Loading story…
Researchers identified an exposed Chinese-language environment dubbed Robobox that appears associated with the Coruna/Bee iOS command-and-control ecosystem, an exploit framework previously reverse engineered from its JavaScript components. Hunt.io attack-capture data showed a dashboard and Node.js backend, deployment documentation, mock operational data, a Cobalt Strike team server, a Linux remote-access trojan, and malware-staging services. The exposed instance appears to have been a test or demonstration deployment rather than a confirmed active Coruna operation.
The infrastructure also contained a fake Sogou Pinyin update chain aimed at mainland Chinese users that reportedly served ImageMagik.dll and SGWangzaix.exe. Researchers observed repetitive commands, implementation defects, and React/Vite, backend, and documentation artifacts consistent with AI- or LLM-assisted development and administration, raising concern that operators are testing more autonomous malware creation, reconnaissance, and deployment workflows. The operators' identity, the environment's intended purpose, and whether victims downloaded the staged payloads remain unconfirmed.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
The exposed directory contained a fake Sogou Pinyin update chain assessed as targeting mainland Chinese users and reported to deliver ImageMagik.dll and SGWangzaix.exe. An access log recorded one download of the DLL by a server located in Hong Kong.
The environment hosted a reportedly active Cobalt Strike team server, reachable through r1u1.com, alongside Npcap and scripts for silent installation. Bash history indicated the host installed MySQL and Apache, configured Cobalt Strike, compiled and launched the RAT, and started the Bee iOS C2 framework.
Researchers found a binary named agent that masqueraded as WinPerfDiagSvc but functioned as a Linux RAT labeled as a client for “AI VPS Manager.” The RAT used crontab persistence, encrypted reverse-shell communications, and polled 45.115.124.42:80 via the /api/v3/sync endpoint.
The exposed files included plan.md, info.md, and Deploy.md documents apparently intended to guide an automated system in recreating and deploying the Chinese frontend. Researchers assessed the backend and operational history as showing AI- or LLM-assisted development and administration, while mock data and a mock-up switch suggested the Coruna deployment may have been a test or demonstration rather than a confirmed live operation.
Researchers using Hunt.io attack-capture data identified an exposed Chinese-language environment associated with the Coruna/Bee iOS C2 ecosystem. It included a Bee-like React/Vite dashboard, Node.js backend, device and exploit-chain tracking, and collection functions for wallets, SMS, photos, and other data from compromised iOS devices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Google-owned Mandiant disclosed infrastructure tied to **Coruna**, an iOS exploit kit delivered through a large network of disposable domains and subdomains. The identified URLs used both HTTP and HTTPS and followed recurring path patterns such as `/group.html`, `/tuiliu/group.html`, `/static/analytics.html`, and `/88k4ez/group.html`, indicating coordinated staging, traffic routing, or payload delivery across the operation. The delivery network included cryptocurrency-themed, gaming-themed, app-store-themed, and typo-squatted domains designed to imitate legitimate brands or attract victims with lures related to digital assets and mobile apps. The breadth and branding of the infrastructure suggest a flexible campaign architecture built to rotate domains quickly, mask exploit delivery, and support continued distribution of the Coruna iOS exploit kit.
Jul 12, 2026
Researchers uncovered multiple malware operations using scalable builder and crypting infrastructure to deliver remote-access trojans and evade detection. Breakglass Intelligence found two unauthenticated **GoLoader** builder panels that had produced **468,349** polymorphic samples across 71 active tasks, while leaking Alibaba Cloud OSS credentials tied to a public bucket containing LNK droppers, polymorphic VBS scripts, steganographic PNG carriers, .NET loaders, and RAT payloads. The reconstructed infection chain ended with **njRAT**, and reversing its custom AES-256-ECB configuration revealed the C2 `laohe1[.]myvnc[.]com:5000`, overlapping with infrastructure previously associated with **XWorm**. The campaign was assessed with moderate confidence as operated by a Chinese-speaking actor using Simplified Chinese cryptocurrency lures. A separate Breakglass report linked **ValleyRAT** samples targeting Chinese-speaking users to a campaign that blended long-lived Hong Kong infrastructure with a likely compromised UK academic relay. One sample connected to `103.215.77[.]17:4488`, a Hong Kong-hosted server linked to dozens of related malware submissions, while another Rust loader masquerading as **Microsoft OneDrive Sync Engine** decrypted and loaded a ValleyRAT core DLL after sandbox checks; its stage-two C2 used a `govroam.cf.ac[.]uk` hostname resolving into Cardiff University space, suggesting temporary relay use through a compromised GovRoam-connected endpoint. In parallel, researchers analyzing the **FUD Crypt** malware-as-a-service platform found it packaged Windows malware with persistence, C2, and evasion features, tracked **200** registered users and **334** confirmed builds, and documented abuse of Microsoft **Azure Trusted Signing** to produce Microsoft-rooted Authenticode signatures for malicious binaries.
Jun 29, 2026