This intelligence analysis covers a malicious campaign deploying Remcos RAT, a commercially available remote access trojan. The infection starts with a weaponized Excel spreadsheet that uses VBA macros to execute PowerShell commands, which then download additional malicious scripts from attacker-controlled domains. The multi-stage attack culminates in the deployment of the Remcos RAT payload. The campaign uses social engineering with financial-themed lures to trick victims into enabling macros, facilitating the infection. Command and control infrastructure involves domains dvrlists[.]com and lbl[.]support.
BITTER is a cyberespionage group targeting South Asian government, energy, and engineering sectors using a custom remote access trojan called PapRAT. PapRAT is deployed through multiple infection chains involving malicious LNK files, VHDX disk images with MSI installers, and URL shortcuts combined with WebDAV. The malware exists in C++ and Rust variants, with capabilities such as command execution, file and directory manipulation, screenshot capture, and secondary payload delivery. Persistence is maintained via scheduled tasks, and communication with command-and-control servers occurs over HTTP. The Rust variant adds enhanced features including PowerShell execution and sleep commands.
In September 2026, multiple advanced persistent threat (APT) campaigns targeted South Korean organizations using spear phishing emails. The attacks employed various techniques such as LNK files with embedded PowerShell scripts, HTA files downloaded via curl.exe, and malicious DLLs. Five attack types were identified, deploying AutoIt scripts, infostealers, keyloggers, backdoors including XenoRAT, and persistence via Task Scheduler. Attackers used legitimate platforms like GitHub, Google Drive, and PubNub for command and control. Malicious files were disguised as legitimate documents to deceive victims and exfiltrate system information, credentials, and virtual asset data while maintaining persistent access.
An unauthorized relay service has been installing legitimate OpenAI Codex and Anthropic Claude Code CLI tools on enterprise systems, reconfiguring them to route requests through third-party infrastructure. This activity, active since early 2026, primarily affects organizations in mainland China, South Korea, Taiwan, and Malaysia across multiple industrial sectors. The relay disables execution sandboxes, enables network access, replaces API credentials with relay-issued tokens, and disables telemetry, granting operators full user privilege command execution and access to sensitive data. No abuse evidence is currently reported.
Variola is a modular Windows malware implant linked to a ClickFix intrusion, designed for persistent host identity and secure command-and-control communications. It supports dynamic loading of modules for credential theft, browser manipulation, and session hijacking, with capabilities typical of banking trojans such as Chromium browser injection and VNC-style remote access. The implant uses strong cryptographic methods for communication security and shows active development with multiple builds found in a public GitHub repository. No patch or remediation information is provided, and no known exploits in the wild have been reported.
The Kimsuky threat group is conducting spear phishing campaigns targeting Ukrainian experts in diplomacy, security, and international policy. The campaign, named GitPower, uses fraudulent international conference invitations and collaboration requests to lure victims. Attackers distribute malware and exfiltrate data via legitimate platforms such as GitHub, employing malicious LNK files and fake Zoom installers. This operation is linked to previous CHM-based attack methods and appears to be state-sponsored cyber espionage focused on monitoring South Korea-Ukraine cooperation developments. Organizations are advised to enhance endpoint detection and response (EDR) capabilities and conduct threat hunting for suspicious LNK execution, PowerShell abuse, and unauthorized GitHub activity.
During August 2026, multiple APT campaigns targeted South Korean entities primarily through spear phishing attacks utilizing LNK files. Six distinct attack types were identified, employing various techniques including PowerShell scripts, AutoIt programs, and DLL side-loading. Type A used HEX data extraction with PubNub command and control, while Type B leveraged curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers. Type C distributed XenoRAT malware via GitHub repositories. Type D used resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection. Type E employed Python-based backdoors through disguised pythonw.exe executables. Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. Attacks focused on information theft, system control hijacking, and additional malware deployment.
Since January 2026, the Russian state threat actor Star Blizzard has enhanced its cyberespionage operations by adopting a new malware delivery technique called RedFlick, alongside large-scale phishing campaigns and use of compromised website accounts. These tactics improve detection evasion and target Ukrainian individuals and institutions, as well as international NGOs, Western think tanks, governments, and organizations linked to Ukraine support. Indicators include multiple malicious domains, file hashes, and an IP address associated with the campaign. No specific software vulnerabilities or CVEs are identified.
Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate models and lure victims via sponsored Google ads to malicious Custom GPTs named 'Plus 5.6'. Victims were shown fake service notices and redirected to Google Sites hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. They were tricked into running PowerShell commands that downloaded malicious MSI installers. The attack used DLL sideloading with legitimate Canon- and Stardock-signed executables to establish persistence via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and deployed a remote access trojan with capabilities including remote desktop access, browser hijacking, credential theft, and follow-on payload delivery. Approximately 40 incidents were investigated by Huntress.
The domain third-party[.]com, historically used as a documentation placeholder similar to example.com, has been compromised and now serves ClickFix lures to Windows users while displaying harmless content to other operating systems. Since at least June 2026, Windows visitors receive a fake Cloudflare verification page that poisons the clipboard with a malicious PowerShell command, instructing users to press Win+R and paste the payload. The domain appears in over 1,500 files across 1,700+ repositories from trusted sources including Chromium, Sanity, and Vercel. Unlike example.com, third-party[.]com is not IANA-reserved, allowing adversaries to register and weaponize it. The attack leverages social engineering to bypass security tools by using signed Windows binaries, making detection difficult through traditional scanning methods.
North Korea-linked threat actors, identified as Opal Sleet, are conducting Operation Conflict Compass targeting Ukrainian diplomatic entities, think tanks, and NGOs. The campaign uses spear-phishing emails with malicious ZIP attachments containing LNK files disguised as PDFs themed around Russia-Ukraine peace plans and geopolitical issues. Execution of these LNK files downloads VBScript from GitHub, which establishes persistence via scheduled tasks and deploys VelvetCake, a PowerShell-based task runner. VelvetCake connects to command-and-control servers to download and execute scripts that perform reconnaissance, collect system information, enumerate security software, and capture screenshots. The campaign also uses trojanized Zoom installers and infrastructure in South Korea and Ukraine. Activity has been observed since early August 2026.
A sophisticated multi-stage infection chain was discovered through analysis of a system exhibiting frequent PowerShell execution alerts. The attack leveraged multiple layers of obfuscation and concealment techniques, including Registry-based payload storage, DNS TXT record exploitation, and data hidden within image and WAV audio files. The threat actors employed various evasion methods such as security control tampering and in-memory execution to avoid detection. Rather than writing payloads directly to disk, attackers reconstructed malicious code from distributed sources including Registry entries and steganographically encoded data in media files. The ultimate objective of this elaborate infection chain was to deploy cryptocurrency mining operations covertly on compromised systems while maintaining persistent access through multiple redundant mechanisms.
In June 2026, a new malware family named SloppyRAT was identified, likely used by ransomware-related threat actors to establish footholds for lateral movement. Delivered through multi-stage ClickFix infection chains, the malware features encrypted code blocks, EtherHiding for command-and-control resolution via Polygon JSON-RPC protocol, and multiple anti-analysis techniques including junk code and indirect system calls. SloppyRAT implements certificate pinning to prevent TLS traffic inspection and includes 47 built-in PowerShell-like commands for remote access. The infection chain uses finger.exe, IronPython, and deploys CastleLoader and CastleRAT components before installing SloppyRAT. Despite sophisticated capabilities, the codebase contains numerous software bugs affecting persistence mechanisms and other features, suggesting active development.
This threat involves a sophisticated malware campaign using fake MP4 files as carriers for encrypted malicious payloads. The MP4 files appear legitimate to basic file-type checks but contain encrypted data in ISO Base Media File Format uuid extension boxes instead of playable video. The infection chain starts with PowerShell scripts delivered via Cloudflare-fronted infrastructure, which perform environment checks before retrieving the malicious carrier file. A secondary script extracts and decrypts an embedded PowerShell payload that silently installs the NetSupport Manager remote administration tool. The attack infrastructure includes multiple live endpoints across several autonomous systems, mainly in Frankfurt and Los Angeles, with rapid registration of command-and-control gateways. The toolkit uses Russian-language business site decoys and frequently rotates carriers without backward compatibility.
In July 2026, multiple APT campaigns targeted South Korean entities using spear phishing emails with malicious LNK files. Seven distinct attack types employed various techniques such as PowerShell scripts, AutoIt programs, DLL side-loading, and curl.exe downloads. Malware was distributed via platforms like GitHub, Google Drive, and Dropbox, disguised as legitimate documents or resumes. The campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate sensitive information and maintain persistence through Task Scheduler entries. Communication with command and control servers used PubNub channels with Base64-encoded data. The attacks focused on deceiving victims with work-related content to execute malicious payloads.
Kimsuky conducted spear phishing campaigns targeting South Korean and Japanese entities in early 2026. The attacks used LNK malware distributed via OneDrive share links to establish scheduled tasks that periodically retrieved PowerShell scripts from command-and-control servers. These scripts profiled infected systems, exfiltrated email data from Thunderbird and Outlook, and logged keystrokes. The threat actor leveraged legitimate remote control tools such as Chrome Remote Desktop and AnyDesk to evade antivirus detection and maintain persistent access. Additionally, a malicious Chrome extension with AI-generated code was used to steal Gmail data. The operation employed rotating infrastructure and compromised legitimate Korean servers as command-and-control nodes to hinder tracking efforts.
A threat hunting investigation identified suspicious PowerShell content served from an IP address (203.188.171.166) and domain (dorenzaa.com), both retrieving ZIP archives from Vercel-hosted infrastructure. The PowerShell loaders extract and execute payloads locally, including Grape.exe, UltraToolliteSetup.exe, and draw.io.exe. Analysis revealed heavily obfuscated PowerShell stages utilizing Base64 encoding, XOR-based obfuscation with the key 'Write', dynamically constructed IEX commands, and hidden PowerShell execution. A decoy 'Verification complete!' message disguised as Google.com was presented to victims during execution. Multiple Vercel instances hosted additional artifacts including loader scripts and executables. The initial infection vector remains unidentified, suggesting these PowerShell-hosting URLs represent second-stage delivery points in a multi-stage attack chain.
The Kimsuky threat group has integrated artificial intelligence capabilities into its attack operations, establishing local large language model environments using Ollama, GPT4All, and Msty. Evidence indicates the group is accumulating technologies to incorporate AI across attack operations, including AI-generated decoy documents and retrieval-augmented generation for document analysis. The campaign, dubbed Operation GitPower, continues targeting foreign diplomatic missions and sectors including military, security, and virtual assets. Attacks utilize malicious LNK files contained in ZIP archives, executing obfuscated PowerShell scripts that abuse Git-based repositories as command-and-control infrastructure. The group distributes encrypted AsyncRAT payloads disguised as image files through GitHub. Linguistic indicators including North Korean vocabulary patterns such as "싸이트", "가입리력", and "로출되였는지" support attribution to North Korean state-sponsored operations under the Reconnaissance General Bureau.
Since January 2026, a threat actor likely functioning as an initial access broker for ransomware operations has been targeting organizations through Microsoft Teams vishing attacks. Attackers impersonate IT helpdesk staff to convince victims to initiate Quick Assist remote sessions. Following initial compromise, PowerShell scripts deploy a Go-based backdoor called GoGRPC, which exists in four distinct variants: Lep, Giver, Pet, and Kind. These variants communicate with command-and-control infrastructure using gRPC over HTTP/2, an uncommon approach that helps blend malicious traffic with legitimate communications. Additional tools observed include BlindDoor backdoor, RevSocket and PyGRPC SOCKS proxies, S3Siphon data exfiltration utility, and RSOX Rust-based proxy relay. Recent campaigns show increased sophistication and selectivity, with heightened focus on corporate environments through enhanced PowerShell scripts capable of antivirus detection, domain controller fingerprinting, and system reconnaissance b...
AhnLab monitored Advanced Persistent Threat attacks targeting South Korea during June 2026, identifying multiple attack types distributed primarily through spear phishing campaigns. Threat actors disguised malicious files as work-related documents, with LNK files being the most common delivery method. Six distinct attack types were observed, employing various techniques including malicious PowerShell commands, AutoIt malware, curl.exe abuse, GitHub repository exploitation, Task Scheduler persistence, DLL side-loading, and Python backdoors. These attacks deployed Infostealers, keyloggers, backdoors, and remote access tools like XenoRAT. Once executed, the malware established persistence, exfiltrated system information, and enabled remote control of compromised systems. Organizations are advised to verify email senders, avoid opening files from unknown sources, apply security patches, and maintain updated antivirus software to mitigate these persistent threats.
