Loading story…
MonPass, one of Mongolia’s largest certificate authorities, was breached and used to distribute a trojanized version of its official certificate installer containing a Cobalt Strike-based payload. Avast reported that the malicious installer was available from February 8 to March 3, 2021, giving attackers a trusted software distribution channel to infect selected victims through software they were likely to regard as legitimate.
Investigators found signs that a public MonPass web server had been compromised as many as eight times and hosted multiple webshells and backdoors. Avast worked with CERT Mongolia and MonPass on the investigation and said the intrusion showed traits consistent with a targeted cyber-espionage operation, though it did not definitively attribute the activity to a specific threat actor; the campaign was assessed against a backdrop of prior Chinese-linked operations targeting Mongolia and the surrounding region, and the backdoor appeared to be removed after the intended victims were reached.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Beginning in April 2021, Avast analyzed a cloned image of a MonPass server provided during the investigation. The analysis indicated that a public MonPass web server had likely been breached as many as eight separate times and contained multiple webshells and backdoors.
The malicious MonPass client installer stopped being distributed on March 3, 2021. Avast assessed that the attackers likely removed the backdoor themselves after reaching their intended targets.
From March to June 2021, Avast worked with CERT Mongolia and MonPass to investigate the breach and its impact. During this period, MonPass also cleaned up the compromised server and notified customers who had downloaded the backdoored client earlier in 2021.
In late March 2021, Avast found the backdoored MonPass installer and identified the associated backdoor on one of its customers' systems. This discovery triggered the subsequent investigation into MonPass's infrastructure.
MonPass's official certificate installer was distributed with a malicious Cobalt Strike-based payload, turning the CA's trusted software channel into a malware delivery mechanism. The compromised installer was available between February 8 and March 3, 2021.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported two active intrusion patterns aimed at stealing credentials and maintaining access: a malvertising campaign that impersonated software brands such as **Notion** in Google search ads to deliver **Rhadamanthys** on Windows and **Atomic Stealer** on macOS, and a separate cyber-espionage operation by **Mantis** (also tracked as **Arid Viper**, **Desert Falcon**, and `APT-C-23`) targeting organizations in the Palestinian territories. In the malvertising chain, victims were redirected through intermediary domains, screened with browser-based anti-VM checks, and sent to fake download pages; the Windows installer fetched its payload from a URL hosted on TextBin, while researchers linked the advertiser account to “BUDNIK PAWEŁ” in Poland and noted thousands of views of the staging URL.
Jun 29, 2026
Multiple reports detailed **state-linked intrusion activity** relying on social engineering and trusted delivery mechanisms to gain initial access and establish remote control. Researchers reported a suspected state-affiliated espionage operation targeting government and financial organizations in **Kazakhstan and Afghanistan**, built around a previously unreported Windows DLL implant dubbed **KazakRAT** delivered via malicious `MSI` installers and decoy documents (e.g., a fake Kazakh presidential letter and an Afghan provincial memo). The malware was described as relatively unsophisticated—unencrypted HTTP beaconing and minimal obfuscation—yet capable of host reconnaissance, file search/exfiltration, and downloading/executing additional payloads, enabling long-running access since at least 2022. Separately, Insikt Group described **North Korean** operators (tracked as **PurpleBravo**) running the “**Contagious Interview**” campaign, using fake recruiter personas and weaponized “coding tests” hosted on platforms like GitHub to trick software developers into executing malware on corporate devices, supporting software supply-chain targeting. The toolset reportedly includes **BeaverTail** (JavaScript infostealer) and newly identified RATs **PylangGhost** and **GolangGhost**. In another supply-chain style incident, Trend research and an Emurasoft advisory reported the **official EmEditor download** being tampered with to serve a trojanized `MSI` whose `CustomAction` launched PowerShell to fetch staged payloads from lookalike domains (e.g., `EmEditorjp[.]com`, `EmEditorgb[.]com`, `EmEditorde[.]com`), followed by environment fingerprinting and geofencing checks—highlighting ongoing risk from compromised public software distribution channels.
Jun 29, 2026
Attackers have been exploiting remote code execution flaws in the Sunlogin and AweSun remote-control tools to compromise exposed systems and install multiple malware families, including **PlugX** and **Sliver**. AhnLab reported that vulnerable Sunlogin versions—especially releases earlier than `11.0.0.33`—were used in campaigns tied to `CNVD-2022-10270` and `CNVD-2022-03672`, with additional payloads such as **Gh0st RAT**, **XMRig**, and **Powercat** also observed. In one intrusion, the attackers used a PowerShell-based chain and a bring-your-own-vulnerable-driver (**BYOVD**) technique leveraging `mhyprot2.sys` to disable security tools before launching a reverse shell and later deploying a Sliver implant configured for **mTLS** command-and-control. In a separate but related campaign, attackers used Sunlogin and AweSun exploitation to deliver the **PlugX** backdoor through a DLL side-loading chain. A legitimate ESET executable, `esetservice.exe`, loaded a malicious `http_dll.dll`, which decrypted and executed PlugX from `lang.dat` directly in memory. AhnLab linked the activity to infrastructure at `imango[.]ink`, including `api.imango[.]ink` and `cdn.imango[.]ink` over ports `443` and `53`. The PlugX sample matched the **BackDoor.PlugX.38** family and supported UAC bypass, service installation, process injection, plugin execution, keylogging, clipboard theft, screenshot capture, remote shell access, and RDP-based propagation, underscoring continued abuse of remote-management software vulnerabilities for persistent backdoor deployment.
Aug 15, 2026