Loading story…
Check Point Research reported that a November 2022 espionage campaign targeted entities in Armenia with an updated OxtaRAT backdoor, an AutoIt-based malware family previously seen in attacks on Azerbaijani activists and dissidents. The intrusion used a malicious .scr file disguised as a PDF and themed around Alexander Lapshin, then unpacked a polyglot payload hidden inside an image file to reduce detection and establish access on victim systems.
The latest OxtaRAT variant introduced stronger operational security and Armenian-IP geofencing, along with persistence through a scheduled task and expanded surveillance capabilities. Researchers said the malware could steal files, record webcams and desktops, remotely control infected machines through TightVNC, deploy a PHP web shell, scan ports, create tunnels, and conduct broader reconnaissance, linking the activity with medium confidence to threat actors aligned with Azerbaijani government interests.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published its analysis of Operation Silent Watch, detailing the November 2022 OxtaRAT campaign, its expanded surveillance capabilities, and links to earlier activity aligned with Azerbaijani government interests.
Alexander Lapshin said Artsakhbank representatives reported receiving malicious emails in his name on the same day the malware samples were uploaded to VirusTotal. This tied the lure theme to real-world delivery activity against Armenian recipients.
A malicious .scr file masquerading as a PDF was submitted to VirusTotal from an IP address in Yerevan, Armenia. The sample used an Alexander Lapshin-themed lure and dropped the latest OxtaRAT infection chain.
In November 2022, threat actors conducted an espionage campaign against entities in Armenia using a new version of the AutoIt-based OxtaRAT backdoor. The activity marked a clear association of OxtaRAT with Armenian targets and corporate environments.
The domains edupoliceam[.]info and avvpassport[.]info were created and were later assessed as likely supporting attacks on Armenian targets in the OxtaRAT campaign.
On 2021-07-07, several prominent political and human rights activists in Azerbaijan received phishing emails impersonating Human Rights Watch and delivering a password-protected archive from Google Drive. The lure installed an AutoIT-based malware chain that fetched second-stage payloads from shoesbuysellone.live and enabled persistence, surveillance, command execution, and file exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcequrium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A previously unreported cyberespionage campaign dubbed **SilkParasite** has targeted government bodies across Central Asia, with researchers assessing the activity with medium confidence as having a China nexus. The operation, first identified in late 2025, used spear-phishing emails carrying password-protected RAR archives and malicious Microsoft Office documents that triggered **DLL sideloading** to deploy malware. Lures were tailored to government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and one Georgian government organization. Bitdefender linked the campaign to a small, modular, professionally engineered toolset spanning **.NET, C++, Go, and JavaScript**, including seven remote access trojan families and five newly documented strains: `DriveSilkRAT`, `CookiETagRAT`, `NomadRAT`, `GoginRAT`, and `NodeEdgeRAT`. Attribution was further supported by the use of **BLOODALCHEMY** and an updated **SpiceRAT** variant associated with Chinese-speaking threat activity. Researchers said the malware ecosystem showed signs of **AI-assisted development**, including phishing content and coding artifacts, while one implant used **Google Drive** for command-and-control; the most consistent detection opportunity was DLL sideloading by legitimately signed applications launched from unusual locations.
Aug 28, 2026
Researchers linked an exposed directory on infrastructure in Kazakhstan to a credential-stealing malware operation built around a heavily obfuscated **SectopRAT**/**ArechClient2** variant. The investigation tied suspicious IP overlap to malware samples that unpacked through a multi-stage chain involving legitimate Microsoft-signed binaries, a QSetup-based installer, an AutoIt stage, and a final obfuscated .NET payload. The malware checked for **Avast** and **AVG** processes, reconstructed and launched a legitimate **AutoIt3** executable, injected code into `jsc.exe`, and communicated with command-and-control infrastructure over TCP port `15647`. Recovered functionality and strings indicated the payload fingerprints infected systems and steals credentials and other sensitive data. The campaign was also linked to fake software download pages promoted through **Google Ads**, including a malicious **OBS** installer archive, and researchers estimated the operation may have affected more than **18,000** victims based on files found in the exposed log directory. Separate analysis of newer SectopRAT samples showed the malware had evolved its evasion and communications methods by moving the real command-and-control address out of the class previously used for static extraction, replacing it with `127.0.0.1`, and adding new configuration fields such as a **build ID** and an encryption key for command-and-control traffic. One analyzed sample identified itself as **Build 3**, indicating continued development of the malware family.
Aug 15, 2026
The **Sticky Werewolf** cyber-espionage group has been linked to phishing attacks against Russian scientific, industrial, and government organizations, with later reporting also identifying targets in Belarus. In one campaign, attackers impersonated Russia’s Ministry of Industry and Trade in emails carrying decoy documents and a password-protected archive; another wave used phishing links generated through **IP Logger** to disguise delivery URLs while collecting victim profiling data such as IP address, location, browser version, and operating system. Researchers also tied the activity to earlier spoofed-email operations themed around Russian state bodies including **EMERCOM**, the Ministry of Construction, and the **FSB**. The intrusions ultimately deployed **Ozone RAT**, and in some cases **Darktrack RAT**, while showing victims decoy files to mask the infection. Analysts said the Ozone RAT loader was copied into `%TEMP%` under names such as `utorrent.exe`, established persistence through a shortcut in the Windows Startup folder, and used a modular chain in which it downloaded an encrypted DLL from a command-and-control server, saved it as `data.dbf`, decrypted it, and loaded it reflectively into memory via the Delphi API function **BTMemoryModule**. The malware was reported to support remote command execution, file and process management, registry changes, keylogging, screen, webcam, and microphone capture, password theft from browsers and mail clients, hidden virtual network computing (**HVNC**) control, reverse proxying, payload delivery, and self-deletion.
Aug 15, 2026