Loading story…
Attackers compromised financial regulator websites in Poland, Mexico, and Uruguay and used them as watering holes to target banks and other financial institutions with a selective, multi-stage malware campaign. In Poland, employees at several banks were infected after visiting the website of the Polish Financial Supervision Authority (KNF), where altered JavaScript loaded a hidden iframe and redirected chosen visitors to attacker-controlled infrastructure. Researchers said the operation used IP-based filtering and whitelisting to focus on roughly 150 targeted IP addresses across more than 100 organizations in 31 countries, with Poland and Mexico among the most heavily targeted. The delivery chain included malicious JavaScript, staged shellcode, and exploit content hosted on domains including sap.misapor[.]ch and eye-watch[.]in, with attackers serving Adobe Flash and Microsoft Silverlight exploits, including a repackaged exploit for CVE-2016-0034.
The payloads included droppers, loaders, and remote-access trojans capable of process injection, encrypted command-and-control, service-based persistence, registry storage, timestamp tampering, and remote file and command execution. Banks reported malware on workstations and some servers, along with suspicious encrypted outbound traffic, though they said they had not identified unauthorized customer transactions. BAE Systems, Symantec, and ESET all found code, infrastructure, and tradecraft overlaps with malware previously associated with the Lazarus Group, including links to Downloader.Ratankba and Destover-related tooling, but some researchers stopped short of definitive attribution. Analysts also found transliterated Russian words embedded in malware and exploit components and assessed them as a likely false-flag attempt rather than genuine evidence of Russian operators.
See the actors and campaigns active against you right now.
14 events from the most recent confirmed update back to the earliest known activity.
BadCyber published an article describing attacks against Polish financial institutions and said more than 20 commercial banks in Poland had been confirmed as victims. The report tied the activity to compromise of the KNF website.
The publicly available gpsvc.exe sample associated with the campaign was first seen from Poland on January 26, 2017. BAE later found that after unpacking, it dropped a malware variant previously associated with the Lazarus toolkit.
A 32-bit variant of the malware used in affected institutions was apparently protected on January 11, 2017. ESET described this variant as combining dropper and loader stages, using RC4, and storing the final module in the registry.
Mexico's banking regulator website www.cnbv.gob.mx was observed redirecting visitors to eye-watch.in as part of the same watering-hole campaign. This showed the operation had expanded beyond Poland to additional financial-sector targets.
A further watering-hole instance was observed on Uruguay bank website brou.com.uy around October 26, 2016, based on a VirusTotal PCAP. Sample submissions from Uruguay later aligned with the same broader campaign.
From at least October 7, 2016, code on Poland's financial regulator website knf.gov.pl was modified to make visitors download malicious JavaScript from attacker-controlled infrastructure. The compromised regulator site became a redirect point in attacks on Polish financial institutions.
A coordinated watering-hole campaign targeting banks and other organizations in 31 countries was active since at least October 2016. Attackers used compromised websites and a customized exploit kit configured to infect only pre-selected IP addresses.
On March 15, 2017, Symantec said further investigation expanded its tentative links between the Polish bank attacks and Lazarus from one to four. New evidence included a Lazarus-attributed malware sample on a Polish target, co-submission with Backdoor.Destover, and the distinctive string "del /a %1" shared with Lazarus-linked malware families.
BAE published a follow-up analysis assessing the watering-hole activity as linked to Lazarus and describing staged exploit delivery via a malicious JBoss-hosted view.jsp implant. The report concluded that transliterated Russian words embedded in the malware and exploit code were likely deliberate false-flag artifacts.
ESET analyzed the malware family used in the attacks, describing 64-bit and 32-bit variants, service-based persistence, encrypted communications, and extensive RAT functionality. It also noted code and tradecraft similarities to Lazarus-linked tooling while stopping short of firm attribution.
BAE Systems published analysis of the watering-hole campaign, describing compromises involving Poland, Mexico, and Uruguay and identifying a recovered malware sample that unpacked to a variant previously associated with Lazarus. The report noted that direct technical evidence tying Lazarus to the watering-hole infrastructure remained incomplete.
Symantec reported that the attacks extended to 104 organizations in 31 countries, with most targets being banks and a smaller number telecoms and internet firms. It said the exploit kit had targeted about 150 IP addresses and that infection attempts had been blocked in Poland, Mexico, and Uruguay.
After the compromise was discovered, KNF cleaned its website and issued a statement acknowledging it had been hacked. KNF and affected banks reported the incident to CERT.pl.
Several Polish banks reported malware infections after employees visited the compromised KNF website. Investigations found malware on numerous workstations and some servers, along with suspicious encrypted outbound traffic to foreign IP addresses.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 47 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
9 references tracked. Mallory keeps watching after this page renders.
niebezpiecznik.pl
Open sourcebaesystemsai.blogspot.com
Open sourcewelivesecurity.com
Open sourcebaesystemsai.blogspot.com
Open sourcecommunity.broadcom.com
Open sourcebleepingcomputer.com
Open sourcebadcyber.com
Open sourcezaufanatrzeciastrona.pl
Open sourcecashless.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
North Korea-linked **Lazarus Group** and its financially motivated subgroup **Bluenoroff/APT38** have been tied to long-running intrusions against banks, SWIFT-connected environments, cryptocurrency businesses, casinos, and other financial targets worldwide. Reporting from multiple investigations links the actors to operations including the **Bangladesh Bank theft**, compromises at **Bancomext** and **Banco de Chile**, and intrusions at banks in Southeast Asia and Europe. Investigators found that the group maintained access for months, compromised **SWIFT Alliance** infrastructure, patched SWIFT-related components to suppress integrity checks, harvested transaction data, and used keylogging, lateral movement, and anti-forensic measures to conceal activity and disrupt investigations. Researchers also documented recurring Lazarus tradecraft across these campaigns, including spear phishing, watering-hole attacks, brute force, exploitation of web and client vulnerabilities, fake-TLS command-and-control, service-based persistence, and reuse of malware families and tooling. Technical reporting connected incidents through shared backdoor design, tunneling tools, SWIFT-focused modules, and malware such as **SQCSVC** and **SWPSVC**, while newer infrastructure hunting identified phishing domains, linked IP space, and a macOS sample named **`localfile~.x64`** communicating with **`104.168.136.24`**. The combined findings reinforce attribution of these financially driven operations to the Lazarus ecosystem and show an adaptive capability spanning traditional banking networks and digital-asset platforms.
Aug 14, 2026
Lazarus-linked operators exploited unpatched **VMware Horizon** servers vulnerable to **Log4Shell** (`CVE-2021-44228`) to compromise organizations, with reporting tying the activity to energy-sector victims in the United States, Canada, and Japan as well as broader targeting of Japanese entities. After initial access, the attackers deployed multiple backdoors and RATs including **VSingle**, **YamaBot**, **MagicRAT**, and **NukeSped**, then carried out hands-on-keyboard actions such as disabling security tools, creating unauthorized accounts, harvesting credentials, enumerating Active Directory, moving laterally with Windows administration utilities and Impacket, and exfiltrating selected files. Separate reporting also found the same exposed Horizon systems had been abused by other actors to install a Monero miner, underscoring how quickly internet-facing Log4Shell targets were reused. The malware set showed a mix of Windows and Linux capability and several methods for blending command-and-control into normal web traffic. **VSingle** supported remote command execution and file transfer, and newer Linux variants could fall back to **GitHub** to retrieve replacement C2 addresses when hard-coded servers failed, using repository content to locate attacker infrastructure. **YamaBot**, a Golang backdoor for both Windows and Linux, exchanged RC4- and Base64-protected data through HTTP cookies and could disguise larger exfiltration as BMP-like multipart content, while **NukeSped** provided modular espionage functions including shell access, file management, keylogging, screen capture, and tunneling. Researchers attributed the campaign to Lazarus based on malware overlaps, infrastructure links, and tradecraft consistent with prior North Korean espionage operations.
Aug 15, 2026