Loading story…
Trend Micro reported a Cobalt Strike intrusion that began with a socially engineered spear-phishing email carrying a malicious .xls attachment. The file triggered excel.exe, which spawned rundll32.exe, loaded iroto.tio, and hollowed mobsync.exe to conduct reconnaissance and establish command-and-control activity. Managed XDR and Vision One alerts helped investigators reconstruct the attack chain and identify the initially compromised endpoint as Patient Zero.
The investigation linked activity across multiple endpoints through indicators of compromise, suspicious process chains, SMB-based lateral movement, and evidence of Pass-the-Hash abuse. Trend Micro said responders moved to isolate affected systems, reset compromised accounts, block command-and-control infrastructure, and continue monitoring to prevent the intrusion from progressing to a likely ransomware stage.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published its investigation describing how Vision One and Managed XDR traced the intrusion to a spear-phishing entry point, linked activity across endpoints, and highlighted containment actions to prevent ransomware-stage escalation.
In late May 2021, Trend Micro began investigating a customer environment after a noteworthy Vision One alert on one endpoint. The investigation expanded to multiple endpoints and uncovered Cobalt Strike activity along with a machine learning detection later verified as IcedID.
A third machine, Endpoint-3, showed blocked execution of excel.exe spawning rundll32.exe and a machine learning detection for iroto.tio. Its execution profile also showed connections to the same suspicious domains seen earlier in the intrusion.
A second affected machine, Endpoint-2, generated a Cobalt Strike detection. Trend Micro found ntoskrnl.exe executing 49c4b8e.exe, indicating the file had likely been transferred over SMB as part of lateral movement.
Trend Micro Investigation Toolkit and Vision One identified potential Pass-the-Hash activity on Endpoint-1. Event logs contained 4624 logon events with seclogo as the process, which the investigators linked to credential abuse.
On Endpoint-1, the injected mobsync.exe ran host and network discovery commands, while BloodHound and AdFind.exe were used to extract Active Directory information. Logs also showed deletion of a BloodHound ZIP archive and AdFind execution to enumerate computer objects.
Trend Micro determined the intrusion began when an internal user executed the malicious XLS file analysis-57909253.xlsx delivered via a socially engineered spear-phishing email. The resulting process chain involved excel.exe spawning rundll32.exe, loading iroto.tio, and hollowing mobsync.exe for command-and-control and reconnaissance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious Excel spreadsheets distributed in ZIP archives were used to infect Windows systems with malware assessed as likely **SystemBC**, using a GlobalSign-themed lure to convince users to enable macros. Once executed, the macro downloaded a Windows payload, wrote it to a newly created path under `C:\`, and established persistence through a scheduled task. The infected host then communicated with `109.234.39.169` over TCP port `4001`, consistent with the observed SystemBC-related activity. Follow-on intrusion activity included HTTP requests that returned obfuscated code used to launch **Cobalt Strike**, followed by HTTPS and DNS beaconing tied to `fastonent[.]com` and `192.169.6.8`. The observed post-compromise behavior differed by environment: in an Active Directory lab, the infection progressed to Cobalt Strike activity, while a stand-alone host showed only the suspected SystemBC communications, indicating the malware chain may selectively deploy additional tooling on domain-connected systems.
Aug 15, 2026
Mandiant reported that **DARKSIDE** operated as a ransomware-as-a-service group that combined data theft and file encryption, with affiliates conducting intrusions that moved from initial access to hands-on-keyboard post-exploitation before deploying ransomware. The group’s operations were associated with common enterprise attack tooling and tradecraft designed to blend into Windows environments, helping operators maintain access, move laterally, and prepare victim networks for extortion. The referenced techniques and detections show how that activity can appear on endpoints: adversaries may abuse trusted Microsoft utilities `Regsvcs` and `Regasm` under MITRE ATT&CK **`T1218.009`** to proxy malicious .NET code execution and evade application controls, while post-compromise activity may also surface through **Cobalt Strike** named pipes tied to Beacon, Artifact Kit, and Malleable C2 profiles. Splunk previously published analytics based on Sysmon Event IDs **17** and **18** to identify those pipe patterns, underscoring how defenders can spot the command-and-control and lateral movement behavior often seen in ransomware intrusions linked to groups such as DARKSIDE.
Aug 15, 2026
Government and industry reporting described multi-stage intrusions in which ransomware and extortion actors gained access through **unpatched Microsoft Exchange ProxyShell flaws**, phishing, compromised credentials, and exposed **RDP** services. Truesec documented attacks where ProxyShell-compromised Exchange servers were used to hijack existing email threads and deliver **Datoploader/Squirrelwaffle** and **QBot**, after which a likely Conti-affiliated actor used **Cobalt Strike**, **RDP**, and privilege escalation to move laterally, enumerate Active Directory, exfiltrate sensitive data, delete backups, and deploy **Conti ransomware**. A recurring artifact in the phishing stage was the Exchange `MessageClass` value `IPM.Blabla`, and infected hosts created `C:\Datop` before executing payloads with `regsvr32.exe` and persistence via registry autoruns or scheduled tasks.
Aug 15, 2026