Loading story…
Researchers reported that the Sundown exploit kit was used in phishing emails sent to large banks and financial services organizations, with malicious links taking recipients directly to exploit pages rather than through a traffic distribution system. Early reporting described Sundown as an emerging exploit kit, and later analysis showed it rapidly changing its exploit inventory while broadly attempting to compromise visitors.
The kit served a mix of exploits for Adobe Flash, Microsoft Windows, and Internet Explorer, and in the observed campaign it installed the LuminosityLink RAT. The malware was seen using aggressive keylogging and process injection techniques and could download additional payloads, raising concern that attackers were using it to profile infected systems before deploying more capable malware against higher-value victims.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Proofpoint reported that Sundown served Adobe Flash zero-day exploits previously seen on the Angler exploit kit in early 2015, indicating overlap in exploit usage during the kit's evolution.
In the observed campaign, Sundown delivered the LuminosityLink remote access Trojan, which Proofpoint said used aggressive keylogging, broad process injection, and could download additional payloads.
Proofpoint researchers detected a phishing campaign targeting large banks and financial services organizations that used malicious attachments and URLs to send recipients directly to the Sundown exploit kit.
An early public analysis of the Sundown exploit kit was published by the dontneedcoffee malware blog, marking one of the first referenced reports on the kit.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026
Attackers compromised financial regulator websites in Poland, Mexico, and Uruguay and used them as watering holes to target banks and other financial institutions with a selective, multi-stage malware campaign. In Poland, employees at several banks were infected after visiting the website of the Polish Financial Supervision Authority (**KNF**), where altered JavaScript loaded a hidden iframe and redirected chosen visitors to attacker-controlled infrastructure. Researchers said the operation used IP-based filtering and whitelisting to focus on roughly 150 targeted IP addresses across more than 100 organizations in 31 countries, with Poland and Mexico among the most heavily targeted. The delivery chain included malicious JavaScript, staged shellcode, and exploit content hosted on domains including `sap.misapor[.]ch` and `eye-watch[.]in`, with attackers serving Adobe Flash and Microsoft Silverlight exploits, including a repackaged exploit for `CVE-2016-0034`. The payloads included droppers, loaders, and remote-access trojans capable of process injection, encrypted command-and-control, service-based persistence, registry storage, timestamp tampering, and remote file and command execution. Banks reported malware on workstations and some servers, along with suspicious encrypted outbound traffic, though they said they had not identified unauthorized customer transactions. BAE Systems, Symantec, and ESET all found code, infrastructure, and tradecraft overlaps with malware previously associated with the **Lazarus Group**, including links to Downloader.Ratankba and Destover-related tooling, but some researchers stopped short of definitive attribution. Analysts also found transliterated Russian words embedded in malware and exploit components and assessed them as a likely false-flag attempt rather than genuine evidence of Russian operators.
Aug 15, 2026