Loading story…
Researchers uncovered compromised UEFI firmware images carrying a malicious implant that persisted in SPI flash and deployed a previously unseen malware family dubbed MosaicRegressor. The rogue firmware reused and modified components from Hacking Team’s leaked VectorEDK UEFI bootkit to drop IntelUpdate.exe into the Windows Startup folder and restore it if deleted, giving attackers durable access below the operating system. The finding followed earlier public reporting on LoJax, the first UEFI rootkit observed in the wild, underscoring that firmware-level persistence had moved from theory to active operations.
The malware framework was used in targeted espionage campaigns from 2017 to 2019 against diplomats and NGO members in Africa, Asia, and Europe, with identified victims linked to North Korea. MosaicRegressor operated as a modular, multi-stage platform using multiple downloaders over HTTP/HTTPS, BITS, WinHTTP, and even mail.ru email accounts to retrieve payloads. Attribution remained low confidence, but researchers cited Chinese-language artifacts, a Royal Road weaponized document, and infrastructure overlap with activity associated with the Winnti umbrella, suggesting possible ties to a Chinese-speaking threat actor.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Securelist published research describing compromised UEFI firmware images that deployed the newly named MosaicRegressor malware framework. The report linked the activity to targeted espionage from 2017 to 2019 and assessed with low confidence that a Chinese-speaking actor was responsible.
Researchers confirmed that two victims were infected with the malicious UEFI bootkit in 2019, before deployment of the BitsReg component. The implant persisted in SPI flash and dropped IntelUpdate.exe into the Windows Startup folder.
ESET published research on LoJax, identifying it as the first publicly known UEFI rootkit found in the wild. Later MosaicRegressor reporting described its own UEFI implant as the second such publicly known case.
An intelligence report on the Winnti umbrella and associated state-sponsored attackers was published, providing background later referenced in MosaicRegressor attribution analysis through infrastructure overlap.
Telemetry showed several dozen victims received MosaicRegressor components during this period. The victims included diplomatic entities and NGOs in Africa, Asia, and Europe, all with some connection to North Korea.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 73 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcewelivesecurity.com
Open source401trg.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a cyber-espionage operation targeting government and public-sector organizations in Central Asia, with additional victims in Syria, deployed two newly identified backdoors, **OctLurk** and **SilkLurk**, alongside a proxy implant called **LurkProxy** and post-compromise tools including Impacket `secretsdump`, Browser Password Decryptor, Fscan, WinRAR, 7-Zip, a keylogger, Pandora RC agent, and in one case **PlugX**. The activity, active since January 2025, used victim-specific decryption, in-memory execution, obfuscation, and plugin-based modules to support command execution, file theft, surveillance, credential access, and remote administration, and is assessed with medium confidence to be operated by the same Chinese-speaking threat actor. The campaign appears connected through infrastructure overlap to **MystRodX**, a previously undocumented Linux C++ backdoor delivered by an ELF dropper and initially misclassified as Mirai. MystRodX uses layered encryption, configurable TCP/HTTP communications, and a passive raw-socket “wake-up” mode triggered by crafted DNS or ICMP packets, allowing it to avoid open listening ports; it also maintains persistence through a dual-process guardian mechanism. Prior analysis identified multiple active C2 servers and distinct campaigns tied to separate RSA public keys, and the newly reported overlap with TrustFall, MystRodX, and SilentRaid infrastructure suggests a broader multi-platform espionage ecosystem spanning both Windows and Linux operations.
Jul 31, 2026
Researchers linked multiple Linux intrusions to suspected Chinese state-sponsored activity using the open-source **Reptile** kernel rootkit and a custom implant known as **Mélofée**. ExaTrack reported that Mélofée targeted Linux servers with capabilities for file and directory operations, shell execution, persistence, and command-and-control over **TCP**, **TLS**, and **UDP/KCP**, while one 2022 sample embedded a kernel-mode rootkit derived from Reptile. The installer deployed components under the disguised path `/etc/intel_audio/`, loaded the malicious kernel module with `insmod`, and established persistence through startup files such as `/etc/rc.modules`, tying the activity to infrastructure and tooling associated with **Winnti**, **ShadowPad**, **PlugX**, **Spark**, **HelloBot**, **StowAway**, and **Cobalt Strike**. AhnLab later documented a Korean intrusion that used Reptile in a nearly identical way, including installation under `/etc/intel_audio/`, manual kernel-module loading instead of the default loader flow, persistence via `rc.local`, and deployment alongside an **ICMP** backdoor called **ISH**. Reptile provides stealth features for files, directories, processes, file contents, and network traffic, and can activate a reverse shell through a **Port Knocking** mechanism using Magic Packets. The overlap in installation path and deployment method matched patterns previously highlighted by ExaTrack and reinforced assessments that Reptile-derived Linux rootkits were being operationalized in broader Chinese espionage campaigns, including activity Mandiant associated with exploitation of **Fortinet** zero-days and custom malware.
Aug 15, 2026
Elastic Security Labs linked the **REF7707** cyberespionage activity to a modular malware ecosystem targeting a South American foreign ministry and likely victims in Southeast Asia. The operators used valid credentials and Windows administrative functionality to deploy the PATHLOADER and GUIDLOADER loaders, including a renamed `cdb.exe` Microsoft debugger to execute in-memory shellcode. PATHLOADER retrieved encrypted payloads from typosquatted and attacker-controlled infrastructure before launching **FINALDRAFT**, a Windows and Linux remote-access tool that used Microsoft Graph API access to communicate through Outlook draft messages. FINALDRAFT supports collection and exfiltration, process injection, proxying, file operations, network discovery, in-memory PowerShell with AMSI/ETW bypasses, and Pass-the-Hash activity; samples spanning 2023 and 2024 indicate sustained development. Elastic later identified **NANOREMOTE** and its WMLOADER delivery component as likely related to the same cluster: WMLOADER masquerades as security software, decrypts `wmsetup.log` with AES-CBC, and executes the backdoor in memory, while NANOREMOTE uses the Google Drive API for command-and-control, payload staging, and bidirectional file transfer. Shared loader behavior, cryptographic material, filenames, code, and network traits indicate a common development environment or codebase.
Sep 9, 2026