Loading story…
A China-linked threat group tracked as admin@338 targeted Hong Kong media organizations with the BUBBLEWRAP second-stage backdoor, using Dropbox for malware communications. Reporting tied the activity to intrusions against media outlets, while MITRE ATT&CK identifies BUBBLEWRAP as malware associated with the same group.
BUBBLEWRAP is described as a full-featured backdoor that can be configured to run automatically at system boot, giving attackers persistence on compromised hosts. The malware also supports checking, uploading, and registering plug-ins, allowing operators to expand capabilities after deployment and maintain flexible post-compromise control over victim systems.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
FireEye published research on a China-based threat group using Dropbox for malware communications and targeting Hong Kong media outlets. The reporting is the cited source for BUBBLEWRAP activity associated with the admin@338 group.
MITRE ATT&CK created a software entry for BUBBLEWRAP, describing it as a full-featured second-stage backdoor used by admin@338. The entry notes persistence at system boot and support for checking, uploading, and registering plug-ins.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple malware campaigns that disguised executables as document files to trick users into launching backdoors. In one case, attackers used a file named **"2021년 국방부 업무보고 수정.pif"** that appeared to be a revised South Korean Ministry of National Defense report; when opened, it displayed a legitimate PDF while silently dropping a malicious DLL to `C:\ProgramData\Intel\Driver\driver.cfg`, executing it with **`regsvr32.exe`**, and creating a scheduled task named **`Disk0`** to run every 30 minutes. The payload was identified as a downloader that contacted command-and-control infrastructure for follow-on instructions. A separate campaign used a malicious **SCR** file signed with a valid certificate from a well-known Korean company and presented with a PDF-like icon to reduce suspicion. After execution, the malware opened a decoy PDF from `%TEMP%`, extracted a DLL named `config.dat` into `C:\Users\Public\`, launched it with **`rundll32.exe`**, and deleted the original dropper. The backdoor then established persistence either through a **`MicrosoftEdgeInstaller`** service or a registry key, decrypted embedded configuration data with **RC4** when needed, and connected to its C2 server to support file transfer, process execution, screenshot capture, configuration updates, and code injection.
Aug 15, 2026
China-linked espionage group **BlackTech**—also tracked as **Earth Hundun**, **Palmerworm**, and **Red Djinn**—was tied to sustained intrusions across East Asia, with a heavy focus on Taiwan and Japan and victims spanning government, media, telecommunications, defense, academia, technology, semiconductors, manufacturing, and professional services. Reporting describes spearphishing campaigns using password-protected archives and malicious Excel macro files, alongside exploitation of internet-facing systems including **ProxyLogon**, `CVE-2015-5119`, and `CVE-2017-7269`, to gain initial access. In Japanese campaigns, researchers linked tools including **Flagpro**, **BTSDoor**, **LAMICE**, **BUSYICE**, **TELESWORD**, **DELTABEEF**, **SELFMAKE**, and **SPIDERPIG** to the actor, while earlier operations used **PLEAD**, **DRIGO**, **Waterbear**, and **Shrouded Crossbow** malware built around **BIFROST/BIFROSE**, **KIVARS**, and **XBOW** variants. Researchers said BlackTech used modular, multi-stage malware to steal credentials, profile hosts, maintain persistence, and exfiltrate sensitive documents, including government, defense, budget, and foreign-affairs material. **Flagpro** was described as an early-stage downloader and credential stealer that could fetch second-stage payloads such as **BTSDoor**, while **Waterbear** operated as an in-memory backdoor and **DRIGO** exfiltrated data through Google services; separate analysis also identified a Linux **ELF Bifrose** variant, showing the group’s tooling extends beyond Windows. Investigations further uncovered exposed directories and overlapping command-and-control infrastructure tied to BlackTech, including malware controllers and exploit collections for routers, Citrix, MikroTik, VMware vRealize, Cisco RV devices, Hongdian routers, and Oracle WebLogic, while domain-tracking research showed the actor repeatedly reused registrant details, name servers, and tech-themed domains even as registrar choices shifted over time.
Aug 15, 2026
Security researchers reported multiple campaigns using trojanized versions of **PuTTY** and other legitimate tools to compromise high-value users, including administrators, engineers, and technical support staff. LevelBlue said a recent malvertising operation pushed fake PuTTY installers through **Bing sponsored ads** and typosquatted domains such as `puttyy[.]org` and `puttysystems[.]com`, with a signed malicious executable creating scheduled-task persistence, dropping `twain_96.dll` and `green.dll`, and communicating with infrastructure linked to **Broomstick/Oyster** malware. In affected environments, the intrusions progressed to hands-on-keyboard activity, reconnaissance via `cmd.exe`, and **Kerberoasting** using an in-memory script derived from PowerSploit’s `Invoke-Kerberoast` to obtain RC4-HMAC Kerberos service tickets for offline cracking. Microsoft previously described a related tradecraft pattern in which North Korean state-backed **ZINC**—now tracked as **Diamond Sleet**—used social engineering on LinkedIn and WhatsApp to deliver weaponized open-source software, including **PuTTY**, **KiTTY**, **TightVNC Viewer**, **Sumatra PDF Reader**, and **muPDF**, to targets in media, defense, aerospace, and IT services across several countries. That activity deployed the **ZetaNile** malware family using DLL search-order hijacking, staged payloads, persistence, lateral movement, and data exfiltration, while separate analysis of Lazarus-linked **BLINDINGCAN** showed the group’s broader capability set for encrypted command-and-control, remote command execution, file transfer, and system discovery. Together, the reporting shows attackers repeatedly abusing trusted admin and open-source tools as malware delivery vehicles to gain persistence, steal credentials, and expand access inside victim networks.
Aug 15, 2026