Threats Tagged 'yandex'

Operation Capsule Vault is a sophisticated spear-phishing campaign targeting individuals in research, policy, and academic sectors. Attackers sent emails disguised as materials from a legitimate academic conference, delivering a malicious ISO file containing a PIF executable masquerading as a PDF. The multi-stage loader used an EMBED_PAYLOAD_v2 structure to embed and sequentially execute both legitimate documents and malicious payloads in memory. The malware injected shellcode into explorer.exe to deploy a RokRAT variant that communicated with cloud-based command-and-control servers hosted on pCloud, Dropbox, and Yandex Cloud. The campaign employed advanced social engineering and evasion techniques, including process injection and cloud-based C2 infrastructure. Attribution links the activity to the APT37 threat group based on infrastructure and code similarities. No patch or remediation is specified, and no affected software versions are identified.