Ding! Your RAT has been delivered
Summary: Cisco Talos analyzed a spam campaign delivering the freeware remote access trojan DarkKomet through DHL- and FedEx-themed emails carrying zip attachments posing as airway bills, sent over 8 hours on a single day in June 2015. The malware hid its executable in nested subfolders, attempted a right-to-left override on filenames, mimicked Adobe and Bluetooth service process names, and spawned close to 500 vbc.exe instances, each creating the mutex DC_MUTEX-0UJ9GZV and connecting to briach202.no-ip.info on port 1126.
What's compelling: Talos traced the same dynamic DNS domain back to samples from January 2015, and more than 50% of the samples it analyzed over a six-month period appeared in the last 30 days - one actor iterating the same infrastructure for months while defenders chase individual filenames.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026