Loading story…
Researchers reported a newly observed Trojan linked by shared code to the COMpfun malware family and assessed with medium-to-low confidence as associated with Turla. The campaign targeted diplomatic entities in Europe and began with a spoofed visa application used as the initial dropper, apparently obtained from a LAN shared directory. The malware stood out for using unusual HTTP/HTTPS response codes—including 402 and 422 through 429—as part of its command-and-control channel to queue and trigger attacker commands.
Once installed, the Trojan could fingerprint infected hosts, log keystrokes, steal clipboard data, capture screenshots, propagate via USB, enumerate network resources, and maintain persistence through COM hijacking. It also used anti-analysis checks to detect virtual machines, debuggers, and monitoring tools, and could inject into Windows, security, or browser processes. Communications and stored data were protected with RSA, AES-128, XOR, and LZNT1 compression, underscoring the malware’s technically distinctive evolution within the COMpfun toolset.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers observed a new Trojan in November 2019 that shared a code base with COMpfun and was assessed with medium-to-low confidence as linked to Turla. The campaign targeted diplomatic entities in Europe and used a spoofed visa application from a LAN shared directory as the initial dropper.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the **Reductor** Trojan, a malware family linked by code similarities to **COMpfun** and tentatively associated with **Turla**, compromised victims by patching browser and system pseudo-random number generator functions in memory. That let the malware insert encrypted, victim-specific identifiers into the TLS `client_random` field without altering packets directly, enabling operators to recognize encrypted sessions and potentially support interception workflows. The campaign primarily targeted users in **Russia** and **Belarus**, and Reductor also installed root certificates, supported remote certificate updates, and maintained persistence through an **LSA notification package** while communicating with command-and-control servers over **HTTP POST** using **AES-128**-encrypted host identifiers. Investigators said victims were infected through trojanized software installers downloaded over **HTTP** from warez sites or through secondary delivery from systems already compromised by COMpfun. Kaspersky assessed that the attackers likely controlled victims’ network channels and replaced legitimate installers on the fly before delivery. The activity highlighted a stealthy persistence and traffic-marking approach consistent with techniques such as **COM object hijacking** and other low-visibility Windows persistence methods, underscoring how the operators combined installer tampering, certificate abuse, and in-memory browser manipulation to track and compromise protected web traffic.
Aug 15, 2026
Researchers tied the long-running **Comfoo** remote access trojan to broader Chinese-linked cyber-espionage activity after identifying overlaps with the **Luckycat** campaign and related APT operations. SecureWorks reported that Comfoo had been under continuous development since at least 2006, was previously associated with the 2010 RSA breach, and used encrypted HTTP communications, rendezvous-style command-and-control, and DNS obfuscation with dynamic DNS and bogus IP resolutions to hide active infrastructure. Trend Micro separately described Luckycat as an espionage campaign active since at least 2011 that used spearphishing emails and malicious attachments exploiting vulnerabilities including `CVE-2010-3333`, along with Adobe Reader and Flash flaws, to compromise targets in India, Japan, and Tibetan organizations. The combined reporting shows a broad victim set spanning government and private-sector organizations in the United States, Europe, and Asia Pacific, as well as aerospace, energy, engineering, shipping, and military research entities. SecureWorks said it monitored dozens of active Comfoo relays, observed more than 200 malware variants and 64 campaign tags, and found the Comfoo relay server lacked authentication, allowing passive monitoring of victim logins and possible relay takeover by anyone with protocol knowledge and the static XOR key. Trend Micro said Luckycat deployed **TROJ_WIMMIE** and **VBS_WIMMIE** backdoors over HTTP port 80 and shared malware or hosting infrastructure with campaigns including **ShadowNet**, **Duojeen**, **Sparksrv**, and **Comfoo**, reinforcing links between these espionage operations.
Aug 15, 2026
Researchers reported a large-scale phishing campaign targeting Windows users with malicious archives that masquerade as business cooperation or payment-related documents from well-known companies. The infection chain uses heavily obfuscated JScript droppers and an AutoIt- or Lua-based loader disguised as a TrueType font (`.ttf`) file, enabling a largely fileless compromise path designed to avoid detection. Security reporting described the operation as global in scope, with lures crafted to persuade recipients to open fake font files that trigger the malware delivery process. The campaign has deployed multiple commodity malware families, including **Agent Tesla**, **Remcos**, **XWorm**, and **Best Private LOGGER**, the latter assessed as a variant of **Snake Keylogger** based on shared modules and coding patterns. Researchers said the loader evolved significantly from late 2025 through mid-2026, adding anti-analysis features such as junk code, string obfuscation, API unhooking, breakpoint neutralization, Donut shellcode signature patching, decoy memory, and segmented shellcode decryption through a Vectored Exception Handler. Published indicators include domains, IP addresses, a Discord-hosted malicious JavaScript file, and SHA-256 hashes to support enterprise detection and threat hunting.
Jul 17, 2026