-2020-28188`, `CVE-2021-3007`, and `CVE-2020-7961`, with later variants adding more n-day exploits such as those affecting TerraMaster, Genexis, Xinuos OpenServer, Zeroshell, and **Visual Tools DVR VX16 4.2.28.0**. The malware also spread through SSH and Telnet brute forcing, and researchers observed infection volumes ranging from hundreds of confirmed download attempts to estimates in the tens of thousands of compromised hosts. The botnet used **IRC-based command and control**, later strengthened with **DGA-generated domains**, **Tor**, **SSL-encrypted communications**, polymorphic code, and PyInstaller-packed binaries to improve resilience and execution. Once installed, Necro enabled **DDoS attacks, reverse shells, persistence, traffic sniffing, ARP poisoning, lateral movement, file infection, and JavaScript injection**, while monetizing access primarily through **XMRig-based Monero mining** and, in some cases, Tezos mining. Cisco Talos also observed a Windows user-mode rootkit and a one-off apparent ransomware delivery attempt, underscoring that the operators were actively adding new payloads and exploit paths as the campaign matured.
Aug 15, 2026
Researchers linked **Nodersok**—also tracked as **Novter** and **Divergent**—to the long-running **KovCoreG** malvertising operation, which used fake Adobe Flash update lures and compromised ads on popular websites to infect Windows systems. The multi-stage chain abused legitimate tools including `mshta.exe`, PowerShell, `node.exe`, and **WinDivert**, fetched RC4-encrypted payloads from short-lived infrastructure and CDN services such as Cloudfront and Cdn77, and ran largely in memory using HTA execution, registry-based staging, and reflective PE injection. The malware also attempted to disable **Windows Defender** and **Windows Update**, bypassed UAC through **CMSTPLUA**, and established persistence through registry Run keys and scheduled tasks. The final payload turned infected hosts into proxy zombies and click-fraud nodes, with Node.js-based modules supporting **SOCKS4A** relaying and fraudulent ad traffic disguised as Android or iOS devices through TCP/IP and SYN packet manipulation. Additional modules supported traffic blocking and technical-support scam activity, while anti-analysis checks and encrypted command-and-control updates helped the operators keep the campaign active and evolving. Microsoft said the operation hit thousands of systems, mostly consumer devices in the United States and Europe, with some enterprise victims across sectors including education, healthcare, finance, retail, and professional services.
Aug 15, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026