Loading story…
The open-source Koadic post-exploitation framework can abuse Windows Script Host, COM objects, and signed Windows utilities such as mshta.exe to execute payloads while minimizing its on-disk footprint. Koadic activity has been linked to APT28, and its execution patterns can begin with spearphishing before progressing through proxy execution, host discovery, UAC bypass, and collection of command output.
mshta.exe, tracked by MITRE ATT&CK as System Binary Proxy Execution: Mshta (T1218.005), is broadly abused to run malicious HTA files, scripts, DLLs, and remotely hosted payloads. Defenders can detect this behavior through process ancestry and ordered event sequences, suspicious network connections from Windows proxy binaries, Internet Explorer cache artifacts, registry modifications, and short-lived files used to redirect command output, rather than relying solely on static indicators.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A Palo Alto Networks report associated an Outlook.exe-to-Mshta.exe process chain with APT28 activity, illustrating spearphishing-driven execution through mshta.exe.
MITRE ATT&CK documented adversary use of mshta.exe to execute malicious scripts, HTA files, DLLs, and remote payloads, including use by Koadic and numerous threat groups and malware families.
Elastic Security Labs documented EQL detections for Koadic behaviors, including Outlook-to-mshta execution, network-enabled proxy execution, Internet Explorer cache artifacts, discovery activity, UAC bypass, and short-lived redirected command-output files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bitdefender warned that attackers are increasingly abusing Microsoft’s legacy `mshta.exe` utility as a living-off-the-land tool to execute remote or in-memory scripts and deliver malware including **LummaStealer**, **Amatera**, **CountLoader**, **Emmenhtal Loader**, **ClipBanker**, and **PurpleFox**. The campaigns rely on phishing, fake software downloads, SEO poisoning, cracked-software lures, fake social media posts, Discord messages, and ClickFix-style fake CAPTCHA or reCAPTCHA prompts that trick users into launching malicious commands. Researchers said much of the observed `mshta.exe` traffic was tied to typosquatted or attacker-controlled domains masquerading as legitimate services, with payloads focused on credential theft, session cookie theft, cryptocurrency wallet theft, and persistent compromise. One highlighted infection chain used a fake `Setup.exe` containing a bundled Python interpreter and a renamed MSHTA binary to retrieve additional payloads, while other chains used fileless execution through PowerShell, WScript, HTA content, and even `msiexec` to fetch disguised installer packages. Bitdefender said legitimate enterprise use of MSHTA is declining while malicious use is rising, and noted that although VBScript was deprecated in 2024 and is expected to be disabled by default in 2027, Microsoft has not indicated plans to remove MSHTA. The company urged defenders to disable or restrict `mshta.exe` and `wscript.exe` where possible, migrate away from legacy scripts, improve user awareness, and rely on layered behavioral and runtime defenses.
Jun 29, 2026
Threat researchers documented multiple campaigns abusing Microsoft Build Engine (**MSBuild.exe**) as a living-off-the-land binary to compile and execute malicious code in memory, helping attackers bypass application controls and reduce disk artifacts. Cisco Talos reviewed more than 100 suspicious MSBuild project files and found frequent use of inline tasks to launch post-exploitation tooling such as **Cobalt Strike**, **Meterpreter**, **Covenant**, **Silent Trinity**, and **Mimikatz**, often after initial access from Office macros, HTA files, or browser-driven delivery chains. MITRE maps this behavior to technique `T1127`, reflecting the use of trusted developer utilities for defense evasion and execution. The same tradecraft appeared across distinct intrusion sets and malware families. Zscaler described a targeted campaign in which macro-enabled Word documents wrote obfuscated C# code to disk and used **csc.exe** and **MSBuild.exe** to compile and deploy the previously unreported **ShellReset** RAT, which supported remote shell access, file transfer, directory listing, and screenshot capture. AhnLab reported attackers compromising exposed Microsoft SQL Server instances and then launching **MSBuild.exe** to inject a **Cobalt Strike** beacon into `wwanmm.dll`, while QiAnXin linked a Kashmir-themed campaign to **APT-C-09**, which used a fake `MSBuild.exe` in `%AppData%` alongside GitHub and Feed43 dead-drop resolvers for command-and-control. Across the reporting, defenders were urged to prioritize detections for unusual parent-child process chains, especially Office applications, browsers, or SQL Server processes spawning **MSBuild.exe**.
Aug 15, 2026
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026