Loading story…
The NSA and FBI published a joint advisory describing Drovorub, a malware platform attributed to Russia’s GRU GTsSS, military unit 26265, and detailing its command-and-control behavior, including WebSocket-based communications. Building on those indicators and protocol details, Insane Forensics released an open-source hunting tool designed to help defenders identify Drovorub activity across both historical PCAP data and live network traffic using Elasticsearch, Kibana, Python, and TShark, with pivots for sessions, modules, actions, tunnels, and file transfers.
Separate malware analysis by FortiGuard Labs showed a memory-resident Windows payload launched inside dllhost.exe after script- and PowerShell-based execution, with corrupted PE headers that required manual reconstruction from memory. The sample decrypted the C2 domain rushpapers.com on port 443, used a WebSocket-style HTTP upgrade over TLS, and added a custom XOR-based encryption layer, while exposing remote-access functions such as screenshot capture, active-window collection, service control, and listener mode. Together, the reporting highlights how defenders are tracking malware families that hide C2 traffic inside WebSocket-like channels and how network-focused hunting can help surface that activity.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Incident Response reported analysis of a memory-resident Windows malware sample recovered from a compromised machine, reconstructing the payload from memory after its PE headers were corrupted. The analysis found the malware used TLS plus a WebSocket-style HTTP upgrade to communicate with rushpapers.com on port 443 and confirmed RAT capabilities including screenshots and listener mode.
Insane Forensics released a free, open-source tool to hunt for Drovorub command-and-control traffic using Elasticsearch, Kibana, Python, and TShark. The tool was built from technical indicators and protocol details in the NSA/FBI report rather than real malware samples or packet captures.
The NSA and FBI released a report describing the command-and-control capabilities of Drovorub malware and attributed it to Russia’s GRU 85th Main Special Service Center (GTsSS), military unit 26265.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourcegithub.com
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026
A series of DFIR case studies documented how attackers are increasingly relying on living-off-the-land techniques, uncommon runtimes, and legitimate administration tools to maintain access while evading detection. On Windows, investigators dissected a PHP backdoor that used `php-win.exe`, a scheduled task named **ClockLauncher**, and a **ClockSystemService** service to fetch and execute second-stage code invisibly; a separate intrusion used mailbombing and Microsoft Teams vishing to deliver a modular **Deno**-based RAT and proxy that persisted via the `HKCU\Run` key and communicated over WebSocket infrastructure hosted behind CloudFront. Another investigation traced a malicious `.lnk` file to a WebDAV-hosted **Remcos** payload cached under `TfsStore\Tfs_DAV`, while repeated compromises of a vulnerable **Kentico CMS** server led to webshell deployment, SEO spam, PowerShell-based payload retrieval, and installation of a malicious IIS module, **HTTPCacheLog**, that accepted commands through HTTP cookies. On Linux and cloud infrastructure, researchers showed how attackers abused both commodity malware and stealthier post-exploitation tooling. TeamTNT-linked activity used **tmate** as a covert backdoor on Linux servers, often without normal login traces, while analysis of the **REPTILE 2.0** rootkit loader showed it bypassing `insmod` by decrypting an embedded kernel module and loading it directly with the `init_module` syscall. A separate **Sysrv** botnet infection established cron persistence, masqueraded as `kthreaddk`, and included exploitation and brute-force features for propagation. In AWS, an extortion actor deleted S3 buckets and supplied a fake Linux “recovery” binary that merely simulated restoration rather than recovering cloud data. Across the investigations, defenders were urged to hunt for recurring artifacts such as scheduled tasks, Run keys, suspicious services, unusual binaries in user-writable paths, outbound SSH or WebSocket traffic, and syscall-level module loading, using telemetry and tools including **Velociraptor**, AutoRuns, Sysmon, and CloudTrail.
Aug 1, 2026