Loading story…
Cisco Talos reported that GravityRAT, a remote access trojan used in targeted attacks against organizations in India, evolved over a two-year period into a more capable and evasive threat. The malware was delivered through malicious Microsoft Office documents, likely sent by email, and fetched its payload when victims opened the file and enabled macros. Researchers linked the campaign to persistent targeting activity and described the malware as an advanced RAT designed to maintain access to compromised systems.
Analysis highlighted GravityRAT’s unusually extensive anti-analysis features, including seven virtual-machine detection techniques and a novel check of CPU temperature to identify hypervisor-based sandbox environments. The reporting also indicated the operators may have uploaded early lure documents to VirusTotal to measure static antivirus detection before wider use, underscoring a deliberate effort to refine delivery and evade security tools.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Cisco Talos researchers Warren Mercer and Paul Rascagnères discovered and analyzed GravityRAT, an advanced remote access trojan used in targeted attacks against organizations in India. Their analysis described delivery via malicious Microsoft Office documents and highlighted extensive anti-virtual-machine techniques, including a CPU-temperature check.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that Pakistani-linked espionage operations continued to target Indian defense, government, police, and technology-related personnel with evolving malware delivered through spear phishing, social engineering, and trojanized applications. Cisco Talos said **Operation Celestial Force**, attributed to the **Cosmic Leopard** cluster, has run since at least 2018 and uses a cross-platform toolset including **GravityRAT** for Windows and Android, the **HeavyLift** Electron-based loader, and the **GravityAdmin** campaign management utility. Earlier Securelist research showed GravityRAT had already expanded from Windows into **Android** and **macOS**, using fake apps and spoofed update domains to steal device data, messages, call logs, documents, screenshots, keystrokes, and other files while maintaining persistence and enabling remote command execution. Separate reporting tied **APT36 / Transparent Tribe / Mythic Leopard** to parallel campaigns against Indian military and government targets using counterfeit apps and themed lures. Securelist documented trojanized Android apps, including a fake **Aarogya Setu** app, that deployed a modified **AhMyth** RAT capable of downloading additional APKs, recording audio, deleting selected SMS messages, and exfiltrating contacts, WhatsApp media, documents, and other data. BleepingComputer, citing Talos, also described fake **Kavach** authentication apps used to infect Indian government employees with updated **CrimsonRAT** and a lightweight .NET RAT, underscoring a sustained effort to refine mobile and desktop surveillance malware for intelligence collection.
Aug 15, 2026
Researchers documented continued use of **njRAT** (also known as **Bladabindi**) in targeted intrusion campaigns alongside other commodity and custom remote access trojans. Cisco Talos said the **SideCopy** APT, which targets government personnel and other entities in India, incorporated njRAT into multi-stage infection chains that often begin with malicious `.LNK` files and progress through HTAs and loader DLLs before deploying RATs and post-compromise plugins for credential theft, file enumeration, and keylogging. ESET separately reported **Operation Spalax**, a phishing-driven campaign aimed at Colombian government institutions and private-sector organizations, especially in the energy and metallurgical sectors, where attackers used shortened links, RAR archives, and multiple droppers to install njRAT, **Remcos**, and **AsyncRAT** for surveillance and remote control. A technical analysis of an **njRAT 0.6.4** sample tied to the campaign ID `splitgateukrayna` showed how the malware persists by copying itself to `%AppData%\services64.exe`, creating a Run registry key, adding a Windows Firewall exception, and using the mutex `49e91d08e684b1770e0cefa60401157a`. The sample connected to `44gang44.duckdns[.]org` on port `2222`, profiled infected systems, and supported a broad set of capabilities including hidden shell execution, keylogging, screenshot capture, registry manipulation, plugin loading, payload download-and-execute, self-update, and uninstall. Across the reported campaigns, njRAT remained a flexible, low-cost espionage tool used to establish persistence, collect victim data, and enable long-term remote access.
Aug 15, 2026
Security researchers reported multiple malware campaigns emphasizing stealth and automation. K7 Lab analyzed a **Python-based RAT** packaged inside an apparently benign **ELF** executable, effectively embedding a Python runtime and scripts to evade simple file-type controls and complicate static inspection; the RAT also uses **adaptive beaconing** to reduce network noise by polling C2 rapidly when active (e.g., sub-second intervals) and sleeping longer when idle (e.g., `config.HELLO_INTERVAL`), lowering the chance of detection by behavior-based monitoring. Separately, threat reporting described a Vietnamese actor (“**Huna**”) targeting job seekers with phishing lures (often via **Dropbox-hosted** archives/links) to deliver **PureRAT** and related payloads, with tooling that shows strong indicators of **generative-AI-assisted development** (unusually detailed comments, numbered steps, and even operator instructions embedded in scripts). An Iran-aligned espionage operation attributed to **RedKitten** targeted Iranian human-rights NGOs and activists using malicious **Microsoft Excel** lures and multi-stage malware, including **AI-generated/obfuscated macros**, cloud and messaging platforms for C2 (e.g., *GitHub*, *Google Drive*, *Telegram*), and TTP overlap with known Iranian groups (e.g., *Charming Kitten*/*Nemesis Kitten* patterns), indicating continued evolution toward AI-enabled tradecraft and resilient infrastructure.
Jun 29, 2026