Loading story…
Check Point Research reported that the APOMacroSploit malware builder was used in a large phishing operation that targeted more than 80 organizations in over 30 countries with malicious Excel XLS attachments. The builder generated heavily obfuscated XLM macro documents that downloaded batch files, attempted to evade security tools, added Microsoft Defender exclusions, bypassed UAC, and then installed follow-on malware including DelphiCrypter and BitRAT.
Researchers said APOMacroSploit was marketed on HackForums by actors using the names Apocaliptique and Nitrix, and that the wider operation involved roughly 40 hackers and about 100 email senders. Check Point linked infrastructure and online personas to the operators, identified a BitRAT command-and-control server at 185.157.161.109, and said the findings were reported to law enforcement.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Check Point Research publicly documented the APOMacroSploit operation, including the infection chain, operator links, and indicators such as BitRAT C2 infrastructure at 185.157.161.109 and 185.57.162.81. The report also said the findings were shared with law enforcement.
Check Point linked APOMacroSploit to a wider campaign involving roughly 40 hackers and about 100 email senders. Victims who opened malicious XLS files triggered obfuscated XLM macros that downloaded BAT scripts and ultimately deployed malware including DelphiCrypter and BitRAT.
The malware builder was advertised and sold on HackForums.net by users Apocaliptique and Nitrix. Check Point estimated the two operators earned at least $5,000 in about 1.5 months from sales of the tool.
Check Point Research said it detected a new Office malware builder named APOMacroSploit at the end of November. The builder was tied to malicious XLS phishing attacks later observed against more than 80 customers in over 30 countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **BitRAT** distribution campaigns that used highly tailored social-engineering lures to infect Windows users with the commodity remote access trojan. In one campaign, attackers abused a Colombian cooperative bank’s compromised infrastructure and reused stolen customer records in malicious Excel files, indicating a real breach involving roughly **418,777** rows of sensitive data. Qualys said the operators likely exploited **SQL injection** with `sqlmap`, then used obfuscated macros, `certutil`, and `rundll32` to stage and launch BitRAT from payloads hosted on a throwaway GitHub repository. Separate reporting showed BitRAT also spread through fake **Windows 10 activators** shared on South Korean webhards, Discord, and social media, where a bogus activation tool downloaded the malware and attempted to weaken Windows Defender protections. Fortinet documented another BitRAT campaign that targeted **NFT enthusiasts**, using Hebrew-language Excel lures and Discord-hosted payloads to deliver the malware through batch scripts, PowerShell, and DLL injection into a copied `MSBuild.exe` process. Across the campaigns, BitRAT was described as a low-cost malware-as-a-service tool sold on underground forums since 2021, with capabilities including credential theft, keylogging, webcam and microphone access, hidden remote desktop (**HVNC**), file exfiltration, cryptocurrency mining, DDoS activity, and persistence via startup-folder placement or process injection. The reporting highlights how BitRAT operators increasingly combine stolen data, topical themes, and pirated software bait with legitimate services such as GitHub and Discord to improve infection success.
Aug 15, 2026
Threat actors distributed **Orcus RAT** and **RevengeRAT** through phishing emails masquerading as official complaints, using delivery methods that shifted from SendGrid-linked downloads to ZIP archives containing malicious batch files and script-based payloads. Reporting tied the activity to organizations worldwide, including government, financial services, IT services, and consulting sectors, and linked both malware families to the same client identifier, `CORREOS`, suggesting shared campaign infrastructure or operator overlap. Technical analysis showed heavily obfuscated infection chains built around VBS, batch, and PowerShell components, with payloads hidden in byte arrays, registry data, or protected loaders and then injected in memory using **RunPE/process hollowing** into legitimate processes such as `InstallUtil.exe`. Researchers also observed persistence through Startup shortcuts and recurring batch execution, along with command-and-control concealment using **DDNS** and Portmap services; one analyzed RevengeRAT sample communicated with `h0pe1759.ddns.net` and retained common remote-access features including screenshot capture, system profiling, and antivirus enumeration.
Aug 15, 2026
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026