Operation PhantomCLR: Stealth Execution via AppDomain Hijacking and In-Memory .NET Abuse

A highly sophisticated multi-stage post-exploitation framework targeting organizations in the Middle East and EMEA financial sectors exploits legitimate digitally signed Intel utilities through .NET AppDomainManager mechanism abuse. The attack leverages trusted binary proxy execution, bypassing EDR and antivirus solutions through JIT-based memory execution and sandbox evasion using computational delays and cryptographic key derivation loops. Initial access occurs via spear-phishing with Arabic-language decoys impersonating Saudi government documents. Once executed, the framework establishes command-and-control communication through Amazon CloudFront CDN domain fronting, employing reflective DLL loading, direct syscall usage, and anti-forensic memory cleanup techniques. The modular plugin-based architecture demonstrates capabilities consistent with advanced persistent threat actors, featuring sophisticated evasion mechanisms including PEB-based API resolution, custom PE export walking, and heap-walking cont...

• Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical InfrastructureMalware2026-10-07
• The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RATMalware2026-09-01
• A fake resume invoked China's defence-tech elite, then installed VShellMalware2026-08-28
• Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaignMalware2026-08-19
• Signed Overwolf Binary Sideloads ValleyRAT Malware in IndiaMalware2026-08-18