Loading story…
Cisco Talos reported that attackers have used Dark Utilities, a command-and-control-as-a-service (C2aaS) platform launched in early 2022, to run malware campaigns against both Windows and Linux systems. The service provides remote access, arbitrary command execution, distributed denial-of-service capabilities, and Monero mining, while distributing payloads for Windows, Linux, and Python environments. Researchers said the platform relies on IPFS-hosted binaries to make payload delivery more resilient against takedowns and is promoted through Telegram, Discord, Tor, and clearnet infrastructure.
The malware associated with Dark Utilities can establish persistence, self-update, execute shell commands and Python code, launch Layer 4 and Layer 7 DDoS attacks, and deploy XMRig miners through the Hashvault pool. The reporting also links the ecosystem to the persona inplex-sys, assessed likely to be based in France, and highlights how the service lowers the barrier to entry for cybercriminals. A related malware reference identifies Kinsing, a Linux-focused malware family, underscoring the broader risk that commodity botnet and cryptomining tooling poses to internet-exposed systems.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Shortly after launch, the persona inplex-sys advertised Dark Utilities in the Lapsus$ Group Telegram channel. Talos assessed that inplex-sys created and managed the platform.
Dark Utilities, a command-and-control-as-a-service platform offering remote access, command execution, DDoS, and Monero mining features, was released in early 2022. The service was marketed via clearnet, Tor, Telegram, and Discord and offered premium access for 9.99 euros.
Talos assessed that the persona inplex-sys created and currently manages Dark Utilities and found indications the operator is likely located in France despite a Doxbin entry claiming Germany. The report also documented the platform's use of IPFS-hosted binaries and Discord-backed authentication.
Dark Utilities expanded support to ARM64 and ARMV71 architectures, broadening targeting to embedded devices such as routers, phones, and IoT systems. This marked an escalation beyond Windows, Linux, and Python-based payload support.
Researchers observed malware samples in the wild using Dark Utilities-generated command strings in PowerShell and Bash scripts to retrieve and execute payloads for remote access and cryptocurrency mining. Multiple distinct account strings in the samples indicated that more than one threat actor was likely using the platform.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 61 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DarkGate has emerged as a versatile **malware-as-a-service** loader and remote access trojan used by multiple threat actors, including **TA577**, **Ducktail**, **UNC2975**, and **UNC5085**, with campaigns delivering it through large-scale email waves, fake browser updates, VBScript loaders, MSI installers, and messaging platforms such as **Skype** and **Microsoft Teams**. Proofpoint reported one major cluster, dubbed **BattleRoyal**, using DarkGate in attacks against organizations in the United States and Canada, relying on traffic distribution systems including **404 TDS** and **Keitaro TDS** and abusing malicious `.URL` files tied to **`CVE-2023-36025`** to bypass Windows SmartScreen protections before later shifting some activity to NetSupport. Technical analyses describe DarkGate as a mature platform with broad post-compromise capabilities, including reverse shell access, **PowerShell** execution, keylogging, credential and token theft, hidden **VNC** remote control, privilege escalation, persistence, file management, and even **XMRig**-based Monero mining. Researchers said the malware continues to evolve its evasion and execution methods through custom Base64 and XOR-obfuscated configuration data, HTTP POST command-and-control, alternate ports such as `2351` and `9999`, dynamic API resolution, parent PID spoofing, APC injection via **`NtTestAlert`**, DLL side-loading, AutoIt-based execution, and LOLBAS abuse through **`extexport.exe`**, underscoring DarkGate’s ongoing role as a significant cybercrime threat.
Aug 15, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026