Loading story…
Researchers uncovered a long-running watering-hole campaign that selectively targeted an Asian religious and ethnic minority through nearly 10 compromised websites linked to community figures, charities, public bodies, and related organizations. Visitors were profiled with obfuscated JavaScript before selected targets were shown a fake Adobe Flash update prompt, allowing the operators to avoid broad exposure while focusing malware delivery on intended victims.
The intrusion chain relied on social engineering rather than browser exploits and used NSIS installers, GitHub-hosted payloads, and malware written in Go and Python. Identified tools included the Intelsyc Go stager, the Godlike12 Go backdoor, and modified versions of the open-source Stitch Python backdoor, while Google Drive was used as a command-and-control channel. Researchers said the operation had been active since at least May 2019, showed rapidly evolving low-cost tooling, and could not be confidently attributed to any known APT group.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On December 4, 2019, researchers discovered compromised websites that selectively triggered drive-by download attacks using fake Adobe Flash update warnings. The sites fingerprinted visitors and only continued the infection chain for validated targets.
Researchers assessed that the targeted watering-hole campaign had been active since at least May 2019, compromising websites associated with an Asian religious and ethnic group and using fake Adobe Flash update lures to infect selected visitors.
GitHub disabled the attackers' AdobeFlash32/FlashUpdate repository after it was reported. The repository had hosted the fake Flash update payloads used in the campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
Attackers compromised financial regulator websites in Poland, Mexico, and Uruguay and used them as watering holes to target banks and other financial institutions with a selective, multi-stage malware campaign. In Poland, employees at several banks were infected after visiting the website of the Polish Financial Supervision Authority (**KNF**), where altered JavaScript loaded a hidden iframe and redirected chosen visitors to attacker-controlled infrastructure. Researchers said the operation used IP-based filtering and whitelisting to focus on roughly 150 targeted IP addresses across more than 100 organizations in 31 countries, with Poland and Mexico among the most heavily targeted. The delivery chain included malicious JavaScript, staged shellcode, and exploit content hosted on domains including `sap.misapor[.]ch` and `eye-watch[.]in`, with attackers serving Adobe Flash and Microsoft Silverlight exploits, including a repackaged exploit for `CVE-2016-0034`. The payloads included droppers, loaders, and remote-access trojans capable of process injection, encrypted command-and-control, service-based persistence, registry storage, timestamp tampering, and remote file and command execution. Banks reported malware on workstations and some servers, along with suspicious encrypted outbound traffic, though they said they had not identified unauthorized customer transactions. BAE Systems, Symantec, and ESET all found code, infrastructure, and tradecraft overlaps with malware previously associated with the **Lazarus Group**, including links to Downloader.Ratankba and Destover-related tooling, but some researchers stopped short of definitive attribution. Analysts also found transliterated Russian words embedded in malware and exploit components and assessed them as a likely false-flag attempt rather than genuine evidence of Russian operators.
Aug 15, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026