Upgraded Aggah malspam campaign delivers multiple RATs
Summary: Cisco Talos reported a new Aggah malspam campaign, ongoing since January 2020, that delivers malicious Microsoft Office documents with VB macros which contact shortened j.mp URLs redirecting to Pastebin to pull down later stages. The chain uses a .NET executable to disable protections via a cmstp.exe UAC bypass, then a VBScript injector that process-hollows a benign process to activate RAT payloads, with one Pastebin PRO account, "alphabates3", hosting all RAT samples found so far.
Bottom line: The attackers host every stage on free Pastebin accounts, and the PRO account lets them edit existing pastes to swap in different malware over time - so a blocklist entry you wrote last month may already point at new code.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026