Loading story…
Researchers reported a spear-phishing campaign against Rubin Design Bureau, a Russian defense contractor involved in submarine design for the Russian Navy, in which attackers used a modified RoyalRoad RTF weaponizer to exploit legacy Microsoft Equation Editor flaws including CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802. Unlike the common RoyalRoad pattern that drops an encoded payload named 8.t, the observed variant used e.o and installed a previously undocumented backdoor, PortDoor, as a Microsoft Word add-in to maintain persistence. PortDoor supports reconnaissance, file and process manipulation, privilege escalation, proxy-aware command-and-control, and encrypted data exfiltration.
The intrusion fits a broader pattern of Chinese-linked espionage groups continuing to rely on RoyalRoad across Asia and beyond, with prior research tying the builder to clusters such as TA428, Tonto, Tick, Naikon, and Sharp Panda in campaigns against government, defense, diplomatic, and trade targets in Russia, Japan, Southeast Asia, the Philippines, and China. Multiple reports show the tool has been adapted over time to deliver different malware families—including Soul, HZ RAT, Hussarini, and other remote access payloads—while preserving recognizable RTF tradecraft that remains useful for hunting and attribution.
TTPs, infrastructure, and targeting history in one profile.
21 events from the most recent confirmed update back to the earliest known activity.
The Soul backdoor sample analyzed by Check Point was compiled on 2022-11-29 02:12:34 UTC. The newer campaign used SoulSearcher to load modules of the Soul malware framework instead of the previously seen VictoryDll payload.
By reimplementing the HZ Rat protocol, researchers found that more than 10 command-and-control servers were still online and responding as of 2022-08-02. Maintaining communication also allowed them to extract full command lists from the servers.
The HZ Rat campaign introduced packed samples in early July 2022. Researchers identified three custom packer variants: packed_base64_v1, packed_base64_v2, and packed_aes_v1.
Check Point reported that in late 2022, a campaign resembling earlier Sharp Panda operations targeted a high-profile Southeast Asian government entity. The attackers used spear-phishing documents, a RoyalRoad weaponized RTF, and the 5.t Downloader.
Check Point said Sharp Panda was previously identified in 2021 as a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. The cluster was tied to campaigns against countries including Vietnam, Thailand, and Indonesia.
In November 2020, attackers used two emailed RTF files related to Royal Road in an attack against Japan. The files delivered an unidentified remote access trojan that the researchers named XLBug RAT.
DCSO CyTec said the HZ Rat backdoor campaign had been active since at least October 2020. The malware was delivered through malicious RTF documents exploiting CVE-2017-11882 and self-extracting archives masquerading as legitimate software.
NAO_SEC observed a Royal Road attack by TA410 in October 2020. The FlowCloud sample used in the case was similar to FlowCloud v4.
NAO_SEC observed Royal Road attacks by FunnyDream from March to May 2020. The activity involved malware associated with the group, including Chinoxy and FunnyDream Backdoor.
NAO_SEC observed a Royal Road attack by Vicious Panda in March 2020. The activity reportedly executed malware similar to Enfal and BYEBY.
NAO_SEC observed a Royal Road attack by Higaisa in March 2020. The malware executed in that case was AttackBot, a downloader the group had used since at least April 2018.
NAO_SEC reported observing two new Royal Road payload encodings during 2020: "A9 A4 6E FE" and "94 5F DA D8." The rr_decoder tool was updated to support decoding these newly seen formats.
360 Security Center said it had intercepted Bayworld attacks since October 2019. The campaign targeted foreign trade companies, transportation firms, and major maritime ports across countries including China, Egypt, and Ukraine.
By mid-May 2019, Trend Micro assessed that TICK had shifted attention from primarily defense targets toward chemical-sector victims. The group was believed to be seeking proprietary and classified information, including advanced materials data.
NAO_SEC concluded that attacks using the Royal Road RTF weaponizer were still active in 2019. The report also grouped confirmed users such as Tick, TA428, and Tonto into regional clusters for attribution and hunting.
In January 2019, TICK compromised a Japanese economic research company and a public relations agency to steal email credentials, files, and decoy documents. The stolen resources were then used to support spear-phishing operations.
Trend Micro observed an unusual increase in TICK malware development and deployment around November 2018 as part of Operation ENDTRADE. The campaign targeted Japanese-headquartered defense, aerospace, chemical, and satellite organizations with subsidiaries in China.
NAO_SEC reported collecting and analyzing more than 100 malicious Royal Road-related documents from 2018 to study their exploit patterns, dropped files, and attribution signals. The survey helped map multiple actor clusters using the tool.
FortiGuard said the Hussarini, also known as Sarhust, backdoor was first mentioned in campaigns targeting the Philippines and Thailand. The report also assessed Hussarini had been used actively against ASEAN targets since that year.
After analyzing the PortDoor intrusion, Cybereason assessed that the campaign bore the hallmarks of a threat actor operating on behalf of Chinese state-sponsored interests. The company said it could not attribute the activity with reasonable certainty to a specific known group, though it noted similarities with Tonto Team and TA428.
Cybereason analyzed a spear-phishing campaign targeting a general director at Rubin Design Bureau in St. Petersburg with a malicious RTF lure about an autonomous underwater vehicle. The document used a modified RoyalRoad variant that dropped "e.o" instead of the usual "8.t" and installed the previously undocumented PortDoor backdoor as the Word add-in file winlog.wll.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 335 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open sourceresearch.checkpoint.com
Open sourcemedium.com
Open sourcenao-sec.org
Open sourcenao-sec.org
Open sourceblog.360totalsecurity.com
Open sourceblog.trendmicro.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers traced a **SideWinder** spearphishing campaign to a malicious Word document named **"Briefing on Ongoing Projects.docx"** that fetched a remote RTF template from a spoofed domain and exploited Microsoft Equation Editor via `CVE-2017-11882`. The recovered RTF decrypted embedded JavaScript, launched an obfuscated script, and executed a .NET component that profiled installed antivirus products before attempting to download a further payload stage. Investigators found the originally malicious RTF had later been replaced with a nearly empty placeholder file, a tactic that obscured follow-on analysis while preserving infrastructure clues. Additional infrastructure and tradecraft links tied the activity to broader South Asian espionage patterns involving malicious RTF lures, Equation Editor exploitation, and multi-stage loaders. Fortinet separately documented a spearphishing attack against a telecommunications agency in South Asia using an RTF lure that exploited `CVE-2018-0798`, abused **Logitech** DLL search order hijacking with a signed executable and malicious `LBTServ.dll`, injected into `svchost.exe`, and contacted `instructor[.]giize[.]com` to retrieve a payload linked through OSINT to **PoisonIvy RAT**. Across the references, the campaigns show consistent use of document-based initial access, obfuscated intermediate stages, and reusable infrastructure and tooling associated with long-running regional espionage operations.
Aug 15, 2026
TA428 conducted **Operation LagTime IT**, a cyber-espionage campaign targeting government organizations in East Asia and defense- and aviation-related entities in Russia and Mongolia. The intrusions used Royal Road-generated malicious RTF documents exploiting **`CVE-2018-0798`** in Microsoft Word, including lures themed around **Qasem Soleimani** and **COVID-19**, to deliver **Poison Ivy**, **Cotx RAT**, and the malware later identified as **nccTrojan** or **MsmRAT**. Researchers said the activity was observed from at least March 2019 through 2020 and showed overlap with Chinese intrusion clusters including **Tick**, **Tonto**, and possibly **DragonOK/Danti**. After initial compromise, the operators stole credentials from Outlook and **`lsass.exe`**, scanned victim networks, and moved laterally using **`MS17-010`** tooling including EternalBlue-related exploitation. TA428 also used **NBTScan**, DLL side-loading with legitimate Intel and PotPlayer binaries, malicious **`.wll`** files for persistence, and follow-on malware such as **Tmanger**, **Poison Ivy-B**, and multiple **nccTrojan** variants. Researchers found that **nccTrojan** had at least two major branches: an initial-access version with standard RAT functions and XOR-obfuscated traffic, and a later-stage version installed as a Windows service that used a custom TCP protocol with **AES-encrypted** payloads and an activation code for command handling.
Aug 15, 2026
**Fancy Bear (APT28)** has been attributed with high confidence to *Operation Neusploit*, a campaign targeting users in Central and Eastern Europe by weaponizing **CVE-2026-21509**, a **Microsoft RTF** parsing zero-day that enables arbitrary code execution via specially crafted RTF documents. Reported lures were written in multiple languages (including English, Romanian, Slovak, and Ukrainian) and targeted victims in **Ukraine, Slovakia, and Romania**. Microsoft issued an **out-of-band patch** for CVE-2026-21509 on **January 26, 2026**, with in-the-wild exploitation observed shortly after. Post-exploitation activity was described as a multi-stage chain that retrieves a malicious dropper DLL from attacker infrastructure and then deploys different payload paths, including **MiniDoor** (focused on Outlook email theft/exfiltration) and **PixyNetLoader**, which ultimately leads to a **Covenant Grunt** implant for command-and-control. The campaign also uses **evasion and targeting controls**, including region-restricted payload delivery (e.g., only serving malicious DLLs to requests from targeted geographies and specific `User-Agent` patterns) and persistence techniques such as **COM hijacking**, plus additional tradecraft like **steganography in PNG files** and shellcode loading to execute the final implant.
Jun 29, 2026