Loading story…
Researchers reported a targeted cyber-espionage campaign delivering BlackWater malware through malicious Microsoft Word documents themed around major public events, including the Beirut explosion and COVID-19. The activity targeted government, diplomatic, and defense-related entities, with reporting tying parts of the operation to victims in Bulgaria and Azerbaijan and noting similarities to broader Asia-focused espionage tradecraft seen in campaigns attributed to groups such as Naikon and Vicious Panda.
The infection chain used an obfuscated macro to retrieve an encrypted second-stage payload from hardcoded command-and-control URLs chosen by the victim’s Windows version, then decrypted it with a book-cipher-style method derived from the legitimate font file C:\Windows\Fonts\cambriab.tff. The malware established persistence by dropping a malicious Word add-in, Moon.wll, into Word’s startup folder, then fetched an encrypted x64 backdoor that communicated over JSON through Cloudflare Workers and resolved infrastructure via DNS-over-HTTPS using cloudflare-dns.com and libcurl. Researchers said the tooling overlaps and advanced operational security point to a capable APT operator tracked as ReconHellcat.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Based on the March and August BlackWater activity, researchers assessed that defense and diplomatic government bodies in Bulgaria and Azerbaijan were highly likely targeted. They attributed the operations to a newly named APT group, ReconHellcat.
A new targeted BlackWater malware campaign used a malicious Word document themed around the Beirut tragedy. The infection chain fetched encrypted payloads, installed a malicious Moon.wll Word add-in for persistence, and ultimately deployed the BlackWater backdoor.
Researchers state that a BlackWater malware campaign was first identified in March. The later activity shared overlapping TTPs including Cloudflare Workers hosting, DNS-over-HTTPS via cloudflare-dns.com, JSON communications, and BlackWater strings.
F-Secure first documented the Microsoft Word add-in persistence and execution technique later abused in this campaign. The method involves placing a malicious .wll add-in in Word's STARTUP path so it loads automatically.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
quointelligence.eu
Open sourceresearch.checkpoint.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers traced a **SideWinder** spearphishing campaign to a malicious Word document named **"Briefing on Ongoing Projects.docx"** that fetched a remote RTF template from a spoofed domain and exploited Microsoft Equation Editor via `CVE-2017-11882`. The recovered RTF decrypted embedded JavaScript, launched an obfuscated script, and executed a .NET component that profiled installed antivirus products before attempting to download a further payload stage. Investigators found the originally malicious RTF had later been replaced with a nearly empty placeholder file, a tactic that obscured follow-on analysis while preserving infrastructure clues. Additional infrastructure and tradecraft links tied the activity to broader South Asian espionage patterns involving malicious RTF lures, Equation Editor exploitation, and multi-stage loaders. Fortinet separately documented a spearphishing attack against a telecommunications agency in South Asia using an RTF lure that exploited `CVE-2018-0798`, abused **Logitech** DLL search order hijacking with a signed executable and malicious `LBTServ.dll`, injected into `svchost.exe`, and contacted `instructor[.]giize[.]com` to retrieve a payload linked through OSINT to **PoisonIvy RAT**. Across the references, the campaigns show consistent use of document-based initial access, obfuscated intermediate stages, and reusable infrastructure and tooling associated with long-running regional espionage operations.
Aug 15, 2026
BlackEnergy operators targeted Ukrainian media organizations and electric power companies with spearphishing emails carrying malicious Microsoft Word documents that used macros to install **BlackEnergy v3**. One lure referenced Ukraine’s Right Sector party and was likely used against the television channel **STB**. The malware dropped an executable, installed a DLL payload as `FONTCACHE.DAT`, created persistence through a startup `.LNK` file, and communicated with a hardcoded command-and-control server over HTTP, reflecting a broader campaign against Ukrainian government, media, energy, and other critical sectors. Investigators also found the group using BlackEnergy as a backdoor to deploy the destructive **KillDisk** component and a trojanized **Dropbear SSH** service known as **SSHBearDoor** for persistent remote access. KillDisk variants were customized by target type: media-focused samples overwrote files and rendered systems unbootable, while energy-sector variants also targeted processes tied to industrial control environments, indicating an intent to disrupt operations as well as destroy data. The activity showed an escalation from espionage and foothold establishment to destructive attacks against Ukrainian critical infrastructure.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026