Threat Spotlight: Valak Slithers Its Way Into Manufacturing and Transportation Networks
Summary: Cisco Talos observed Valak malspam campaigns targeting financial, manufacturing, insurance and transportation organizations, with 14 unique emails sent over 10 days from eight compromised accounts against one financial institution and more than 20 emails over several weeks from eight accounts against an insurer. The emails reply to stolen existing threads, carry password-protected ZIP files containing Word documents that use VBA macros to download an obfuscated DLL via UrlDownloadToFileA and register it with regsvr32.exe, with delivery infrastructure mostly in Russia and Ukraine and C2 servers spread across more regions including the United States.
Key Takeaway: Because the lures are replies inside real email threads and the payloads sit in password-protected ZIPs, perimeter controls cannot scan them, leaving endpoint security as the last barrier before a Valak infection.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026