NEW#0001MMalpedia4 days ago6 min▣LLM reporthigh Unsigned fake GlobalProtect MSI targets Myanmar via geolocation guardrail, using Cloudflare Workers for config delivery and Google Sheets API as C2 channel with command execution capability.
The MSI installs an unsigned x64 executable that queries ip-api.com for geolocation and checks for Myanmar. On match, it contacts a Cloudflare Worker gate at /config0 with an X-Bot-Secret header to retrieve Google service-account credentials. It then authenticates to Google OAuth, reads and updates Google Sheets cells as a C2 channel. Command execution via hidden cmd.exe exists in code but was not observed at runtime.
#0002MMalpedia11 days ago10 min▣LLM reporthigh A new unnamed cross-platform malware component attributed to North Korean threat actors was delivered via a fake job interview coding challenge. The infection chain uses OS-specific stager scripts that create a hidden .vscode directory, download bootstrap scripts, and fetch a final payload (ghost.js/ghost.npl) that beacons to an unauthenticated C2 server at 141.94.148.39:1224. The C2 endpoint /api/checkStatus accepts victim registration without authentication, allowing mass fake-registration flooding for infrastructure takedown.
#0003MMalpedia11 days ago6 min▣LLM reporthigh The Auto-Color Linux backdoor provides remote access while employing a user-space rootkit to hide its presence. It achieves persistence by dropping a shared library and registering it via /etc/ld.so.preload, which loads the library into other dynamically linked processes. The rootkit component hooks libc functions to hide files, filter network connections in /proc/net/tcp, and disable SELinux enforcement.
#0004MMalpedia14 days ago12 min▣LLM reporthigh SilkParasite is a China-nexus APT campaign targeting Central Asian government bodies involved in economic policy. The operation deploys seven RAT families, five newly named, delivered primarily through DLL sideloading of signed legitimate applications. DriveSilkRAT serves as the backbone, using Google Drive as a C2 channel to route tasking through trusted cloud infrastructure. The toolset exhibits modular plugin architectures across four programming languages, maintained build infrastructure, and traces of AI-assisted development. Initial access uses spear-phishing emails delivering password-protected RAR archives containing malicious Office documents with regionally tailored lures.
#0005MMalpedia14 days ago12 min▣LLM reporthigh A cluster of three ClickFix campaigns observed between June and July 2026 used compromised WordPress sites to deliver social engineering lures that copied malicious commands to victim clipboards. The campaigns deployed payloads via MSI packages, NodeJS, and Python runtimes, all leveraging DLL sideloading with legitimate Windows binaries and hiding artifacts in ProgramData. C2 domains were resolved through dead drop encodings stored in Digital Point forum user profiles. The activity overlaps with the Lorem Ipsum malware family and shares discovery TTPs with the Supper backdoor attributed to Vanilla Tempest.
#0006MMalpedia18 days ago6 min▣LLM reporthigh CNCMachineRMS is a remote access trojan using a custom binary C2 protocol over TCP port 443 without TLS. It leverages DNS over HTTPS (DoH) to resolve C2 domains, bypassing local DNS logging. The protocol is identifiable by statistical analysis due to distinctive byte patterns at fixed offsets. Delivery has been observed via ClickFix attacks delivering the BabaDeda chain.
#0007MMalpedia29 days ago12 min▣LLM reporthigh Head Mare APT group exploited a chain of two vulnerabilities (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf Server instances to achieve unauthenticated remote code execution as SYSTEM via port 4307/TCP. Attackers deployed a web shell by replacing locale.php, then trojanized the TrueConf Client installer to deliver PhantomCore and PhantomGraph backdoors to meeting participants. PhantomGraph uses Microsoft OneDrive for C2 and is split into two DLLs to evade EDR. The vulnerabilities were patched in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5 released on June 18, 2026.
#0008MMalpedia29 days ago11 min▣LLM reporthigh Six npm packages were identified delivering a malicious Node.js loader that uses Ethereum blockchain transactions to resolve C2 infrastructure. Three packages were hijacked legitimate projects with malicious code appended to existing files, and three were newly published packages. The loader queries Ethereum RPC providers, decodes IPv4 addresses from transaction recipient addresses, and retrieves secondary payloads from HTTP endpoints. The activity is attributed to the DPRK-linked Contagious Interview campaign.
#0009MMalpediaabout 1 month ago10 min▣LLM reporthigh ASEC analyzes the connection between Xctdoor backdoor and historical CRAT malware attacks by Larva-26005, a North Korea-linked threat actor targeting Korean users since at least 2020. Xctdoor and CRAT share identical code obfuscation routines, XOR decryption algorithms, and AppX package installation paths. The threat actor uses spear phishing LNK files, disguised security software, compromised web servers, and tampered ERP/groupware update modules for initial access, deploying XcLoader as an injector and Xctdoor as a full-featured backdoor with capabilities including shell execution, file exfiltration, keylogging, and process injection.
