Loading story…
Researchers linked new LazyScripter activity to the Octopus backdoor after analyzing malicious document lures that targeted Windows users with a fake patch PDF and a Microsoft Word file containing embedded fake PDF objects. In both cases, user interaction triggered heavily obfuscated batch scripts that downloaded additional payloads from hpsj.firewall-gateway.net, a domain tied to the campaign. Reporting indicates the group has targeted the airline sector since at least 2018, and the latest samples reused infrastructure and tradecraft previously associated with Octopus.
The scripts focused on rapid host takeover by elevating privileges, disabling Microsoft Defender and other Windows security controls, tampering with services and scheduled tasks, modifying the registry for persistence, and using PowerShell download cradles to fetch next-stage malware over ports 80 and 443. The final payload collected host, user, and process information, encrypted the stolen data with AES-CBC, and sent it to command-and-control endpoints on the same domain. MITRE ATT&CK tracking for LazyScripter also aligns the group with phishing-led initial access, PowerShell and VBScript execution, registry-based persistence, defense evasion, tunneling, and RAT-style post-compromise activity.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On May 10, 2022, a GitHub-hosted analysis described a malicious PDF lure attributed to LazyScripter that masqueraded as a patch installer, downloaded a password-protected ZIP, and dropped obfuscated batch scripts. The write-up detailed privilege escalation, Defender tampering, persistence, follow-on PowerShell payload retrieval, and AES-CBC-encrypted data theft to hpsj.firewall-gateway.net endpoints.
On May 9, 2022, SANS published analysis of a malicious Word document that used embedded fake PDF objects to launch an obfuscated batch script instead of VBA macros. The script disabled Microsoft Defender and other protections, established persistence, and downloaded additional payloads from hpsj.firewall-gateway.net infrastructure linked to the Octopus backdoor.
A Malwarebytes PDF report on LazyScripter was published in 2021, indicating public documentation of the group by that time. The reference provides only the year through the file path.
The SANS diary says the Octopus backdoor had been documented previously in 2020 before the newly analyzed sample appeared. This establishes prior public reporting on the malware family.
The analyzed malware write-up states that the LazyScripter threat group has mainly targeted the airline industry since at least 2018. This is the earliest explicit temporal anchor in the references.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceisc.sans.edu
Open sourcemalwarebytes.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Patchwork, an advanced persistent threat group also known as Monsoon, Dropping Elephant, and Hangover Group, has launched a new espionage campaign characterized by the use of sophisticated malware delivery techniques. The campaign begins with the distribution of malicious Microsoft Office documents containing illicit macros, which, when executed, trigger PowerShell scripts on the victim's system. These scripts are designed to download a trojanized executable that masquerades as the VLC media player, furthering the deception. The malware then sideloads a fake DLL library, a technique that allows it to evade detection by security software and gain persistence on the infected machine. To further obfuscate its activities, the malware injects a decoy PDF file into the Public Documents folder, likely to distract users and security analysts. A scheduled task is established in Windows to ensure the malicious executable is triggered regularly, maintaining the attacker's foothold. The final Patchwork payload is then loaded, enabling the threat actors to conduct extensive espionage operations. Technical analysis revealed that the malware uses Scourgify encoding to exfiltrate command outputs, making detection and analysis more challenging. The malware is also capable of running commands that segment large files, allocate executable memory, and capture full-screen screenshots, providing attackers with comprehensive surveillance capabilities. The campaign demonstrates a high level of modularity, allowing Patchwork to adapt its tactics and payloads as needed. Security researchers have recommended that organizations implement robust endpoint protection solutions to defend against such modular and stealthy threats. The use of DLL sideloading and layered obfuscation techniques highlights Patchwork's ongoing evolution and sophistication in cyber-espionage. The campaign's reliance on PowerShell-based loaders and scheduled tasks underscores the importance of monitoring script execution and task creation within enterprise environments. The attack chain leverages both social engineering, through malicious documents, and technical stealth, through obfuscation and sideloading. Patchwork's activities in this campaign are consistent with its historical focus on espionage against government and strategic targets. The campaign's discovery was attributed to detailed analysis by K7 Security Labs, which provided insights into the malware's operation and recommended defensive measures. Organizations are urged to educate users about the risks of enabling macros in Office documents and to monitor for unusual scheduled tasks and PowerShell activity. The campaign serves as a reminder of the persistent and evolving nature of APT threats targeting sensitive information.
Jun 29, 2026
The **Lazarus Group** ran a spearphishing campaign that delivered malicious Microsoft Word documents to targets in aerospace, defense, research, and financial sectors, including organizations linked to Boeing, BAE Systems, Lockheed Martin, and the Republic of Korea Army. The infection chain used remote template injection to fetch an external `DOTM` file, whose macro dropped a lure document and a malicious DLL such as `onenote.db` into the victim’s `AppData` path, then executed the implant while showing a decoy file to reduce suspicion. Related reporting describes similar Lazarus lures sent in spoofed emails, with separate payloads for 32-bit and 64-bit systems and reconnaissance-focused first-stage malware. The implant executed through **`rundll32.exe`** and established persistence via the Windows **Startup folder**, techniques widely tracked in MITRE ATT&CK as `T1218.011` and `T1547.001`. Once active, it collected host, process, and disk information, compressed or encrypted the data, and exfiltrated it over HTTP POST using compromised or attacker-controlled infrastructure, including IIS/Plesk-hosted domains such as `elite4print.com` and `astedams.it`. Analysts linked the activity to Lazarus based on recurring tradecraft, lure themes, victim profiling, and overlap with operations such as **Operation Dream Job**, where the group similarly abused `rundll32.exe` and autostart mechanisms for stealthy execution and persistence.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026