Loading story…
The Buhtrap group, previously known for financially motivated attacks on Russian banks and businesses, was observed conducting espionage operations against governmental institutions in Eastern Europe and Central Asia using a Windows local privilege escalation zero-day, CVE-2019-1132, in win32k.sys. The activity marked the first known use of a zero-day by the group and underscored its shift from cybercrime into intelligence-focused intrusions.
The campaigns retained several Buhtrap tradecraft elements, including malicious lure documents, NSIS installers used as droppers, abuse of valid code-signing certificates, and DLL side-loading through legitimate applications. Researchers also identified newer tooling, including a password-stealing grabber module and a Meterpreter payload that communicated through DNS tunneling and Microsoft-themed command-and-control domains, highlighting a blend of established criminal techniques with more advanced espionage capabilities.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In June 2019, Buhtrap was observed using CVE-2019-1132, a local privilege escalation vulnerability in Windows win32k.sys. The report describes this as the first observed zero-day exploit use by the group.
One of the first Buhtrap samples aimed at governmental organizations was observed in December 2015. It used a Ukrainian government-themed decoy and downloaded an NSIS installer that installed the main Buhtrap backdoor.
Since late 2015, Buhtrap's targeting shifted from Russian businesses and banks toward governmental institutions in Eastern Europe and Central Asia, while retaining many of its established tactics and tooling patterns.
Microsoft fixed the CVE-2019-1132 local privilege escalation vulnerability and released a patch following the report.
After discovering and analyzing the exploit, the vulnerability was reported to the Microsoft Security Response Center.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple campaigns using trojanized versions of **PuTTY** and other legitimate tools to compromise high-value users, including administrators, engineers, and technical support staff. LevelBlue said a recent malvertising operation pushed fake PuTTY installers through **Bing sponsored ads** and typosquatted domains such as `puttyy[.]org` and `puttysystems[.]com`, with a signed malicious executable creating scheduled-task persistence, dropping `twain_96.dll` and `green.dll`, and communicating with infrastructure linked to **Broomstick/Oyster** malware. In affected environments, the intrusions progressed to hands-on-keyboard activity, reconnaissance via `cmd.exe`, and **Kerberoasting** using an in-memory script derived from PowerSploit’s `Invoke-Kerberoast` to obtain RC4-HMAC Kerberos service tickets for offline cracking. Microsoft previously described a related tradecraft pattern in which North Korean state-backed **ZINC**—now tracked as **Diamond Sleet**—used social engineering on LinkedIn and WhatsApp to deliver weaponized open-source software, including **PuTTY**, **KiTTY**, **TightVNC Viewer**, **Sumatra PDF Reader**, and **muPDF**, to targets in media, defense, aerospace, and IT services across several countries. That activity deployed the **ZetaNile** malware family using DLL search-order hijacking, staged payloads, persistence, lateral movement, and data exfiltration, while separate analysis of Lazarus-linked **BLINDINGCAN** showed the group’s broader capability set for encrypted command-and-control, remote command execution, file transfer, and system discovery. Together, the reporting shows attackers repeatedly abusing trusted admin and open-source tools as malware delivery vehicles to gain persistence, steal credentials, and expand access inside victim networks.
Aug 15, 2026
Black Basta affiliates used a multi-stage social-engineering campaign to breach corporate networks by impersonating IT support staff in **Microsoft Teams** and persuading employees to grant remote access through **Windows Quick Assist** and **AnyDesk**. Researchers said the attacks often began with email bombing to overwhelm targets, followed by Teams chats or calls from attacker-controlled external Entra ID tenants using names such as "Help Desk" or "support." In earlier incidents, the group similarly abused Quick Assist after contacting victims by phone, showing a consistent pattern of using legitimate remote-support tools to gain initial access. After access was established, the attackers deployed additional tooling including **ScreenConnect**, **NetSupport Manager**, **Cobalt Strike**, and **SystemBC**-linked payloads, while also using credential-theft and lateral-movement activity such as accessing **LSASS**, scanning internal hosts, and running **Impacket `secretsdump.py`**. ReliaQuest also observed malicious QR-code lures tied to domains such as `qr-s1[.]com` through `qr-s4[.]com`, and a VBS-based infection chain that contacted `179.60.149[.]194` to retrieve follow-on payloads. The activity was attributed to Black Basta with high confidence, with reporting indicating infrastructure and Teams activity linked to Russia, and defenders were urged to restrict external Teams communications, limit trusted domains, and improve Teams, email, and remote-access monitoring.
Aug 14, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026