Loading story…
Elastic Security Labs linked the REF7707 cyberespionage activity to a modular malware ecosystem targeting a South American foreign ministry and likely victims in Southeast Asia. The operators used valid credentials and Windows administrative functionality to deploy the PATHLOADER and GUIDLOADER loaders, including a renamed cdb.exe Microsoft debugger to execute in-memory shellcode. PATHLOADER retrieved encrypted payloads from typosquatted and attacker-controlled infrastructure before launching FINALDRAFT, a Windows and Linux remote-access tool that used Microsoft Graph API access to communicate through Outlook draft messages.
FINALDRAFT supports collection and exfiltration, process injection, proxying, file operations, network discovery, in-memory PowerShell with AMSI/ETW bypasses, and Pass-the-Hash activity; samples spanning 2023 and 2024 indicate sustained development. Elastic later identified NANOREMOTE and its WMLOADER delivery component as likely related to the same cluster: WMLOADER masquerades as security software, decrypts wmsetup.log with AES-CBC, and executes the backdoor in memory, while NANOREMOTE uses the Google Drive API for command-and-control, payload staging, and bidirectional file transfer. Shared loader behavior, cryptographic material, filenames, code, and network traits indicate a common development environment or codebase.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
A wmsetup.log sample uploaded to VirusTotal from the Philippines was decrypted using WMLOADER and found to contain a FINALDRAFT implant. The artifact later provided evidence linking WMLOADER activity to the FINALDRAFT ecosystem.
Elastic Security Labs discovered the NANOREMOTE Windows backdoor in telemetry. The observed WMLOADER infection chain executed NANOREMOTE in memory and showed code, cryptographic, and loader overlaps with FINALDRAFT and REF7707.
Elastic observed the REF7707 intrusion cluster at the foreign ministry of an unnamed South American nation. The operators used valid network credentials, Windows administrative features, lateral movement, credential harvesting, and scheduled-task persistence while deploying PATHLOADER and FINALDRAFT.
Linux ELF variants of the FINALDRAFT backdoor were submitted from the United States and Brazil. The samples referenced infrastructure and services associated with the broader REF7707 activity.
GUIDLOADER sample uploads from Hong Kong continued through August 2023, showing continued development and testing of the loader family associated with FINALDRAFT.
Twelve GUIDLOADER samples were uploaded from Hong Kong, including samples with broken decryption routines and debug strings indicating development or testing. The loaders were configured to retrieve payloads from attacker infrastructure and third-party services including Firebase, Pastebin, and a Southeast Asian university storage system.
The earliest identified REF7707-related sample, a PATHLOADER variant named dwn.exe, was submitted from Thailand. It was configured to retrieve encrypted FINALDRAFT payloads from typosquatted domains impersonating Check Point and Fortinet.
Elastic published YARA rules for NANOREMOTE and WMLOADER and reported endpoint detections for related activity, including invalid signatures, cloud-service abuse, shellcode injection, and unsigned-code execution.
After registering the expired support.fortineat[.]com domain, Elastic observed characteristic TLS connections from eight telecommunications and internet-infrastructure companies in Southeast Asia, indicating possible additional REF7707 victims.
During its REF7707 investigation, Elastic Security Labs identified the previously unreported PATHLOADER loader and FINALDRAFT cross-platform backdoor toolkit. Elastic assessed the operation as likely espionage-oriented and documented FINALDRAFT's Microsoft Graph/Outlook-draft command-and-control mechanism.
Elastic Security created the Windows_Trojan_PathLoader_d62822f8 YARA rule to detect PathLoader in Windows files and memory on x86 and ARM64 systems. The rule requires three of four indicators, including a WinHttpSendRequest debug string and byte patterns associated with FNV-based API resolution and PEB access.
Elastic Security created two severity-100 YARA rules, Multi_Trojan_FinalDraft_81975d51 and Multi_Trojan_FinalDraft_69deb8cd, to detect FINALDRAFT in files and memory on x86 and ARM64 systems. The rules use distinctive Outlook draft-folder and communication-channel strings, plus binary signatures, to identify the malware.
Elastic created the severity-100 Windows_Trojan_FinalDraft_ce03cf22 YARA rule for file and memory scanning on Windows x86 and ARM64 systems. The rule detects FINALDRAFT using at least five indicators, including configuration-decryption and key-derivation sequences, injection-target strings, and Microsoft Graph refresh-token parameters.
Elastic Security created the severity-100 Linux_Trojan_FinalDraft_4ea5a204 YARA rule for file and memory scanning of Linux/x86 FINALDRAFT samples. The rule detects FINALDRAFT through communication-channel strings and multiple operational indicators, including refresh-token request and filesystem-path strings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceelastic.co
Open sourceelastic.co
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcelolbas-project.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Elastic Security Labs have identified a new Windows backdoor named NANOREMOTE, which leverages the Google Drive API for command-and-control (C2) operations. The malware shares code similarities with the FINALDRAFT (Squidoor) implant, previously linked to the threat group REF7707, and is capable of data exfiltration and payload staging through Google Drive, making detection challenging. The attack chain involves a loader, WMLOADER, which masquerades as a Bitdefender executable and decrypts shellcode to load NANOREMOTE into memory, with similar loaders mimicking other security products. NANOREMOTE is a 64-bit C++ backdoor that supports 22 command handlers, enabling attackers to execute commands, move files, and gather system information on compromised Windows systems. The malware communicates with a hard-coded, non-routable IP address over HTTP, using encrypted and compressed JSON payloads. The threat actor REF7707, suspected to be a Chinese group, has previously targeted sectors such as government, defense, telecommunications, education, and aviation, with recent activity including a prolonged intrusion at a Russian IT service provider. The initial access vector for NANOREMOTE remains unknown.
Jun 29, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026