Loading story…
Seqrite Labs reported phishing campaigns using fake PayPal-themed Word documents to deliver Cronus, a fileless ransomware strain that relies on heavily obfuscated VBA macros and PowerShell to evade detection. The malicious attachment launches PowerShell, retrieves a second-stage loader disguised as a JPEG, and executes the ransomware in memory through reflective DLL loading, avoiding a conventional on-disk payload and complicating forensic analysis.
The final .NET payload copies itself for persistence, creates Run key entries, enumerates and AES-encrypts files, terminates processes, changes the victim's wallpaper, drops a ransom note, and manipulates the clipboard to swap Bitcoin wallet addresses. The campaign's use of command and script obfuscation aligns with MITRE ATT&CK T1027.010, a technique widely used by both criminal and state-backed operators, and Seqrite said Cronus tooling shares code overlap with other fileless malware campaigns involving Revenge RAT, Arrow RAT, Async RAT, Andromeda RAT, XWorm, and njRAT.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Seqrite said it observed the Cronus campaign on 14 July 2024 after finding a malicious PayPal-themed Word document on VirusTotal. The lure used a file named paypal_charges.doc that impersonated a PayPal receipt and initiated a fileless ransomware infection chain.
Seqrite Labs reported multiple July 2024 campaigns delivering a new fileless ransomware variant called Cronus via malicious VBA macros, PowerShell, and reflective DLL loading. The report detailed persistence, AES-based encryption, ransom note creation, process termination, clipboard wallet replacement, and code overlap with other fileless malware campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Aryaka Threat Research Labs reported a multi-stage **CRPx0** malware campaign that tricks users searching for “free OnlyFans accounts” into opening a malicious ZIP archive containing a disguised shortcut. The shortcut launches hidden commands and a VBScript loader that prepares the host, installs components for Python-based malware, and connects to a remote server for interactive attacker control. Researchers said the operation targets **Windows** and **macOS**, with possible **Linux** support in development, and is built to blend into normal user behavior rather than rely on a single obvious malicious action. Once active, the malware supports clipboard-based cryptocurrency theft, credential and data harvesting, system reconnaissance, selective exfiltration, and eventual ransomware deployment in a **double-extortion** scheme. Stolen content reportedly includes documents, media, emails, and source code before files are encrypted with the `.crpx0` extension; the malware then changes the desktop wallpaper to a “gotcha” image and drops multilingual ransom notes directing victims to contact the operators via email, **qTox**, and **Telegram**. Reporting also said the group runs a leak site claiming 38 victims and more than 10,839 TB of leaked data, while offering access to stolen information for **$500** in cryptocurrency.
Jun 29, 2026
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026