Loading story…
Check Point reported a targeted intrusion campaign that used malicious Excel macro documents masquerading as sensitive U.S. government finance material to compromise officials in government finance authorities and embassy personnel across Europe and other regions. The infection chain dropped AutoHotkey components that contacted command-and-control infrastructure, collected screenshots and host details, and then deployed a trojanized TeamViewer instance through DLL side-loading, giving the operator covert remote access and credential-theft capability.
Observed victims included selected government revenue and finance officials in Nepal, Guyana, Kenya, Italy, Liberia, Bermuda, and Lebanon. Researchers linked the activity to related operations seen in 2017 and 2018 based on reused macro code, similar TeamViewer backdoors, Russian-language lures, and overlapping payload behavior, and they cited circumstantial ties to a Russian-speaking forum user known as "EvaPiks". The campaign appeared financially motivated because the malware targeted banking, cryptocurrency, and online commerce services and the suspected developer was active on a Russian carding forum.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
When macros were enabled, the document extracted AutoHotkey components that contacted command-and-control infrastructure, gathered screenshots and host information, and downloaded a malicious TeamViewer package. The attackers used DLL side-loading with a malicious TV.DLL to hide the TeamViewer interface, steal session credentials, and execute additional payloads.
The 2019 intrusion chain began with an emailed XLSM attachment titled "Military Financing.xlsm" and the subject line "Military Financing Program." The decoy impersonated a top secret U.S. Department of State document and contained Cyrillic artifacts.
Check Point identified a targeted campaign in 2019 against officials in government finance authorities and embassy representatives in Europe and other regions. Victims were handpicked public-sector finance personnel in countries including Nepal, Guyana, Kenya, Italy, Liberia, Bermuda, and Lebanon.
Check Point said a second variant seen in 2018 introduced a new command-and-control command system. It also collected Chrome history related to banks, online shops, and cryptocurrency markets from a predefined list.
During 2018, the actor used self-extracting archives in some campaigns instead of malicious documents with AutoHotkey. One archive used a Russian-language filename referencing prosecutor regulations and displayed an image of Kazakhstan officials.
Check Point attributed the activity circumstantially to a CyberForum[.]ru user named "EvaPiks" based on reused macro code, matching panel paths, and similar API-hooking techniques discussed on Russian-language forums. The report also noted overlap with infrastructure and methods used in the attacks.
An exposed server directory containing uploaded victim screenshots allowed researchers to identify some victims before the files were deleted and directory listing was disabled. This provided visibility into the campaign's targeting.
Check Point reported that earlier campaigns by the same threat actor used trojanized TeamViewer backdoors before later 2018 and 2019 evolutions. These earlier variants supported remote control, file send-and-execute, basic system information theft, self-deletion, and use of a config.bin configuration file.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 66 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and government defenders have linked multiple campaigns to **SpyAgent**—also tracked as **TeamSpy**, **TVRAT**, **TeamBot**, and **Sheldor**—a long-running malware family that hijacks legitimate remote administration tools to gain covert control of Windows systems. Early and later variants abused **TeamViewer** by delivering malicious Office documents through targeted spam or job-application lures, then installing signed TeamViewer components alongside a rogue DLL and configuration files. The malware used **DLL search order hijacking** and **DLL side-loading** to hide the remote-access interface, suppress user prompts, steal the victim’s TeamViewer ID, and enable data theft, arbitrary command execution, and persistent backdoor access while blending traffic with legitimate remote-support activity. More recent activity showed the operators adapting both tooling and delivery to reduce detection. Deep Instinct reported that 2022 campaigns shifted from TeamViewer to **Safib Assistant**, a similar remote administration product, and used oversized droppers and inflated DLLs to evade scanning limits before moving to Inno Setup bundles containing the legitimate tool and SpyAgent alone. HP Wolf Security separately documented a blocked intrusion at a financial organization in which a resume-themed Word document launched TeamViewer and `regsvr32.exe` to execute a malicious DLL, with infrastructure tied to domains including **morteson[.]com**, **creatorz123[.]top**, **123faster[.]top**, and **thief[.]lol**. The reporting shows a sustained espionage-oriented threat that continues to repurpose trusted remote-access software as malware delivery and command-and-control cover.
Sep 2, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Threat actors are impersonating corporate IT support staff in **Microsoft Teams** voice calls to trick employees into granting remote access and installing the **EtherRAT** remote access trojan. The campaign begins with a phishing email themed as an **"Employee Survey"**, then shifts to a Teams call from an external Microsoft 365 tenant, where the caller poses as helpdesk or system administration staff and persuades the target to enable screen sharing and install legitimate remote management tools such as **HopToDesk** or **AnyDesk**. Attackers then execute a malicious MSI installer, including samples such as `v7.msi`, to deploy a multi-stage loader that fetches a legitimate **Node.js** runtime, decrypts embedded payloads, and launches EtherRAT. Researchers said EtherRAT is a cross-platform Node.js RAT for **Windows, Linux, and macOS** that supports command execution, file manipulation, persistence, and data theft. The malware uses **Ethereum smart contracts** to locate active command-and-control infrastructure, with some reporting also noting a fallback conventional domain, making disruption more difficult. Investigators found multiple installer versions in an open directory, including versions 1 through 9, indicating active development, and identified Teams forensic artifacts such as files beginning with `CtrlVirtualCursorWin_*` that may show an attacker remotely controlled a victim's desktop during a session. The activity adds to a broader rise in Teams-based impersonation attacks, even as Microsoft rolls out protections such as external caller warnings and stricter handling of suspected third-party bots.
Jul 7, 2026