Threats Tagged 'meshagent'

Settra is a ransomware variant first observed in June 2026 that targets organizations through VPNs or compromised credentials. Two incidents were investigated in July and September 2026, affecting the consumer services, retail, and manufacturing sectors. Attackers deployed MeshAgent RMM for persistence, naming ransomware executables after victim domain names. The malicious activity included file encryption with .locked or .locked_wip extensions, deployment of RESTORE_FILES.txt ransom notes, clearing Windows event logs, and disabling Windows recovery options using reagentc and diskpart utilities. One incident featured Bring Your Own Vulnerable Driver (BYOVD) tactics using gdrv.sys. A notable operational security failure occurred when attackers misspelled the Windows Defender Event Log path, preventing its deletion. Both attacks followed remarkably similar operational patterns, with MeshAgent installations pointing to different C2 IP addresses (45.13.122[.]7 and 193.5.65[.]114), and malicious workstation WIN...

A sophisticated phishing campaign leverages DocuSign-themed lures to trick victims into installing legitimate remote management software including MeshAgent, ScreenConnect, and SimpleHelp. The operation employs a reusable web kit featuring staged delivery through simulated document loading interfaces, user-agent based targeting that filters for Windows systems while blocking Edge browsers, and Cloudflare Turnstile verification. The campaign demonstrates operational maturity with separate Windows and macOS delivery paths, real-time victim telemetry via Telegram, and VBS deployment scripts that disable Windows Defender and establish persistence through service installation. Active from May through July 2026, the infrastructure rotates across multiple domains using consistent URL patterns to evade detection while abusing trusted IT tools for persistent access.

In May 2026, security researchers observed an attack campaign distributing KimJongRAT through GitHub and other legitimate services. KimJongRAT, used by the North Korean APT group Kimsuky since 2013, combines information stealing and remote access capabilities. The infection chain begins with phishing emails containing shortened URLs redirecting to GitHub Releases hosting malicious ZIP files. Victims execute LNK files that download HTA files from GitHub, which then retrieve subsequent payloads from Google Drive. Recent variants demonstrate significant evolution: they now dynamically fetch C2 addresses from external sources rather than hardcoding them, enabling operators to maintain persistent access despite infrastructure takedowns. Additionally, new versions include MeshAgent RMM installation for redundant access. The campaign exemplifies Living Off Trusted Sites (LOTS) techniques, abusing legitimate platforms like GitHub, Google Drive, and Dropbox to evade detection.

MediumMalwareJapan#kimsuky#lots#infostealer

The NKNShell malware campaign involves a compromised South Korean VPN provider website used to distribute a multi-stage malware payload. The threat actor Larva-24010 deploys several backdoors including MeshAgent, gs-netcat, and a novel Go-based backdoor called NKNShell, which leverages NKN and MQTT protocols for command and control. The infection chain uses trojanized installers and PowerShell scripts, employing advanced evasion techniques such as AMSI and UAC bypasses. Additional tools like SQLMap are deployed to facilitate further exploitation. While primarily targeting Korean VPN users, the sophisticated use of blockchain-based networking protocols and multiple backdoors poses risks to any users of the compromised VPN service. The campaign's medium severity reflects its complexity and targeted nature, but it has not yet been observed exploiting widespread vulnerabilities or causing large-scale impact beyond South Korea.

MediumCampaignGermanyFranceNetherlands+2#nknshell#nkn#backdoor

A sophisticated phishing campaign targeting Indian organizations has been uncovered, utilizing spear-phishing techniques reminiscent of Operation Sindoor. The campaign employs a Linux-focused infection method using weaponized .desktop files, a tactic previously associated with APT36. When executed, these files initiate a complex, obfuscated chain that ultimately delivers a MeshAgent payload, granting the attacker full remote access to the compromised system. The campaign showcases an evolution in regional threat actor tactics, particularly in targeting Linux environments. By combining localized spear-phishing lures with advanced obfuscation techniques, the adversaries increase their chances of bypassing defenses and gaining footholds in sensitive networks. The attack chain involves multiple stages of encryption and decryption, anti-VM checks, and the use of legitimate remote administration tools to complicate detection and response efforts.

MediumMalwareUnited KingdomGermanyFrance+2#obfuscation#linux#apt36