Loading story…
SentinelOne reported that the Sandman APT targeted telecommunications providers with a rare LuaJIT-based malware platform dubbed DreamLand, expanding on earlier reporting that linked the toolkit to an intrusion against a government entity in Pakistan. Researchers described DreamLand as a modular Windows malware family that relies on compiled Lua scripts rather than conventional native implants, an uncommon design choice that complicates reverse engineering and gives operators flexible post-compromise control.
Technical analysis shows the infection chain using libcurl.dll to load UpdateCheck.dll, which then decrypts and decompresses an embedded LuaJIT orchestrator and executes additional compiled scripts stored in updater.ver. The malware includes anti-debugging features and uses Lua FFI to access Windows APIs directly, while configuration data points to HTTPS command-and-control over port 443 via ssl.explorecell.com. Researchers also identified a related loader, Comx64.dll, believed to come from the same developer and built to load shellcode from an encrypted local file, suggesting the toolkit remains under active development and may support future intrusions.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Additional public analysis documented DreamLand's infection chain using libcurl.dll, UpdateCheck.dll, and updater.ver, along with HTTPS command-and-control configuration pointing to ssl.explorecell.com over port 443. The write-up also described a related sample, Comx64.dll, used to load shellcode from an encrypted local file.
Kaspersky reported discovering a new modular malware strain named DreamLand in March 2023 while it was targeting a government entity in Pakistan. The malware stood out for using LuaJIT and Lua FFI in an APT context.
SentinelOne Labs published research on the Sandman APT, describing a mystery group targeting telecommunications organizations with a LuaJIT-based toolkit. The reference indicates public reporting on the campaign by September 2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLABS and QGroup GmbH identified a previously untracked threat cluster, **Sandman**, targeting telecommunications providers in the Middle East, Western Europe, and the South Asian subcontinent. The intrusion set used a modular backdoor called **LuaDream**, an unusual malware framework built on **LuaJIT**, and showed activity consistent with espionage-focused operations. Investigators said the actor stole administrative credentials, used **pass-the-hash** over **NTLM** to reach selected workstations, and moved laterally in a restrained manner designed to reduce the chance of detection. The attackers deployed LuaDream through **DLL hijacking**, planting a malicious `ualapi.dll` that was loaded by the Windows **Spooler** or **Fax** service. Researchers described LuaDream as a large, actively developed platform with dozens of components, plugin-based extensibility, and support for multiple command-and-control channels including **TCP**, **HTTPS**, **WebSocket**, and **QUIC**. SentinelLABS said it could not confidently tie Sandman to a known threat actor, but assessed that the combination of sophisticated tooling, infrastructure overlap across victims, and uneven operational tradecraft may point to a private contractor or mercenary-style group.
Jun 29, 2026
SentinelLABS, Microsoft, and PwC reported that the **Sandman APT** is likely connected to suspected China-based threat clusters tied to the **KEYPLUG** backdoor, especially `STORM-0866` and `Red Dev 40`. The assessment is based on multiple overlaps, including the presence of Sandman’s **LuaDream** malware alongside KEYPLUG in the same victim environments, shared targeting patterns in the **Middle East and South Asia**, and similar infrastructure practices such as hosting provider selection, reverse-proxy use, and domain naming conventions. Researchers said **LuaDream** and **KEYPLUG** remain distinct malware families, but they share notable design traits, including modular architecture, multi-protocol command-and-control support, comparable execution flow, and overlapping data-handling structures. The findings point to either operational cooperation or shared tooling within the broader China-linked espionage ecosystem, and also indicate that **Lua-based malware development** is no longer limited to Western or Western-aligned operators but is increasingly being adopted by China-linked adversaries.
Jun 29, 2026
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026