Loading story…
Security reporting linked an Iranian APT33 phishing campaign to fake job offers designed to lure targets into opening malicious attachments and visiting job-themed infrastructure. The activity used employment-related domains including world-jobs.org and raytheonjobs.serveblog.net, along with a ZIP archive and a malicious VBE script, to support credential theft, information theft, and unauthorized remote access. Researchers said the campaign’s exact end goal was not fully confirmed, but the tradecraft matched earlier intrusion activity associated with Iranian operators.
Additional indicators and detection content tied the campaign to PoshC2 payloads, including JavaScript- and HTA-based artifacts, file hashes, and an IP-hosted malware download path. A published YARA rule was created to help defenders identify payloads consistent with the reported APT33 activity, while guidance urged organizations to block the listed domains, URLs, hashes, and source IPs and to warn users against interacting with unsolicited recruiting emails or attached files.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published the YARA rule "poshc2_apt_33_2019" to detect PoshC2 payloads associated with 2019 APT33 reporting. The rule included hashes, URLs, and job-themed domains tied to the campaign and referenced the earlier Rewterz reporting.
Rewterz published a threat alert describing a phishing campaign using fake job offers as lures and linked the activity to Iranian threat actor APT33. The report said the campaign could enable credential theft, information theft, and unauthorized remote access, and published related indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
APT34, also tracked as **OilRig** and **Helix Kitten**, ran targeted phishing campaigns that used malicious Microsoft Word documents to deliver new malware closely related to the **SideTwist** backdoor. One lure posed as a Seychelles Licensing Authority registration form with pricing in Saudi riyals, indicating likely targeting in Saudi Arabia, while another impersonated marketing services firm **GGMS** to reach enterprise victims. In both cases, the documents dropped .NET payloads—identified as **Menorah** and **SystemFailureReporter.exe**—that gave the operators espionage capabilities including host fingerprinting, command execution, file listing, file upload, and file download. The malware established persistence through scheduled tasks, including **`OneDriveStandaloneUpdater`** and another task triggered every five minutes via an **`update.xml`** file. The implants communicated over HTTP with command-and-control infrastructure including **`tecforsc-001-site1.gtempurl.com`** and **`11.0.188.38:443`**, with one report noting that the latter, a U.S. Department of Defense-owned IP address, was likely a decoy or testing endpoint intended to shield operational infrastructure. Researchers said the activity shows APT34 continuing to evolve SideTwist-style tooling while relying on straightforward phishing and persistence methods for cyberespionage in the Middle East and against enterprise targets.
Aug 15, 2026
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026