Loading story…
Researchers documented multiple Ursnif campaigns in which the malware evolved beyond a traditional banking trojan into a stealthy loader, reconnaissance tool, and credential theft platform. In North America and Europe, attackers hijacked existing email threads and sent links to password-protected ZIP archives containing obfuscated JavaScript, while other operations used phishing lures themed as Italian courier and energy companies with malicious Office documents. The malware chain commonly relied on Windows scripting and LOLBins such as wscript and regsvr32, staged DLL loading, anti-analysis tricks, and geofencing or locale checks to reduce detection and limit infections to intended victims.
The activity was tied to sustained, targeted operations including campaigns attributed to TA544 against Italian organizations and a separate LOLSnif variant observed from 2019 into 2020. Analysts reported that the malware reused infrastructure, bypassed local proxies through COM interfaces and Internet Explorer automation, and used WMI and broken PE headers to frustrate defenders. In several intrusions, Ursnif infections led to follow-on payloads including Cobalt Strike Beacon, TeamViewer/TVRat, and a VNC-related module, showing that the campaigns supported both credential theft and broader post-compromise remote access.
Get the infrastructure and lures behind it.
12 events from the most recent confirmed update back to the earliest known activity.
In 2021, Proofpoint observed nearly 20 notable TA544 campaigns and almost half a million messages targeting Italian organizations with Ursnif, including lures impersonating courier and energy companies.
Between January and August 2021, observed Ursnif campaigns impacting Italian organizations exceeded the total number of such campaigns seen in all of 2020.
Proofpoint said Emotet activity targeting Italy disappeared after the January 2021 disruption of the Emotet botnet, preceding increased Ursnif activity in the region.
The JavaScript file used in the LOLSnif campaign was first submitted to VirusTotal on 2020-04-07 and initially had a very low detection rate.
A LOLSnif campaign began on 2020-04-07 with spam emails carrying encrypted ZIP archives and passwords in the message body.
The LOLSnif Ursnif variant was first publicly mentioned in August 2019 before gaining momentum later in 2019 and early 2020.
The LOLSnif campaigns gained momentum in autumn and winter 2019/2020 as the repurposed Ursnif variant was used in targeted cybercrime operations.
Proofpoint stated it has tracked the cybercriminal group TA544 since 2017 as an actor distributing banking malware and other payloads.
The Ursnif source code was leaked in 2014, making it broadly available online and enabling later repurposing of the malware family.
Some Ursnif infections progressed beyond initial beaconing and, after about 24 hours, received additional modules including a VNC-related component, Cobalt Strike beacons, and TVRat using TeamViewer.
As of April 22, the campaign operators moved infrastructure from 8.208.90.28 to 47.241.106.208 after initially using 16 domains pointed at the earlier IP.
A growing Ursnif campaign began around April 6, targeting entities across North America and Europe using compromised email accounts and malicious Google Drive links.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
proofpoint.com
Open sourcetelekom.com
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tracking **Ursnif** uncovered a wider command-and-control footprint tied to the long-running banking trojan and its role in later-stage ransomware intrusions. Bridewell identified a distinctive SSL certificate pattern and related network traits that revealed **72 additional servers**, then used a second hunt rule to find **7 more** previously missed systems. Several of the discovered C2 nodes had gone unreported or were poorly detected by security tools, with an average VirusTotal detection score of **4.78**, and the infrastructure was concentrated in **Germany, the Netherlands, and Russia** across providers including **servinga GmbH, Datasource AG, and GleSYS AB**. The findings reinforce Ursnif's evolution from a banking trojan into a broader intrusion enabler used for credential theft, data exfiltration, and ransomware access. Earlier reporting linked Ursnif to campaigns against more than **100 Italian banks**, theft of over **1,700 credential sets** from one payment processor, and phishing-led infections targeting organizations in **Italy** and the **United States**. Bridewell also tied current activity to malicious **LibreOffice installers**, DLL payloads, and domains including `gameindikdowd[.]ru`, while noting overlap with intrusions associated with the **Royal** ransomware group.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026