Loading story…
Palo Alto Networks researchers reported that a targeted phishing campaign against a U.S.-based government organization delivered QuasarRAT through malicious RTF files and Crimson Downloader through a weaponized Excel document. During the investigation, they found an open directory on subaat[.]com containing 84 unique malware payloads across multiple commodity malware families, indicating the infrastructure was being used as a broader malware staging repository rather than for a single intrusion set.
The analysis linked much of the activity to 115.186.136[.]237, an IP address that both interacted with the repository and acted as command-and-control for several samples. Researchers noted overlaps with earlier Crimson Downloader activity, including Operation Transparent Tribe and Operation C-Major, while separate Palo Alto reporting on LuminosityLink RAT underscored the wider use of commodity remote-access malware and configurable tooling in such campaigns; however, the evidence in the Subaat case was described as only marginal and insufficient for firm attribution, despite indicators suggesting a possible Pakistan nexus.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Beginning on July 16, 2017, Unit 42 observed 43 phishing emails tied to the campaign. The lures delivered either CVE-2012-0158 RTF downloaders for QuasarRAT or a macro-enabled Excel file that dropped Crimson Downloader.
Unit 42 identified a targeted phishing campaign aimed at a U.S.-based government organization in mid-July 2017. The campaign used subject lines including "Invention" and "Invention Event" and delivered malicious RTF and Excel files.
Unit 42 linked a registration email found in LuminosityLink samples to a HackForums account named "Subaat," whose posting activity resumed in early July 2017. The timing aligned with the later phishing campaign.
Unit 42 observed 16 unique Crimson Downloader samples communicating with 5.189.157.215 starting in May 2017. The IP was described as being located in Germany and almost exclusively associated with Crimson Downloader in their telemetry.
Unit 42 reported that historical WHOIS data for subaat.com from early 2016 referenced a Pakistani location, providing background context on the infrastructure later used in the campaign.
Palo Alto Networks Unit 42 published research describing the July 2017 phishing campaign, the subaat.com malware repository, and infrastructure overlaps involving 5.189.157.215 and 115.186.136.237. The report noted similarities to Operation Transparent Tribe and Operation C-Major but said the attribution evidence was not conclusive.
During its investigation, Unit 42 found that directory listing was enabled on subaat.com and uncovered a repository hosting 84 unique malware payloads and scripts. The hosted malware included QuasarRAT, LuminosityLink, DarkComet, Meterpreter, NJRAT, RevengeRAT, and RemcosRAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 94 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
researchcenter.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026