Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new phishing campaign targeting healthcare and IT organizations in Russia has been attributed to the Rainbow Hyena cluster. The attackers used compromised email addresses to distribute malicious attachments, including polyglot files and LNK files mimicking legitimate documents. A new custom-built backdoor called PhantomRemote was identified, capable of system information gathering and command execution. The campaign demonstrates a shift in tactics, with threat actors abandoning traditional malicious documents in favor of alternative formats. The sophistication of the tools and techniques suggests a move towards more conventional illicit activities such as espionage and financial gain.

The Rainbow Hyena threat actor cluster has launched a new phishing campaign targeting healthcare and IT organizations in Russia, employing a shift in tactics and novel malware tools. Unlike previous campaigns that relied on traditional malicious document attachments, this campaign uses compromised email addresses to distribute polyglot files and LNK shortcut files that masquerade as legitimate documents. These alternative file formats help evade detection by conventional security solutions that focus on common document exploits. The campaign delivers a newly identified custom backdoor named PhantomRemote, which provides capabilities for system information gathering and remote command execution. This backdoor enables the attackers to maintain persistence, conduct reconnaissance, and execute arbitrary commands on compromised systems. The use of polyglot and LNK files indicates a sophisticated approach to social engineering and evasion, leveraging Windows shortcut files that can execute commands when clicked, and polyglot files that can be interpreted in multiple ways to bypass security filters. The campaign’s tactics align with MITRE ATT&CK techniques such as T1566 (phishing), T1204 (user execution), T1082 (system information discovery), T1059.003 (command and scripting interpreter: Windows Command Shell), and T1105 (ingress tool transfer). The shift away from traditional malicious documents towards alternative file formats and the deployment of a custom backdoor suggest an evolution in Rainbow Hyena’s operational methods, possibly reflecting a move towards more conventional cyber espionage and financially motivated intrusions. While currently observed in Russia, the sophistication and targeting of healthcare and IT sectors highlight the potential for broader impact if the campaign expands geographically or sector-wise.

Detailed information about Rainbow Hyena strikes again: new backdoor and shift in tactics. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'rainbow hyena'

Filter Threats

Threats Tagged 'rainbow hyena'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility