Loading story…
Huntress reported an advanced persistent threat campaign targeting Vietnamese human-rights defenders, indicating continued espionage-focused targeting of civil-society organizations in Vietnam. The available reference does not identify the actor, malware family, intrusion vector, or affected organizations.
Separately, dmpdump documented a stager targeting a Russian organization. Although the references describe targeted activity in different regions, neither available summary provides sufficient technical detail to establish a shared actor, infrastructure, malware lineage, or operational objective.
TTPs, infrastructure, and targeting history in one profile.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Syrian activists were hit by a sustained surveillance campaign that combined Facebook phishing with malware-laced files masquerading as revolutionary documents and other trusted content. Electronic Frontier Foundation reporting described attackers stealing account credentials through fake login pages and deploying remote-access trojans to monitor victims, with one later campaign using the commercially available **BlackShades** malware to capture data and maintain access to compromised systems. A separate EFF report said Vietnamese activists also faced highly personalized malware operations, indicating that threat actors tailored lures and surveillance tools to specific individuals and their relationships. Taken together, the incidents showed politically motivated targeting of dissidents through social engineering, credential theft, and commodity as well as custom malware designed to spy on activists and their networks.
Jul 12, 2026
Multiple advanced persistent threat (APT) groups and cybercriminal actors have launched sophisticated campaigns targeting organizations, IT professionals, and software developers using a variety of tactics and malware. Notable incidents include the deployment of malicious Visual Studio Code extensions containing Rust-based implants that mimic legitimate extensions to evade detection, as well as the use of public blockchain and cloud services for command-and-control (C2) communications. Other campaigns involve the distribution of trojanized installers for popular software, such as Telegram, to deliver ValleyRat malware, and the mass publication of malicious npm packages by North Korean actors to spread updated OtterCookie malware, which is capable of credential theft, remote access, and data exfiltration. Additional threats include targeted spear-phishing campaigns like "Operation Hanoi Thief," which uses pseudo-polyglot documents to compromise Vietnamese IT and HR professionals, and the Tomiris APT group’s adoption of new multi-language implants leveraging public messaging platforms for C2. Meanwhile, large-scale phishing campaigns are using seasonal lures to trick users into installing remote management tools, potentially for initial access brokering. These incidents highlight the increasing sophistication and diversity of attack vectors, the blending of legitimate and malicious infrastructure, and the persistent targeting of both organizations and individuals in the technology sector.
Jun 29, 2026
Researchers detailed two active Russia-linked threat operations using different intrusion models to target Western organizations. **TA577**, a phishing group active since 2020, was observed sending HTML attachments that force outbound SMB connections to `file://` URLs in order to capture **NTLMv2** authentication handshakes and steal credential hashes. Infrastructure hunting tied the campaign to a narrowed set of likely servers identified through Impacket-like 8-character SMB target names, a distinctive SMB server GUID, shared SSH banner hashes, and recurring hosting patterns across providers including **GLOBALWAYS**; some hosts also exposed a **"We’ll back soon.."** page, login panels, or default Apache pages. A separate analysis examined **NoName057(16)**, a pro-Russian hacktivist collective that has sustained disruptive attacks against Western targets, especially Italian banks, government entities, military infrastructure, and public administrations. The group operates a volunteer-driven DDoS ecosystem known as **DDosia** or **People Go Stresser 2.0**, combining attack tools, support channels, operational guidance, and cryptocurrency rewards to coordinate participants. Its operations primarily use Layer 7 HTTP floods and Layer 4 TCP-SYN attacks, with most traffic aimed at **TLS/443** services but also hitting SSH, FTP, and secure email ports; researchers also noted prior links between the collective and **Bobik RAT** infections used to support DDoS activity.
Jul 12, 2026