Loading story…
A malware campaign targeting Korean users distributed Orcus RAT and XMRig by disguising the payload as a cracked installer for Hangul Word Processor 2022 on file-sharing sites. AhnLab said the installer used 7z SFX archives, obfuscated PowerShell, Windows Defender exclusion changes, Google Docs-hosted payload retrieval, NirCmd, and scheduled tasks to evade detection and maintain persistence. The downloader checked for analysis environments and installed security tools, exfiltrated host details through the Telegram API, and then selectively deployed a coin miner or additional malware components. On some systems, particularly those with Telegram or Visual Studio installed, the actor installed Orcus RAT and enabled broad remote access, including keylogging, webcam access, remote desktop control, and RDP activation through an OrcusRDP account.
The activity reflects the continued criminal use of Orcus, a commercially sold modular RAT previously documented by Palo Alto Networks Unit 42 as a low-cost malware platform with plugin support and live scripting capabilities. Unit 42 reported that Orcus was built around separate controller, server, and victim components and supported functions such as password theft, remote code execution, webcam and microphone monitoring, reverse proxying, and hidden virtual network computing. The Korean campaign also showed anti-analysis behavior consistent with Orcus tradecraft, including checks for virtualized environments and monitoring tools, while the bundled XMRig miner was injected into explorer.exe, paused during games or monitoring activity, and attempted to kill security-related processes to hinder remediation.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Orcus started being sold for about $40, with Unit 42 identifying "Sorzus" and partner "Armada" as the main people behind its development, sales, and support. The malware was marketed as a remote administration tool despite its malicious capabilities.
Around October 2015, the developer using the alias "Sorzus" posted about the malware, then called "Schnorchel," on a hacker forum and asked for feedback on publishing it. Forum users encouraged commercialization instead of releasing it for free or open source.
ASEC identified a campaign distributing malware through file-sharing sites as a cracked Hangul Word Processor 2022 installer. The installer deployed XMRig CoinMiner broadly and installed Orcus RAT instead of the actor's previously used BitRAT on some systems, especially when Telegram or Visual Studio was present.
ASEC said the same threat actor had earlier distributed BitRAT and XMRig CoinMiner on file-sharing sites while disguising them as a Windows license verification tool. This earlier campaign primarily targeted Korean users through file-sharing sites and torrents.
Palo Alto Networks Unit 42 reported on Orcus, describing its modular controller-server-trojan architecture, plugin ecosystem, real-time scripting, delivery vectors, and anti-analysis checks. The report assessed Orcus as a malicious RAT and documented its growing criminal utility.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors distributed **Orcus RAT** and **RevengeRAT** through phishing emails masquerading as official complaints, using delivery methods that shifted from SendGrid-linked downloads to ZIP archives containing malicious batch files and script-based payloads. Reporting tied the activity to organizations worldwide, including government, financial services, IT services, and consulting sectors, and linked both malware families to the same client identifier, `CORREOS`, suggesting shared campaign infrastructure or operator overlap. Technical analysis showed heavily obfuscated infection chains built around VBS, batch, and PowerShell components, with payloads hidden in byte arrays, registry data, or protected loaders and then injected in memory using **RunPE/process hollowing** into legitimate processes such as `InstallUtil.exe`. Researchers also observed persistence through Startup shortcuts and recurring batch execution, along with command-and-control concealment using **DDNS** and Portmap services; one analyzed RevengeRAT sample communicated with `h0pe1759.ddns.net` and retained common remote-access features including screenshot capture, system profiling, and antivirus enumeration.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026