Intelligence Feed

4w ago · lab52

DragonForce, a ransomware-as-a-service (RaaS) operation, has been observed deploying two backdoors that abuse legitimate infrastructure for command and control (C2) communications. The first backdoor operates in-memory and uses TURN servers, including Microsoft Teams infrastructure, to blend malicious traffic with legitimate traffic. The second backdoor ensures persistence via DLL sideloading and scheduled tasks, using both TURN and MQTT as redundant C2 channels. The malware employs encryption, obfuscation, and in-memory execution to evade detection and maintain access on compromised systems.

8mo ago · lab52

A recent PlugX RAT campaign leverages a spear-phishing email with the subject 'Meeting Invitation' to deliver malicious payloads via DLL side-loading. The infection chain uses a legitimate G DATA antivirus executable (Avk.exe) to load a malicious DLL (Avk.dll), which decrypts and executes the payload from AVKTray.dat. The malware establishes persistence through a registry Run key and communicates with the C2 server at decoorat[.]net over HTTPS on port 443. The campaign demonstrates continued use of trusted binaries, XOR-based obfuscation, and API hashing techniques consistent with China-aligned threat actors.

7mo ago · lab52

LAB52 identified a new cyber espionage campaign targeting Ukrainian entities using a JavaScript-based backdoor named DRILLAPP, delivered via malicious LNK and CPL files. The malware leverages Microsoft Edge in headless mode with permissive command-line flags to enable remote surveillance capabilities including microphone, webcam, and screen capture. The campaign uses lures themed around judicial and charity topics, with infrastructure hosted on public text-sharing services like pastefy.app. Activity shows possible links to the Russian-aligned threat actor Laundry Bear, based on overlapping tactics such as lure themes and hosting patterns.

3mo ago · lab52

In August 2025, the Lazarus group conducted a targeted campaign using trojanized tools and DLL sideloading techniques as part of their DreamJob operations. The attackers deployed multiple variants of modular loaders, collectively termed 'DreamLoaders', including TSVIPSrv.dll and HideFirstLetter.dll, to execute malicious payloads and extract credentials. These loaders leveraged legitimate system binaries and encrypted resources to evade detection, while communicating with attacker-controlled SharePoint domains. The campaign demonstrates a high degree of code reuse and operational sophistication aimed at compromising organizational administrators.