Threat Spotlight: Group 72, Opening the ZxShell
Summary: Cisco Talos published a technical analysis of ZxShell (also called Sensocode), a remote administration tool used by the well-funded Group 72 actor against manufacturing, industrial, aerospace, defense, and media organizations, with watering-hole and spear-phishing as primary vectors. The analysis documents the RAT's installation as a service under a name harvested from the netsvc registry group, its plugin loading from HKLM\SYSTEM\CurrentControlSet\Control\zxplug, a kernel driver named Loveusd.sys installed as USBHPMS, and hooks on ObReferenceObjectByHandle and KiFastCallEntry that hide it from the system.
Why it matters: ZxShell gives its operator file transfer and execution, keylogging, remote desktop, and webcam access, and its command handler rewrites the host process name to the default browser's so a firewall logs the connection as browser traffic. Group 72 uses that foothold as a pivot to attack other hosts inside the victim's network, so a single infection is a route into the rest of the estate.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026