Loading story…
Researchers and incident responders documented a targeted intrusion campaign by CryptoMimic—also tracked as Dangerous Password, CageyChameleon, and Leery Turtle—that focused on banks, financial organizations, and especially cryptocurrency businesses. The attacks used spear-phishing lures that delivered ZIP or RAR archives containing malicious .lnk shortcut files and decoy documents; when opened, the shortcuts launched mshta.exe to fetch remote HTML or VBScript payloads. JPCERT/CC said the activity hit Japanese organizations tied to cryptocurrency operations, while later analysis captured a full intrusion chain in which the initial script deployed staged implants including Cabbage RAT variants, a browser information stealer, msoRAT, and a credential theft component that abused Windows Security Packages.
Across the reports, the malware showed consistent tradecraft: persistence through Startup-folder shortcuts and registry changes, victim filtering and antivirus checks, host reconnaissance via WMI, and command-and-control through Bitly links and spoofed cloud-themed domains such as cloudfiles.club and msupdatepms.xyz. The operators collected browser cookies, saved passwords, OS and hardware details, process lists, and likely system credentials, then used interactive follow-on access, including legitimate VNC tools, for manual post-compromise activity and possible cryptocurrency theft. Investigators also observed cleanup actions such as event log deletion and destructive behavior, and noted that the tooling and operational patterns shared multiple similarities with activity previously linked to Lazarus, though attribution remained unconfirmed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
An April 2020 analysis reported that the malware's reconnaissance format and tradecraft were consistent with activity observed since mid-2019. It also assessed the campaign as focused on cryptocurrency theft and likely involving manual post-compromise actions.
The researchers monitored 15 CryptoMimic attacks during March 2020 and noted no attacks on Sundays. The observations reinforced that the actor's tactics had remained stable while targeting finance and cryptocurrency victims.
Researchers observed a complete CryptoMimic intrusion in February 2020 that unfolded in about three hours. The chain progressed from a phishing-delivered LNK file through multiple Cabbage RAT stages, a browser information stealer, msoRAT, and a credential stealer.
As of 26 June 2019, JPCERT/CC reported that it could not confirm details of update.gdrives.top because the hostname no longer resolved. This showed the attackers had already made parts of the infrastructure unavailable to analysis.
A later analysis cited a June 2019 Japanese CERT report as documenting the same categories of host data collection, including VBS execution path, network adapter information, and running processes. This tied the observed intrusion chain to activity seen since mid-2019.
JPCERT/CC observed targeted emails sent to some Japanese organizations beginning in June 2019. The campaign used cloud-hosted ZIP downloads containing a password-protected decoy document and a malicious Password.txt.lnk shortcut that launched mshta.exe to fetch VBScript.
Researchers assessed that the CryptoMimic threat actor had been active since around March or April 2018, using largely consistent tradecraft. The group targeted banks, finance organizations, and especially cryptocurrency-related companies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceblogs.jpcert.or.jp
Open sourcevb2020.vblocalhost.com
Open sourcevb2020.vblocalhost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have used **Parallax RAT**, a low-cost remote access Trojan sold on criminal forums, in phishing and spam campaigns that compromise Windows systems and increasingly target cryptocurrency organizations. Delivery has relied on malicious Microsoft Word attachments, embedded macros, and exploits such as `CVE-2017-11882`, giving attackers full remote access for credential theft, file theft, clipboard monitoring, keylogging, command execution, and broader system control. Researchers reported that the malware has been active since late 2019 and has remained a common payload because of its low price and ease of deployment. Technical analyses show Parallax RAT using multi-stage loaders, process hollowing, and persistence mechanisms including the Windows Startup folder and scheduled tasks. Recent samples decrypted payloads with **RC4**, injected into legitimate processes including `pipanel.exe`, `Notepad.exe`, `mstsc.exe`, and `cmd.exe`, and fetched additional components from services such as **Pastebin** and **Imgur**, while some command-and-control infrastructure used **DuckDNS**. Investigators also observed attacker interaction through Windows Notepad, victim instructions pointing to a Telegram channel, and cleanup scripts designed to delete payloads and remove traces after execution.
Aug 14, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026