Loading story…
Researchers reported substantial overlap between malware attributed to Chimera and APT19, linking the clusters through shared PE-header anomalies, near-identical code, and common use of Cobalt Strike, Meterpreter, reflective DLL loading, and SMB named-pipe pivoting. Analysis of suspected Chimera samples found multiple related payloads used from 2017 through 2020, including variants that exposed a standard ReflectiveLoader export and others that hid it behind ordinal-only or renamed exports such as execute, while preserving similar persistence, host profiling, and lateral movement behavior.
The broader activity aligns with earlier APT19 operations targeting law and investment firms with phishing lures that exploited CVE-2017-0199, malicious XLSM macros, obfuscated PowerShell, and at least one Cobalt Strike BEACON payload. Separate analysis of an APT19-linked Derusbi backdoor showed service- or registry-based persistence, host reconnaissance, XOR-and-Base64-encoded exfiltration over HTTP/HTTPS, and follow-on DLL loading, while updated OwlProxy samples tied to Chimera added HTTPS listener capability on port 443, a webshell-like endpoint, service persistence, and file-management features to bridge DMZ and internal networks for remote command execution.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
The Chimera/APT19 analysis says the most recent Chimera samples had adopted the same export-hiding modification by August 1, 2020. This change replaced obvious ReflectiveLoader references with ordinal-based or renamed exports such as execute.
Researchers identified three more recent samples from July 2020, including newer 32-bit and 64-bit OwlProxy variants and a dropper they named OwlInstaller. The dropper installed an architecture-appropriate OwlProxy payload as wmipd.dll in system32 and created a wmipd service for persistence.
Another February 2019 OwlProxy sample used HTTPS on port 443 with /topics/ for remote command execution and /topics/pp/ for proxying. The sample used the Windows service name wmipd.
A February 2019 OwlProxy sample used HTTPS on port 443 with /HelpTheme/ for remote command execution and /HelpTheme/pp/ for proxying. It used the Windows service name FastUserSwitchingCompatibility for persistence.
The malware clustering analysis reports newer related samples from 2019–2020 that shared PE-header anomalies, reflective-loading patterns, and high code reuse with older samples. The author assessed them as likely built from a common template with configuration differences such as IP addresses or domains.
FireEye observed a phishing campaign in May and June 2017 targeting at least seven global law and investment firms and attributed it to APT19. Early activity used RTF attachments exploiting CVE-2017-0199, and later activity shifted to macro-enabled Excel documents, including some with an application-whitelisting bypass.
The Chimera/APT19 malware analysis states that related samples identified through YARA hunting span older 2017–2018 periods, indicating the malware family or template was already in use by then. These samples were later compared for shared malformed PE-header traits, code reuse, and reflective-loading behavior.
Lab52 analyzed a recent OwlProxy sample from an Internet-exposed server and reported newer variants exposing HTTPS services on port 443 with /exchangetopicservices/ and /exchangetopicservices/pp/ endpoints. The updated malware also added a webshell-like /px/ endpoint supporting directory listing, file upload, and file download commands.
A technical analysis of a DLL backdoor publicly reported as Derusbi described APT19-linked malware that persisted either as a WinHelpSrv Windows service or a Run key entry, profiled infected hosts, and exfiltrated data over HTTP/HTTPS. The sample contacted infrastructure including 106.185.43.96 and www.microsoft-cache[.]com and was designed to retrieve and execute a secondary DLL payload from C2.
An analyst examined a suspicious DLL with a malformed PE header, published a YARA rule based on that anomaly, and used it to hunt related samples on VirusTotal. The resulting analysis linked Chimera- and APT19-attributed samples through shared PE-header signatures, Cobalt Strike and Meterpreter tradecraft, and roughly 98% code reuse in some pairs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
lab52.io
Open sourcecybergeeks.tech
Open sourcegithub.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Researchers tied multiple government-focused espionage campaigns to a shared malware development and logistics ecosystem built around **CMSTAR** and related tooling. FireEye’s analysis of 11 APT campaigns found common malware families, overlapping command-and-control infrastructure, reused code-signing certificates, clustered compile times, and distinctive NSIS manifest artifacts, leading to its assessment that a centralized **“Sunshop Digital Quartermaster”** supplied malware and operational support to otherwise separate intrusion groups. The report linked 110 malware binaries and 54 domains across campaigns that used families such as `Trojan.APT.9002`, **PoisonIvy**, and **Gh0st**, and described a Chinese-language **9002 Builder** that further suggested centralized tooling rather than fully independent operators. Palo Alto Networks later documented how that model appeared in real-world government targeting. In Mongolia, spear-phishing attacks used politically themed Word documents exploiting `CVE-2012-0158` and later `CVE-2014-1761` to deploy the **Cmstar** loader and **BBSRAT**, with some lures sent from compromised or likely compromised government-associated email accounts and one sample aimed at nearly 2,000 recipients. A separate campaign against Belarusian government entities used Zapad-2017-themed phishing emails, malicious RTF and macro-enabled Word files exploiting `CVE-2015-1641`, and a disguised SCR file to deliver updated **CMSTAR** variants alongside newly identified backdoors **PYLOT** and **BYEBY**. Across both cases, researchers highlighted shared infrastructure, malware lineage, and tooling overlaps that support the view that multiple espionage operators were drawing from a common malware supply chain.
Aug 15, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026