Loading story…
Elastic analyzed a spearphishing operation targeting Malaysian government officials with a malicious Word document themed around Malaysia's 2020 political crisis. The document remotely loaded a VBA template that wrote DLL payloads to disk, downloaded Logitech's legitimate LogiMailApp.exe, and exploited DLL side-loading by placing a malicious LogiMail.dll beside it for execution.
The backdoor retrieved and decrypted a second-stage implant in memory, enabling host reconnaissance, command execution, file transfers, Registry Run-key persistence, and AES-encrypted command-and-control through dynamic-DNS infrastructure. Elastic linked the activity with moderate confidence to the China-nexus APT40/Leviathan group, citing overlaps in strings, URLs, functionality, and tactics with indicators previously published by MyCERT; DLL side-loading is a widely used execution and defense-evasion technique tracked as MITRE ATT&CK T1574.001.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic analyzed the campaign and assessed with moderate confidence that it was linked to the China-nexus APT40/Leviathan group, citing shared strings, URLs, implant functionality, infrastructure, and tradecraft. Elastic also published the APT_APT40_Implant_June2020 YARA rule for the identified second-stage implant.
An espionage campaign targeted Malaysian government officials using a spearphishing attachment, Bubar Parlimen.docx, themed around the Malaysian political crisis. The document loaded a remote VBA template that deployed DLL payloads and abused Logitech LogiMailApp.exe for DLL side-loading.
MyCERT issued an advisory concerning espionage activity targeting Malaysia; its samples and indicators were later found to align with activity associated with APT40/Leviathan.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcemycert.org.my
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Targeted intrusion campaigns used tampered **Microsoft-signed DLLs** to evade trust checks and launch malware through **DLL side-loading** and service hijacking. LAC researchers documented the **SigLoader** malware family modifying data in a file's certificate or overlay area while preserving Windows signature validation, allowing the DLL to still appear legitimately signed. The loader then decrypted and executed additional stages in memory using layered routines including **XOR**, custom **DES**, **AES**, and later **RC4**, with observed payloads including **DelfsCake**, **GreetCake**, and shellcode associated with **Metasploit Framework** or **Cobalt Strike**. In one case, the intrusion began with exploitation of an **SSL-VPN vulnerability** before the loader was deployed on a compromised endpoint. A related campaign assessed as likely tied to **APT41** used the same signed-DLL abuse technique to deliver **Cobalt Strike Beacon**, including a tampered `KBDTAM131.DLL` derived from `UXLibRes.dll` and malicious loading via the Windows **IKEEXT** service and `wlbsctrl.dll`. Researchers said the loader stored encrypted configuration data, API strings, offsets, and payload content with **ChaCha20**, then decrypted a Beacon linked to a leaked or cracked **Cobalt Strike 4.x** build using watermark `0x12345678` and C2 over **HTTPS**, with other samples using **HTTP** or **DNS**. The activity was also tied to a malicious shortcut file masquerading as a PDF, campaign infrastructure including `119.45.238[.]189` and `192.109.98[.]187`, and detection guidance using **Sigcheck**, **Autoruns**, Windows event logs, YARA rules, and stricter Authenticode verification.
Aug 15, 2026
NTT Security Japan reported a malware campaign that used malicious Microsoft Management Console (`.msc`) files and **AppDomainManager Injection** to execute payloads with minimal user interaction. Since around July 2024, attackers distributed ZIP archives through spear-phishing emails and attacker-controlled websites, then abused the **GrimResource** technique so that opening an MSC file could trigger embedded JavaScript via `apds.dll`, execute VBScript, download additional files, and launch a renamed legitimate Microsoft binary, `oncesvc.exe`. The attack chain relied on a companion configuration file that abused .NET version redirection to load a malicious DLL derived from `AppDomainManager`, culminating in deployment of a **Cobalt Strike** beacon. Researchers said the tooling and infrastructure resembled **APT41**, with likely targeting that included Taiwanese government organizations, the Philippine army, and Vietnam’s energy sector. Separate public research from Elastic and offensive-security writeups from Rapid7 and Pentest Laboratories show that AppDomainManager Injection is an established technique that can be easier to abuse and harder to detect than traditional DLL side-loading, raising concern that its use may spread.
Aug 15, 2026
The **Lazarus Group** ran a spearphishing campaign that delivered malicious Microsoft Word documents to targets in aerospace, defense, research, and financial sectors, including organizations linked to Boeing, BAE Systems, Lockheed Martin, and the Republic of Korea Army. The infection chain used remote template injection to fetch an external `DOTM` file, whose macro dropped a lure document and a malicious DLL such as `onenote.db` into the victim’s `AppData` path, then executed the implant while showing a decoy file to reduce suspicion. Related reporting describes similar Lazarus lures sent in spoofed emails, with separate payloads for 32-bit and 64-bit systems and reconnaissance-focused first-stage malware. The implant executed through **`rundll32.exe`** and established persistence via the Windows **Startup folder**, techniques widely tracked in MITRE ATT&CK as `T1218.011` and `T1547.001`. Once active, it collected host, process, and disk information, compressed or encrypted the data, and exfiltrated it over HTTP POST using compromised or attacker-controlled infrastructure, including IIS/Plesk-hosted domains such as `elite4print.com` and `astedams.it`. Analysts linked the activity to Lazarus based on recurring tradecraft, lure themes, victim profiling, and overlap with operations such as **Operation Dream Job**, where the group similarly abused `rundll32.exe` and autostart mechanisms for stealthy execution and persistence.
Aug 15, 2026