New Malware with Ties to Sun Orcal Discovered
Summary: Unit 42 discovered a new malware family it named Reaver, tied to the attackers behind SunOrcal, with 10 unique samples and three variants in the wild since late 2016. Reaver's final payload is a Control Panel (CPL) file, a technique Palo Alto Networks has seen in only 0.006% of all malware samples it has analyzed, and the attackers ran both families concurrently from late last year through November 2017 with overlapping command-and-control infrastructure.
Bottom line: The SunOrcal operators, active since at least 2013 and possibly 2010, are still writing custom malware, and their C2 domains have been linked to prior campaigns against Hong Kong democracy activists and Tibetan and Taiwanese activists. A payload format that shows up in 0.006% of samples is exactly the kind of rarity that slips past signature-based defenses tuned to common file types.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026