New Threat: Dist Track
Summary: Sourcefire reported at least one ongoing incident in the energy sector involving a new destructive threat called DistTrack, with earliest known sightings on 8/14 and no widespread activity detected, suggesting it is targeted. The core file, trksvr.exe (also reported as str.exe), poses as a Microsoft "Distributed Link Tracking Server" and drops a reporter that contacts a command-and-control server plus a data destruction component that, four hours after infection, overwrites files in Documents and Settings, Users, Windows\System32\Drivers and Windows\System32\Config with a portion of a jpeg file before overwriting the MBR so the machine cannot boot.
Why it matters: A four-hour fuse between infection and an unbootable machine leaves little room for response, and the source warns that any analysis should occur only on virtual machines or on computers you are ready to completely rebuild.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026