Loading story…
Researchers tracking Ursnif uncovered a wider command-and-control footprint tied to the long-running banking trojan and its role in later-stage ransomware intrusions. Bridewell identified a distinctive SSL certificate pattern and related network traits that revealed 72 additional servers, then used a second hunt rule to find 7 more previously missed systems. Several of the discovered C2 nodes had gone unreported or were poorly detected by security tools, with an average VirusTotal detection score of 4.78, and the infrastructure was concentrated in Germany, the Netherlands, and Russia across providers including servinga GmbH, Datasource AG, and GleSYS AB.
The findings reinforce Ursnif's evolution from a banking trojan into a broader intrusion enabler used for credential theft, data exfiltration, and ransomware access. Earlier reporting linked Ursnif to campaigns against more than 100 Italian banks, theft of over 1,700 credential sets from one payment processor, and phishing-led infections targeting organizations in Italy and the United States. Bridewell also tied current activity to malicious LibreOffice installers, DLL payloads, and domains including gameindikdowd[.]ru, while noting overlap with intrusions associated with the Royal ransomware group.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
One of the Ursnif command-and-control IPs later highlighted as unreported, 31.214.157[.]31, had a Shodan scan date of 2023-04-30. Bridewell noted it had a low VirusTotal detection rate of 2/87.
CISA stated in March 2023 that the Royal ransomware group uses malware tools and derivatives such as Ursnif/Gozi for data aggregation and exfiltration.
Shodan history showed that IP address 185.189.151[.]38 used an SSL certificate matching Bridewell's Ursnif hunt rule in January 2023. The server was linked to the MSICBE.tmp sample, which was configured to beacon to that IP.
Royal ransomware became a prominent threat to organizations globally starting in September 2022. The Bridewell report frames Ursnif as a malware family used during Royal ransomware intrusions.
Darktrace documented a 2020 Ursnif campaign in which a phishing email sent to a US bank employee led to execution of a malicious file disguised as a .cab archive. The malware contacted command-and-control servers registered in Russia one day before the campaign began, and those IPs were not blacklisted at the time.
The Ursnif Trojan was first discovered in 2007 and initially emerged as a simple banking Trojan before later evolving into a more sophisticated information stealer.
Researchers built a second hunt rule using HTTP header information pivoted from 176.10.111[.]167. The rule returned 55 servers and, after deduplication, surfaced 7 servers not caught by the initial SSL-based hunt.
Using a distinctive SSL certificate pattern and other fingerprintable features, researchers identified 72 additional servers of interest linked to Ursnif infrastructure. The analysis also found several Ursnif C2 servers were unreported or poorly detected by security vendors.
Avast reported that Ursnif had been used in attacks against at least 100 banks in Italy, stealing credentials and financial data. In one case, an unnamed payment processor had more than 1,700 credential sets stolen, and Avast shared findings with identifiable victim banks and CERTFin Italy.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 78 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **Ursnif** campaigns in which the malware evolved beyond a traditional banking trojan into a stealthy loader, reconnaissance tool, and credential theft platform. In North America and Europe, attackers hijacked existing email threads and sent links to password-protected ZIP archives containing obfuscated JavaScript, while other operations used phishing lures themed as Italian courier and energy companies with malicious Office documents. The malware chain commonly relied on Windows scripting and **LOLBins** such as `wscript` and `regsvr32`, staged DLL loading, anti-analysis tricks, and geofencing or locale checks to reduce detection and limit infections to intended victims. The activity was tied to sustained, targeted operations including campaigns attributed to **TA544** against Italian organizations and a separate **LOLSnif** variant observed from 2019 into 2020. Analysts reported that the malware reused infrastructure, bypassed local proxies through COM interfaces and Internet Explorer automation, and used WMI and broken PE headers to frustrate defenders. In several intrusions, Ursnif infections led to follow-on payloads including **Cobalt Strike Beacon**, **TeamViewer/TVRat**, and a VNC-related module, showing that the campaigns supported both credential theft and broader post-compromise remote access.
Aug 15, 2026
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026