Loading story…
Attackers used the legitimate Windows finger.exe utility in a phishing campaign to download and install the MineBridge backdoor, turning a rarely used Windows command into a living-off-the-land malware delivery tool. The lures arrived as malicious Word documents disguised as job applicant resumes, and victims who enabled editing or content triggered a password-protected macro that fetched a Base64-encoded payload from a remote server. The payload was written to %AppData%, decoded with certutil.exe, and executed, showing how multiple native Windows tools were chained together to avoid suspicion.
The downloader then retrieved a TeamViewer executable and used DLL hijacking to sideload MineBridge, ultimately giving the attackers broad remote access to infected systems. Reported capabilities included command execution, file download, process control, system information collection, and microphone access through TeamViewer. FireEye had previously linked MineBridge to phishing activity targeting South Korean organizations, indicating the campaign fit an established pattern of malware delivery and post-compromise remote control.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
SentinelLabs published technical analysis of a TA505 crypter, stating it had been used since at least September 2019 and that crypter overlap linked TA505 activity with Clop/CryptoMix tooling and with FireEye-reported MINEBRIDGE samples. The report also disclosed additional related malware, decoded command-and-control artifacts, sample hashes, domains, and YARA rules for detecting the packer.
Zscaler ThreatLabZ reported new MINEBRIDGE RAT instances discovered in January 2021, delivered through macro-enabled Word documents disguised as resumes and using finger.exe, certutil.exe, a self-extracting archive, and TeamViewer DLL side-loading. The report assessed with moderate confidence that the activity was likely conducted by TA505 based on similarities in lure themes and command-and-control infrastructure to earlier MINEBRIDGE operations.
FireEye previously reported numerous phishing campaigns targeting South Korean organizations that delivered the MineBridge malware and documented its remote-access capabilities.
Security researcher Kirk Sayre found a phishing campaign using malicious Word documents disguised as job applicant resumes to abuse Windows finger.exe, certutil.exe, and DLL hijacking to install the MineBridge backdoor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcelabs.sentinelone.com
Open sourcebleepingcomputer.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a multi-stage malware campaign that used fake trading software installers to deliver **MineBridge RAT**, including a trojanized **TradingView Desktop** package served from the look-alike domain `tradingview[.]cyou`. The malicious Windows installer, signed by **YUNIVELL, LLC**, selectively targeted Windows 10 systems and launched PowerShell-based stages that installed and configured **OpenSSH**, retrieved attacker-controlled keys and configuration, and established a reverse SSH tunnel to `86.106.181[.]183:32672` to maintain remote access. The operation also relied on shortened URLs and additional lures such as `Bitcoin_Trade.exe`, `Arbitrage_Bot.exe`, and `Polarr_Setup (2).exe`. Follow-on stages created scheduled tasks disguised as **OneDrive Sync** and **Google Disk Sync** to fetch more PowerShell payloads, eventually deploying **NetSupport** client components and MineBridge RAT. The malware chain abused **TeamViewer** for DLL side-loading, giving operators persistent control while blending into legitimate remote administration activity. Reporting indicates the campaign reflects a sophisticated delivery mechanism built to evade suspicion by impersonating trusted trading tools and layering multiple persistence and remote-access techniques.
Aug 15, 2026
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026
Security researchers reported active phishing activity targeting enterprise users by impersonating routine workplace workflows (e.g., meeting invites, invoices, and document notifications) to trick recipients into running malware. One campaign used executables masquerading as *Microsoft Teams*, *Zoom*, and *Adobe Acrobat Reader* installers (e.g., `msteams.exe`, `zoomworkspace.clientsetup.exe`, `adobereader.exe`, `invite.exe`) that appeared trustworthy because they were **digitally signed** with an Extended Validation (EV) certificate issued to **TrustConnect Software PTY LTD**. Microsoft Defender telemetry attributed the activity to an unknown threat actor and assessed the approach as a deliberate, multi-wave effort designed to bypass user suspicion and basic security controls. After execution, the signed malware deployed **remote monitoring and management (RMM)** tooling—reported examples include **ScreenConnect**, **Tactical RMM**, and **Mesh Agent**—to establish persistent remote access and enable follow-on actions across affected environments. Separately, reporting also highlighted phishing lures distributing **malicious ISO attachments** embedded in job application/resumé-themed emails, reinforcing that attackers continue to rely on socially engineered business processes (recruiting and HR workflows in particular) to deliver initial payloads and gain a foothold.
Jun 29, 2026