Loading story…
Kaspersky reported that the DeathStalker threat actor used a new Janicab malware variant to target legal entities, financial institutions, and possibly travel agencies across the Middle East and Europe, with activity observed through 2020 and likely continuing into 2021. Victims were concentrated in Egypt, Georgia, Saudi Arabia, the United Arab Emirates, and the United Kingdom, and the report noted Saudi legal entities among the targets for the first time.
The campaign relied on spear-phishing emails carrying ZIP archives with malicious .LNK droppers that launched chained VBE/VBS stages, unpacked a CAB archive containing Python-based tools, and established persistence on infected systems. The malware resolved command-and-control infrastructure through dead-drop resolvers hosted on public services including YouTube, and researchers linked the operation to other DeathStalker toolsets such as PowerSing, EVILNUM, and PowerPepper through shared tactics, infrastructure, anti-analysis logic, and tools including a Stormwind keylogger and an ICMP shell; the implant supported command execution, screenshots, keylogging, proxying, FTP access, and reverse SSH tunneling.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
The report says the Janicab campaign was likely still active during 2021, with intrusions reusing old unlisted YouTube links as dead-drop resolvers to obtain command-and-control infrastructure.
Throughout 2020, DeathStalker used a newer Janicab variant in spear-phishing intrusions targeting legal entities in the Middle East, as well as financial institutions and possibly travel agencies in the Middle East and Europe. The activity affected victims in Egypt, Georgia, Saudi Arabia, the United Arab Emirates, and the United Kingdom.
DeathStalker has targeted legal, financial, and travel-related organizations in the Middle East and Europe since at least early 2015.
The Janicab malware family was first introduced as malware capable of running on both macOS and Windows.
The reporting identified legal entities in Saudi Arabia as Janicab victims, marking the first time such targets in Saudi Arabia were noted in this reporting.
Securelist reported with high confidence that the newer Janicab variant was associated with the DeathStalker threat actor, citing overlaps in TTPs, infrastructure, anti-analysis logic, and tooling with other DeathStalker malware families.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers attributed an ongoing cyber-espionage campaign to **DeathStalker** with high confidence, saying the group has targeted foreign exchange and cryptocurrency trading companies since at least Q2 2020 using its **VileRAT** toolchain. The intrusion chain evolved over time from spear-phishing emails carrying malicious Google Drive-hosted shortcut files to email- and chatbot-delivered `DOCX` documents that retrieved macro-enabled `DOTM` remote templates, ultimately deploying **VileDropper**, **VileLoader**, and the Python-based **VileRAT** remote access trojan. The operators repeatedly refined the malware to evade detection and frustrate analysis, using techniques including **VBA stomping**, XOR-encoded data hidden in Office objects, JavaScript anti-analysis checks, multi-stage in-memory loading, and Python bytecode obfuscation intended to break decompilers. Investigators also linked the activity to a large infrastructure footprint involving hundreds of domains and IP addresses, many associated with **AS42159 (DELTAHOST UA)** in the Netherlands from late 2021 onward, and said a rise in related samples and infrastructure from March 2022 pointed to intensified compromise attempts against less mature organizations.
Jul 12, 2026
Kaspersky identified **DeathStalker**, a long-running hacker-for-hire group that targeted **European law firms** and **fintech companies**, with additional victims in the Middle East including **Israel, Jordan, and Egypt**. Researchers said the group appeared focused on stealing **business and financial intelligence** rather than conducting traditional state espionage, marking it as part of a broader **mercenary APT** market in which private operators sell intrusion capabilities to paying clients. The intrusions typically began with **spear-phishing emails** carrying weaponized `.LNK` shortcut files that launched **PowerShell-based backdoors**. Reporting on mercenary threat actors placed DeathStalker alongside groups such as **Bahamut, DarkBasin, Candiru, and NSO Group**, underscoring how commercial surveillance and hacking services are increasingly used against not only activists and dissidents but also enterprises. Researchers noted that, despite the sophistication associated with mercenary operators, campaigns like DeathStalker’s often still rely on familiar weaknesses such as phishing susceptibility and poor patching.
Aug 15, 2026
Researchers linked **Batloader** activity to the **Water Minyades / DEV-0569 / SteelClover** ecosystem, which used malvertising, SEO poisoning, and fake software download pages to lure victims into installing trojanized packages. The campaigns abused legitimate installer frameworks such as **Advanced Installer** and **WiX**, then shifted to obfuscated JavaScript and PyArmor-protected Python loaders that fingerprinted hosts, contacted command-and-control infrastructure, escalated privileges, and attempted to disable security tools. Operators also used cloned software sites and malicious Google ads to distribute MSI files that launched PowerShell, added Microsoft Defender exclusions, and retrieved encrypted follow-on payloads. The infections were used to selectively deploy a broad set of malware, including **Qakbot**, **Ursnif**, **Vidar**, **ZLoader**, **RedLine Stealer**, **Raccoon Stealer**, **Cobalt Strike**, and remote-management tools such as **Atera** and **Syncro**. Trend Micro reported that Batloader infections observed from September 2022 onward were associated with **Royal ransomware**, while NTT documented a surge of related infections at Japanese companies in early 2023 through the **FakeGPG** and **BatApp** campaigns. The activity was concentrated heavily in the United States but also affected Canada, Germany, Japan, and the United Kingdom, underscoring Batloader's role as a flexible initial-access platform for both credential theft and ransomware intrusion chains.
Aug 15, 2026