Loading story…
ESET disclosed DePriMon, a multi-stage malicious downloader and malware framework active since at least 2017, after finding it at a private company in Central Europe and on dozens of systems in the Middle East. Its most distinctive persistence technique abuses the Windows print subsystem by registering a malicious DLL as a local port monitor named "Windows Default Print Monitor", causing spoolsv.exe to load it with SYSTEM privileges at startup. Researchers said the malware uses reflective DLL loading, extensive AES-256 encryption, a large encrypted configuration, and TLS communications implemented through SSPI and Schannel, while its initial infection vector and final payloads remain unknown.
The findings add to evidence tying DePriMon to the Lamberts cyberespionage platform, also known as Longhorn, a highly sophisticated toolkit previously documented by Kaspersky and linked by Symantec to the actor exposed in Vault 7 reporting. Kaspersky described the Lamberts as an elite espionage framework active since at least 2008, with multiple color-coded malware families including Black, White, Blue, Green, Pink, and Gray Lambert, plus capabilities such as modular backdoors, packet-sniffing implants, in-memory plugin execution, signed-driver abuse, and use of the CVE-2014-4148 TrueType Font zero-day against a European target. ESET noted some DePriMon infections appeared alongside ColoredLambert, reinforcing the assessment that the downloader is connected to the broader Longhorn/Lamberts arsenal.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
On November 21, 2019, ESET published technical analysis of DePriMon, describing its multi-stage architecture, encrypted configuration handling, reflective DLL loading, and print-monitor persistence technique. The researchers said the initial infection vector and final payloads remained unknown.
On April 11, 2017, Kaspersky published its analysis of the Lamberts/Longhorn toolkit, detailing multiple related malware families and their links. The report described the actor as a top-tier cyberespionage operation.
ESET said telemetry showed the DePriMon downloader and malware framework had been active since at least March 2017. The malware used a malicious Windows print monitor for persistence and SYSTEM-level execution.
Kaspersky reported that Gray Lambert migration or upgrade activity from White Lambert infections was last observed in October 2016. The observation tied Gray Lambert to the evolution of the passive network toolset.
Kaspersky said known Lambert variants for Windows and OS X included samples created as late as 2016. This marked the latest sample creation timeframe cited in the report.
FireEye publicly reported in October 2014 that CVE-2014-4148 had been exploited as a zero-day in the wild. Microsoft patched the vulnerability when it was publicly disclosed.
Kaspersky reported that an OS X variant of Green Lambert, version 1.2.0, was uploaded to a multiscanner service in September 2014. This showed the Lamberts toolkit had cross-platform capability.
In 2014, attackers used the Windows TrueType Font zero-day CVE-2014-4148 to deliver Black Lambert against a high-profile European target. Kaspersky linked the malware to the Lamberts/Longhorn toolkit.
Kaspersky reported that the Lamberts/Longhorn cyberespionage toolkit had been in use since at least 2008. The arsenal included multiple malware families for espionage, harvesting, and wiping across Windows and OS X.
ESET reported detecting DePriMon in a private company in Central Europe and on dozens of computers in the Middle East. Some infections were observed within a short timeframe of ColoredLambert activity, suggesting possible overlap with the Lamberts/Longhorn ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
symantec.com
Open sourcewelivesecurity.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Rapid7 reported a renewed **Dropping Elephant** malware campaign using a China-themed lure to deliver a heavily reworked, memory-resident remote access trojan on Windows systems. Victims are enticed with a decoy document tied to a GRES-3 seawater pump contract, while a malicious shortcut file, `GRES3001.lnk`, launches a PowerShell-based staging chain that downloads components from `chinagreenenergy[.]org`. The malware then abuses the legitimate Microsoft binary `Fondue.exe` to side-load a malicious `APPWIZ.cpl` file from `C:\Users\Public\`, decrypts an AES-256-CBC protected payload from `editor.dat`, and uses Donut shellcode to map the final 32-bit RAT directly into memory. The RAT patches **AMSI**, **WLDP**, and **ETW** in-process to reduce detection, then communicates over encrypted HTTPS with `gcl-power[.]org` using Salsa20-protected fields and frequent beaconing. Rapid7 said the malware supports host fingerprinting, process enumeration, directory listing, file upload, download-and-execute, shell execution, and screenshot capture, while persistence is maintained through a scheduled task named **GoogleErrorReport** that runs `Fondue.exe` every minute from `C:\Users\Public\`. Researchers linked the activity to earlier Dropping Elephant tooling through shared command-handler structure, screenshot logic, WININET request flow, and beaconing patterns, and urged defenders to focus on behavioral detections such as LNK-triggered PowerShell, nonstandard `Fondue.exe` loading of `APPWIZ.cpl`, and the `GoogleErrorReport` task rather than static indicators alone.
Jun 29, 2026