Loading story…
ESET attributed a 2021–2022 cyberespionage campaign to the Tick APT group after attackers breached an East Asian developer of data-loss prevention software and compromised its internal update servers. The intrusion allowed the group to execute malware inside the vendor’s network, where it deployed several tools including the previously undocumented ShadowPy downloader, the Netboy backdoor, Ghostdown, and customized ReVBShell payloads.
Investigators said the update-server compromise was likely used primarily for lateral movement within the DLP company rather than mass distribution to outside targets, but trojanized legitimate Q-Dir installers were also used and later reached systems at two customers in East Asia through remote support activity. Because the vendor served government and military organizations, the operation appears to have been aimed at intelligence collection rather than disruptive attacks, extending Tick’s access from the software provider into downstream customer environments.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
ESET disclosed a 2021–2022 campaign targeting an East Asian DLP software developer and attributed it with high confidence to the Tick APT group. The report also documented malware used in the intrusion, including the previously undocumented ShadowPy downloader, Netboy, Ghostdown, and customized ReVBShell payloads.
In June 2022, attackers again transferred trojanized Q-Dir installers to customer systems via remote support tooling. The activity formed part of the same intrusion chain affecting two customers of the DLP vendor.
In February 2022 and again in June 2022, trojanized Q-Dir installers were transferred to systems at two East Asian customers in the engineering and manufacturing sectors using the remote support tools helpU and ANYSUPPORT. This resulted in malware execution on customer systems.
In September 2021, another malicious ZIP update package was downloaded from a public-facing server and deployed inside the DLP company's network via the legitimate update agent. ESET assessed the compromised update infrastructure was likely used for lateral movement within the vendor rather than broad external distribution.
In June 2021, a malicious ZIP update package was downloaded from an internal server and deployed by the vendor's legitimate update agent on machines inside the DLP company's network. The executable contacted 103.127.124[.]117 to retrieve a key used to decrypt an embedded payload assessed as ReVBShell.
Starting in April 2021, the attackers placed both 32-bit and 64-bit trojanized installers for the legitimate Q-Dir application inside the DLP vendor's network. These installers were later used to deploy payloads including customized ReVBShell variants.
Attackers gained access to the network of an East Asian company that develops data-loss prevention software. ESET later assessed the operation as a cyberespionage campaign attributed with high confidence to the Tick APT group.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Multiple reports detailed **state-linked intrusion activity** relying on social engineering and trusted delivery mechanisms to gain initial access and establish remote control. Researchers reported a suspected state-affiliated espionage operation targeting government and financial organizations in **Kazakhstan and Afghanistan**, built around a previously unreported Windows DLL implant dubbed **KazakRAT** delivered via malicious `MSI` installers and decoy documents (e.g., a fake Kazakh presidential letter and an Afghan provincial memo). The malware was described as relatively unsophisticated—unencrypted HTTP beaconing and minimal obfuscation—yet capable of host reconnaissance, file search/exfiltration, and downloading/executing additional payloads, enabling long-running access since at least 2022. Separately, Insikt Group described **North Korean** operators (tracked as **PurpleBravo**) running the “**Contagious Interview**” campaign, using fake recruiter personas and weaponized “coding tests” hosted on platforms like GitHub to trick software developers into executing malware on corporate devices, supporting software supply-chain targeting. The toolset reportedly includes **BeaverTail** (JavaScript infostealer) and newly identified RATs **PylangGhost** and **GolangGhost**. In another supply-chain style incident, Trend research and an Emurasoft advisory reported the **official EmEditor download** being tampered with to serve a trojanized `MSI` whose `CustomAction` launched PowerShell to fetch staged payloads from lookalike domains (e.g., `EmEditorjp[.]com`, `EmEditorgb[.]com`, `EmEditorde[.]com`), followed by environment fingerprinting and geofencing checks—highlighting ongoing risk from compromised public software distribution channels.
Jun 29, 2026
Researchers disclosed **SockDetour**, a previously undocumented Windows backdoor used against U.S. defense contractors as a stealthy secondary implant for persistence. The malware operates **filelessly** and **socketlessly**, hijacking legitimate processes' network sockets with the Microsoft Detours library to create an encrypted command-and-control channel that is difficult to spot through host or network monitoring. Palo Alto Networks Unit 42 said at least four U.S.-based defense contractors were targeted and confirmed compromise at one organization, with compilation artifacts indicating the tool may have been in use since at least **July 2019**. Unit 42 linked the activity to the China-linked **TiltedTemple** cluster, also tracked by Microsoft as **DEV-0322**, and said the campaign overlapped with late-2021 intrusions involving **Zoho ManageEngine** exploitation; reporting also noted possible ties to **APT27** based on tactics and targeting. In one case, attackers delivered SockDetour from an external FTP server hosted on a compromised **QNAP NAS** device that had likely been exploited through **`CVE-2021-28799`**, the same flaw previously abused to deploy **eCh0raix** and associated with earlier **QLocker** ransomware activity, showing how vulnerable internet-facing NAS infrastructure was repurposed to support espionage operations.
Aug 15, 2026