Loading story…
The WARMCOOKIE backdoor remains active despite disruption efforts during Europol's Operation Endgame, which targeted malware services supporting the ransomware kill chain. Newly observed variants can execute PE files, DLLs, and occasionally PowerShell scripts, using temporary directories and launching payloads directly or through rundll32.exe and PowerShell.exe.
The malware now dynamically selects legitimate company names for deceptive directories and scheduled tasks, changed its persistence argument from /p to /u, and uses two GUID-like mutexes. WARMCOOKIE operators distinguish builds through campaign identifiers and possibly embedded RC4 keys, while expanding command-and-control from IP addresses to embedded domains; they also continue reusing an expired SSL certificate that may be a default backend certificate.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
The expired WARMCOOKIE-associated SSL certificate continued to be used on new and reused infrastructure through at least September 2025. Elastic assessed it may be a default backend certificate, with redirectors reconfigured around it.
Researchers first observed a WARMCOOKIE sample configured with embedded domains rather than numeric IP addresses for command-and-control in July 2025.
Europol's Operation Endgame disrupted WARMCOOKIE along with other malware families in May 2025, but the backdoor continued to be observed afterward.
An SSL certificate associated with WARMCOOKIE command-and-control infrastructure expired, though operators later continued using it on new and reused infrastructure.
WARMCOOKIE samples have included a campaign-ID field since July 2024, used by operators to tag infection or distribution contexts.
WARMCOOKIE was initially documented as a backdoor delivered through recruiting-themed phishing campaigns in summer 2024.
Recent WARMCOOKIE variants added handlers to execute PE files, DLLs, PowerShell scripts, and DLLs via a Start export; observed builds also use deceptive company-name string banks, updated scheduled-task parameters, and two mutexes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 49 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceelastic.co
Open sourceattack.mitre.org
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ICEDID** (Bokbot), a modular banking trojan active since 2017, is delivered through phishing campaigns and can provide initial access for follow-on tools including Cobalt Strike and ransomware. Recent variants use multistage loaders and bot payloads, with lures such as ZIP archives containing ISO files and malicious LNK shortcuts that invoke `rundll32.exe`; earlier campaigns also used password-protected ZIP files carrying macro-enabled Word documents. The malware persists through scheduled tasks or Windows Registry Run keys, retrieves components dynamically, and supports credential and browser-cookie theft, host discovery, command execution, browser-traffic proxying, process injection, reverse shells, and VNC access. ICEDID-enabled intrusions have progressed rapidly to RansomExx deployment: one observed operation used ICEDID, Vatet, PyXie, and Cobalt Strike to reach ransomware execution in roughly five hours. RansomExx operators also developed a Linux ELF variant targeting VMware-related storage environments, recursively encrypting a supplied directory with AES keys protected by a hardcoded RSA-4096 public key. Defenders can more reliably identify ICEDID command-and-control infrastructure through its TLS certificate-pinning implementation—validating certificate serial numbers against public-key hashes—combined with self-signed certificate metadata and scan results; JARM and JA3S fingerprints alone are not sufficient for attribution.
Sep 9, 2026
Several distinct malware and ransomware campaigns have resurfaced with new variants and advanced features, targeting organizations globally. The XWorm remote access trojan (RAT) has re-emerged in its version 6.0, now featuring a modular architecture that includes a ransomware plugin and advanced evasion techniques. This new version of XWorm is designed to bypass security defenses more effectively, increasing the risk of successful intrusions and data encryption. Meanwhile, the WARMCOOKIE malware has also returned after a previous takedown, now equipped with stealth handlers and utilizing expired command-and-control (C2) certificates to evade detection. The use of expired certificates is a novel tactic that complicates network monitoring and threat hunting efforts. In a separate development, the Russian-speaking Lunar Spider cybercriminal group has launched a new wave of ransomware attacks, leveraging the Latrodectus V2 loader to deliver their payloads. This loader is known for its sophisticated delivery mechanisms and ability to bypass traditional security controls. The Lunar Spider group’s campaign demonstrates a continued evolution in ransomware delivery, with a focus on maximizing infection rates and minimizing detection. Concurrently, ransomware groups Qilin and Gunra have been actively targeting South Korean organizations, with Qilin listing nine asset management firms and an engineering services company as victims, and Gunra compromising a gas manufacturing and supply company. These attacks highlight a trend of ransomware operators focusing on critical infrastructure and financial sectors in South Korea. The resurgence of these malware and ransomware families underscores the persistent threat posed by cybercriminal groups who continuously adapt their tools and techniques. Security researchers have observed that the modularity and stealth features in these new variants make them more challenging to detect and remediate. Organizations are advised to update their threat intelligence feeds and enhance monitoring for indicators of compromise associated with XWorm, WARMCOOKIE, and Latrodectus. The use of expired C2 certificates and advanced evasion tactics signals a shift in attacker methodologies, requiring defenders to adapt their detection strategies. The targeting of multiple sectors, including finance, engineering, and energy, demonstrates the broad scope of current ransomware campaigns. Incident response teams should be prepared for multi-stage attacks that leverage loaders like Latrodectus to deploy ransomware. The ongoing activity from groups such as Lunar Spider, Qilin, and Gunra indicates a high level of coordination and resourcefulness among threat actors. The rapid re-emergence of previously disrupted malware families suggests that takedown efforts may only provide temporary relief. Security teams should prioritize patching, network segmentation, and user awareness training to mitigate the risk of infection. Collaboration with threat intelligence providers can offer early warning of emerging threats and support proactive defense measures. The evolving landscape of ransomware and malware campaigns requires continuous vigilance and adaptation by defenders.
Jun 29, 2026
Researchers and incident reports show **Remcos RAT** continuing to spread through multiple delivery channels, including business-themed phishing emails, fake cryptocurrency software, and multi-stage script loaders. Trend Micro documented a phishing campaign using an ACE archive attachment and an AutoIt-based loader to install **Remcos Professional 1.7**, while ESET reported a spoofed SafeMoon application that delivered Remcos to cryptocurrency users. SonicWall later identified a newer infection chain using VBScript, batch files, PowerShell, and a .NET loader to deploy Remcos after patching **AMSI** and **ETW** for defense evasion, with observed targeting of European institutions. Technical analysis from Elastic Security Labs found that modern Remcos samples retain extensive remote-access and surveillance functions, including **keylogging, screenshots, audio capture, webcam access, shell command execution, password theft, browser-history collection, persistence, process injection, and UAC bypass**. Elastic recovered most of the malware’s configuration structure and command set, showing that Remcos stores encrypted settings, supports TLS-enabled command-and-control, can masquerade as legitimate processes such as `explorer.exe`, and can clean browser artifacts or uninstall itself on command. The reporting underscores how a tool originally marketed for red teaming has become a widely abused malware family with increasingly evasive delivery chains and mature post-compromise control features.
Aug 14, 2026