Loading story…
Government agencies publicly linked the WellMess malware to APT29, with the UK NCSC supported by CSE, NSA, and DHS CISA, while CISA also published malware analysis for the threat. WellMess is a cross-platform backdoor seen in Linux, Windows, and .NET variants that communicates over HTTP, sends command output in RSA-encrypted POST data, stores RC6-encrypted data in HTTP cookie headers, and supports shell command execution, file upload and download, and in some Windows samples, PowerShell execution.
Independent technical analysis said the public evidence did not conclusively prove a single actor was responsible. Researchers found infrastructure pivots from the domain onedrive-jp[.]com and IP addresses tied to a 2018 sample that suggested a possible connection to activity previously associated with APT28, while another sample, SangforUD.exe, showed weaker TTP overlap with activity attributed to DarkHotel. The conflicting indicators underscored that malware attribution can be distorted by shared code, overlapping infrastructure, or deliberate false flags, even as confirmed infections were reported in Japanese organizations.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos published an assessment saying open-source and technical evidence did not independently confirm or refute the government attribution of WellMess to APT29. The post highlighted weak alternative links to infrastructure associated with APT28 and to Sangfor/DarkHotel-related activity.
CISA released analysis report MAR-10296782-2.v1 covering WELLMESS. The report publicly documented the malware in mid-2020 amid broader scrutiny of its use.
A second WellMess sample with SHA-256 65495d173e305625696051944a36a031ea94bb3a4f13034d8be740982bc4ab75 and original name SangforUD.exe was submitted to VirusTotal. Talos notes this occurred before the related attack was publicly disclosed.
JPCERT/CC published analysis of WellMess as a cross-platform backdoor affecting Linux and Windows. The report said infections had been confirmed in Japanese organizations and listed observed command-and-control infrastructure and sample hashes.
A WellMess sample later identified by SHA-256 0b8e6a11adaa3df120ec15846bb966d674724b6b92eae34d63b665e0698e0193 was submitted to VirusTotal. The sample used 45.123.190[.]168 as its command-and-control server and had the original filename QnapSSL.
The domain my-iri[.]org pointed to 198.251.83[.]27 from April 13 to April 19, 2018. Talos cites Microsoft's prior association of my-iri[.]org with attacks on U.S. political institutions attributed to APT28.
The UK National Cyber Security Centre publicly attributed WellMess to APT29, with support from Canada's CSE, the U.S. NSA, and DHS CISA. Talos later cited this as the principal government attribution under debate.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourceus-cert.cisa.gov
Open sourceblogs.jpcert.or.jp
Open sourceblogs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Microsoft reported a multi-stage malware campaign that used **WhatsApp messages** to trick targets into opening malicious **Visual Basic Script** (`.vbs`) files. The activity, observed from late February 2026, relied on social engineering and trusted cloud infrastructure including **AWS S3**, **Tencent Cloud**, and **Backblaze B2** to host follow-on payloads. After execution, the malware created hidden folders under `ProgramData`, downloaded additional VBS components, and used renamed legitimate Windows utilities to blend into normal system activity. The intrusion chain then attempted **UAC bypass**, registry changes for persistence, and deployment of unsigned MSI installers including `Setup.msi`, `WinRAR.msi`, `LinkPoint.msi`, and `AnyDesk.msi`, which provided remote access and backdoor capability on compromised systems. Microsoft said the attackers abused living-off-the-land techniques such as renaming `curl.exe` and `bitsadmin.exe` while leaving original PE metadata intact, giving defenders a detection opportunity; the company also linked the activity to command-and-control domains **`neescil.top`** and **`velthora.top`** and published indicators, file hashes, and hunting guidance for defenders.
Jun 29, 2026
The provided items do not describe a single cohesive cybersecurity event; they span multiple unrelated threat reports and opinion pieces. Notable incident-level reporting includes **APT28** activity in Western/Central Europe (“Operation MacroMaze”) using spear-phishing lures with Office macros that beacon via `INCLUDEPICTURE` to `webhook[.]site` and then execute VBScript/CMD/batch stages for persistence and follow-on payload delivery. Separately, **MuddyWater** (Iran/MOIS-linked) was reported running “Operation Olalampo” against organizations in the Middle East and Africa, delivering new custom malware (including a **Char** backdoor using a **Telegram bot** for C2) and, in some cases, attempting exploitation of public-facing servers in addition to phishing. Criminal activity and initial-access tradecraft were also covered across distinct stories: a DFIR case study described exploitation of **Apache ActiveMQ** `CVE-2023-46604` to gain RCE, conduct post-exploitation (Metasploit/Meterpreter, privilege escalation, LSASS access, lateral movement), and ultimately deploy **LockBit**-branded ransomware via RDP using previously stolen credentials (with indications the payload was built using the leaked builder and used *Session* for communications). Multiple reports described malware delivery via compromised web assets and social engineering, including **GrayCharlie** injecting malicious JavaScript into WordPress sites to push **NetSupport RAT**, **Stealc**, and **SectopRAT** via fake updates/ClickFix-style CAPTCHAs, and a separate **ClickFix** campaign delivering a custom C++ RAT (**MIMICRAT**) through fake Cloudflare verification prompts that trick users into running PowerShell. Additional, unrelated threat reporting included a **NuGet** supply-chain attack (typosquatted `NCryptYo` plus companion packages) targeting ASP.NET Identity data and enabling backdoored authorization rules, and malicious Chrome extensions using a “**Promise Bomb**” browser-crash technique to drive users to run fake “CrashFix” PowerShell steps. Several other items were generic commentary/roundups (data breach trends, quantum preparedness, Enigma history, NATO public opinion polling, recon how-to, and a malware-newsletter link list) and do not add event-specific intelligence.
Jun 29, 2026