Loading story…
Kaspersky reported that the WhiteBear espionage campaign used the Gazer backdoor, a modular malware platform associated with long-term covert operations. According to MITRE ATT&CK, Gazer communicates with command-and-control servers over HTTP and protects parts of its traffic and stored data with custom encryption based on 3DES and RSA, indicating a design focused on resilient and concealed remote access.
The malware supports multiple persistence and evasion methods, including Start Menu shortcut creation or modification, Winlogon Shell registry changes, scheduled tasks, and screensaver-based execution. MITRE also documents process injection, thread execution hijacking, file download capability, configuration storage in alternate data streams, and stealth measures such as mutex use, file deletion, fake compilation timestamps in early variants, and code signing with valid certificates, underscoring the campaign's emphasis on maintaining access while avoiding detection.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Securelist published research titled "Introducing WhiteBear," which introduced the WhiteBear platform and its Gazer malware component. The reporting described Gazer's capabilities and linked it to the broader threat activity.
MITRE ATT&CK published a software entry for Gazer (S0168), documenting its command-and-control, persistence, encryption, injection, and stealth behaviors and mapping them to ATT&CK techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued development of the **EAGERBEE** backdoor, also tracked as **Thumtais**, in espionage campaigns attributed to China-linked operators targeting government and private-sector organizations in Japan, Southeast Asia, Mongolia, and the Middle East. Recent investigations tied the malware to intrusion activity associated with **REF5961** and overlaps with **TA428/LuckyMouse**, while also noting possible links to **Tonto Team**. Earlier incidents included compromise of a foreign affairs ministry in an ASEAN state and a Japanese consulting company, where EAGERBEE appeared alongside other implants such as **RUDEBIRD** and **DOWNTOWN** and was delivered through DLL hijacking or sideloading chains. Newer EAGERBEE variants add capabilities aimed at persistence, stealth, and flexible command-and-control, including **listen-mode** operation that opens ports on infected hosts for inbound C2, encrypted configuration and communications, authenticated proxy support, and in-memory execution of downloaded payloads. Researchers also observed deployment of **WinDivert** to interfere with DNS lookups for security vendor domains and identified related tooling such as **OAED Loader** delivering the Go-based **NKN-goRAT**, which uses the decentralized **NKN** network for C2; defenders were advised to watch for unusual Windows services, newly opened TCP/UDP ports, dropped files, and traffic to `seed.nkn.org` over TCP/30003.
Aug 15, 2026
Microsoft disclosed a destructive Go-based Windows backdoor dubbed **GigaWiper** that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses **RabbitMQ**, **Redis**, and in some reporting **MinIO** for command, result handling, and data exfiltration. Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to **Crucio** and **FlockWiper** and references to a broader framework labeled **GRAT**. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier **BLUERABBIT** findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Jul 17, 2026
The **Sticky Werewolf** cyber-espionage group has been linked to phishing attacks against Russian scientific, industrial, and government organizations, with later reporting also identifying targets in Belarus. In one campaign, attackers impersonated Russia’s Ministry of Industry and Trade in emails carrying decoy documents and a password-protected archive; another wave used phishing links generated through **IP Logger** to disguise delivery URLs while collecting victim profiling data such as IP address, location, browser version, and operating system. Researchers also tied the activity to earlier spoofed-email operations themed around Russian state bodies including **EMERCOM**, the Ministry of Construction, and the **FSB**. The intrusions ultimately deployed **Ozone RAT**, and in some cases **Darktrack RAT**, while showing victims decoy files to mask the infection. Analysts said the Ozone RAT loader was copied into `%TEMP%` under names such as `utorrent.exe`, established persistence through a shortcut in the Windows Startup folder, and used a modular chain in which it downloaded an encrypted DLL from a command-and-control server, saved it as `data.dbf`, decrypted it, and loaded it reflectively into memory via the Delphi API function **BTMemoryModule**. The malware was reported to support remote command execution, file and process management, registry changes, keylogging, screen, webcam, and microphone capture, password theft from browsers and mail clients, hidden virtual network computing (**HVNC**) control, reverse proxying, payload delivery, and self-deletion.
Aug 15, 2026