Loading story…
Malicious Excel spreadsheets distributed in ZIP archives were used to infect Windows systems with malware assessed as likely SystemBC, using a GlobalSign-themed lure to convince users to enable macros. Once executed, the macro downloaded a Windows payload, wrote it to a newly created path under C:\, and established persistence through a scheduled task. The infected host then communicated with 109.234.39.169 over TCP port 4001, consistent with the observed SystemBC-related activity.
Follow-on intrusion activity included HTTP requests that returned obfuscated code used to launch Cobalt Strike, followed by HTTPS and DNS beaconing tied to fastonent[.]com and 192.169.6.8. The observed post-compromise behavior differed by environment: in an Active Directory lab, the infection progressed to Cobalt Strike activity, while a stand-alone host showed only the suspected SystemBC communications, indicating the malware chain may selectively deploy additional tooling on domain-connected systems.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
By the next day, several related samples had appeared in VirusTotal, indicating broader distribution of the same malicious Excel campaign. The campaign involved ZIP archives containing malicious spreadsheets likely sent as email attachments.
A malicious Excel spreadsheet using a GlobalSign-themed lure was uploaded to the Hatching Triage sandbox. The sample contained a macro that, when enabled, downloaded a malware payload later assessed by the author as likely SystemBC.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 96 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro reported a **Cobalt Strike** intrusion that began with a socially engineered spear-phishing email carrying a malicious **`.xls`** attachment. The file triggered **`excel.exe`**, which spawned **`rundll32.exe`**, loaded **`iroto.tio`**, and hollowed **`mobsync.exe`** to conduct reconnaissance and establish command-and-control activity. Managed XDR and Vision One alerts helped investigators reconstruct the attack chain and identify the initially compromised endpoint as **Patient Zero**. The investigation linked activity across multiple endpoints through indicators of compromise, suspicious process chains, **SMB-based lateral movement**, and evidence of **Pass-the-Hash** abuse. Trend Micro said responders moved to isolate affected systems, reset compromised accounts, block command-and-control infrastructure, and continue monitoring to prevent the intrusion from progressing to a likely ransomware stage.
Aug 14, 2026
Multiple incident reports describe **Qakbot** infections delivered through phishing emails that linked to ZIP archives containing malicious Excel files, often using Excel 4.0 macros to fetch DLL payloads. On compromised Windows systems, the malware executed downloaded DLLs with `regsvr32.exe`, contacted multiple command-and-control servers, and in some cases used distribution tags such as **`obama166`** and **`aa`**. Researchers observed Qakbot storing artifacts on disk, changing persistence behavior compared with earlier variants, and in broader campaigns stealing Outlook credentials, adding Windows Defender exclusions, and using internal email threads to spread further inside organizations. Follow-on activity showed operators deploying **Cobalt Strike** and VNC-based remote access, including **DarkVNC** traffic over TCP 443 and VNC beaconing detected after the initial compromise. In one analyzed case, Cobalt Strike and VNC activity appeared about 17 hours after infection, indicating a second-stage intrusion after Qakbot established foothold. Additional reporting ties these intrusions to hands-on-keyboard actions such as reconnaissance, lateral movement over SMB admin shares, service-based persistence, and preparation for ransomware deployment, while one campaign also reportedly abused **PrintNightmare** (`CVE-2021-34527`) for SYSTEM-level execution and may have leveraged **ProxyLogon** and **ProxyShell** to help distribute malicious emails in enterprise environments.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026