Malware Analysis Weekly

Families, campaigns, TTPs, and IOCs from the field · for malware analysts and IR teams

At a glance

This week’s threat landscape was shaped by large-scale law-enforcement takedowns colliding with freshly discovered malware families and an unpatched Windows LPE. The most operationally significant headline: Operation Endgame partnered with the FBI and Europol to nuke SocGholish infrastructure across nearly 15,000 compromised sites, simultaneously cutting off Evil Corp’s primary initial-access pipeline. Within hours of that announcement, CISA independently warned that 86,644 FortiGate devices remain exposed to the FortiBleed heap-overflow (CVE-2026-27568), with exploitation confirmed in the wild against critical-infrastructure targets. And CVE-2026-47281 — the RoguePlanet race condition in Microsoft Defender — added to KEV this week after a public PoC began circulating, giving post-compromise operators a reliable SYSTEM escalation path on fully patched Windows 10/11.

On the malware-family front, three distinct campaigns stood out. DragonForce pivoted to abusing Microsoft Teams external-relay channels to beacon their Backdoor.Turn C2 traffic through legitimate Microsoft infrastructure, evading most proxy-based controls. Separately, Microsoft detailed a novel Windows crypto-clipper that spreads via USB LNK worm and routes C2 through Tor hidden services, and researchers at ESET documented SprySOCKS — previously Linux-only, tied to Chinese-nexus actor FishMonger — now expanded to Windows with a new DLL-sideloading chain. The Gentlemen RaaS group continued to mature their toolkit, deploying GentleKiller, an EDR-killer that terminates more than 400 security-product processes before deploying ransomware payloads.

The week also surfaced important threads in credential theft, OAuth abuse, and AI-agent exploitation. Rokarolla, a new Android banking trojan, targets 217 banking and cryptocurrency applications with overlay and keylogger capabilities. The Icarus campaign leveraged an OAuth token theft at Klue to pivot into Salesforce data exfiltration across multiple downstream customers. Microsoft published primary technical research on AutoJack, a web-page-to-host-RCE attack chain targeting AI agents running on local machines — a technique that is likely to be operationalized in credential-harvesting and initial-access toolkits. Foundational this week: Check Point’s deep DFIR report on The Gentlemen & SystemBC, and Cisco Talos’ anatomy of UAT-8302’s sprawling China-nexus toolset.

Topic map — families, actors, CVEs, and how they intersect

Named entities extracted from this week’s 16 malware-analysis articles — threat actors, malware families, CVEs, vendors, researchers, and the campaigns or themes connecting them.

This week clusters around three gravitational centres: law-enforcement infrastructure takedowns (SocGholish/Evil Corp via Operation Endgame, FortiBleed KEV pressure); active malware families and EDR evasion (DragonForce/Backdoor.Turn, SprySOCKS/FishMonger, GentleKiller/Gentlemen RaaS, the USB LNK crypto-clipper); and credential theft and lateral-access chains (Rokarolla banking trojan, Icarus/Klue OAuth pivot, Phantom Stealer, Popa botnet) — with AI-agent exploitation (AutoJack) and the military-AI verification problem as this week’s emerging-vector entries.

Article index

Active exploits & critical CVEs

A mass-exploitation warning on unpatched FortiGate devices and a newly KEV’d Windows Defender LPE with a public PoC already circulating.

Ransomware, EDR evasion & takedowns

Operation Endgame kills SocGholish across 15,000 sites; GentleKiller terminates 400+ security processes before payload; the Gentlemen group’s SystemBC roots.

APT campaigns & new backdoor families

Chinese-nexus actors expanding Linux backdoors to Windows, DragonForce hiding C2 in Teams relay traffic, and Talos’s deep dive into UAT-8302’s multi-tool toolset.

Stealers, botnets & delivery chains

New Android banking trojan, a fileless browser-credential stealer, a USB-worm-dropped crypto-clipper with Tor C2, a botnet tied to a listed firm, and Steam Workshop abused as a delivery channel.

OAuth abuse, AI-agent exploitation & emerging vectors

OAuth token theft pivoting to Salesforce data exfiltration, a single web page triggering host-level RCE via AI agents, and the unsolved problem of verifying military AI behavior.

Detailed write-ups

1. FortiBleed: CISA warns as 86,644 FortiGate devices remain exposed to active exploitation

The Hacker News · Jun 19, 2026

CISA issued an emergency warning confirming that 86,644 FortiGate VPN and firewall appliances remain internet-exposed and unpatched against FortiBleed (CVE-2026-27568), a heap-buffer-overflow in FortiOS SSL-VPN that has seen confirmed exploitation against critical-infrastructure targets. The vulnerability enables unauthenticated remote code execution by sending a crafted HTTP request to the management interface. Exposure at this scale — tens of thousands of perimeter devices with a public RCE — provides ransomware affiliates and nation-state actors a large, reliable initial-access surface. Immediate actions: pull your exposed FortiGate inventory from Shodan or FOFA, patch to the fixed FortiOS version, enforce management-interface ACLs to restrict access to internal networks only, and hunt for evidence of pre-patch exploitation including unusual admin account creation, config changes, and outbound tunneling from FortiGate hosts. CISA KEV status means federal agencies face a hard patch deadline.

Read the article

2. Windows zero-day ‘RoguePlanet’ exploit released — Defender LPE grants SYSTEM (CVE-2026-47281)

SecurityWeek · Jun 15, 2026

A public proof-of-concept named RoguePlanet weaponizes CVE-2026-47281 (CVSS 9.6), a race condition in the Microsoft Defender scanning engine, to obtain a SYSTEM-level shell on fully patched Windows 10/11. CISA added the CVE to KEV this week following confirmed in-the-wild exploitation. The PoC availability means any threat actor with an existing foothold can now trivially escalate to SYSTEM — dramatically lowering the skill bar for post-exploitation. No patch is available yet. Defensive priorities: build behavioral detections for anomalous SYSTEM-context process launches descended from Defender service paths, monitor for token-manipulation primitives (SetThreadToken, ImpersonateNamedPipeClient) invoked from unexpected parent processes, and treat every existing low-privilege foothold in your environment as SYSTEM-capable until Microsoft ships a fix. Prioritize endpoints that are exposed to untrusted code execution.

Read the article

3. SocGholish takedown: law enforcement nukes malware from nearly 15,000 sites (Op Endgame, Evil Corp)

BleepingComputer · Jun 18, 2026

Operation Endgame — the same multi-nation joint action that targeted Smokeloader and IcedID infrastructure last year — expanded this week with an FBI/Europol operation that sanitized SocGholish JavaScript injection code from nearly 15,000 compromised websites, cutting off Evil Corp’s primary drive-by initial-access pipeline. SocGholish had operated as a major initial-access broker for over five years, delivering fake browser-update overlays that dropped NetSupport RAT, Cobalt Strike, and ransomware precursors. The takedown removes a high-volume first-stage loader but does not eliminate Evil Corp or its affiliate relationships. For defenders: remove SocGholish IOCs from your block lists as live infrastructure, but retain detection logic for the fake-update social-engineering template — successor campaigns will reuse the pattern. Review web filtering logs retroactively for SocGholish domain hits that may indicate unresolved compromises.

Read the article

4. The Gentlemen RaaS deploys GentleKiller EDR-killer (terminates 400+ security processes)

The Hacker News · Jun 19, 2026

The Gentlemen RaaS operation has introduced GentleKiller, a dedicated EDR-disabling tool that systematically terminates processes matching a hardcoded list of more than 400 security products — including EDR agents, AV engines, logging forwarders, and forensic tools — before deploying their ransomware payload. The technique relies on a combination of a vulnerable signed driver for kernel-level process termination and a user-mode enumeration loop. This is a notable capability uplift from the group’s earlier reliance on commodity BYOVD tooling. YARA and Sigma rules for GentleKiller’s driver load and process-kill patterns are the priority detection artifacts. Also pair with the Check Point DFIR report (article 5) for the broader Gentlemen intrusion chain, which includes SystemBC for proxy/C2 persistence before the EDR-kill and encryption steps.

Read the article

5. DFIR report: The Gentlemen & SystemBC — anatomy of a modern RaaS intrusion chain · FOUNDATIONAL

Check Point Research · May 6, 2026

Check Point’s DFIR team reconstructs a full Gentlemen RaaS intrusion from initial access through encryption, detailing the role of SystemBC as the persistent SOCKS5-proxy implant that maintains covert operator access throughout the dwell time. The report maps the full kill chain: phishing lure delivering a dropper, SystemBC installation for C2, Cobalt Strike beacon for interactive operations, credential dumping via Mimikatz, lateral movement via RDP and WMI, and eventual GentleKiller deployment before file encryption. This is the technical foundation for building detection coverage across the entire Gentlemen chain rather than just the ransomware payload. Timeline correlation and the Cobalt Strike watermarks extracted by the team provide pivot points for retrospective threat hunting in EDR and SIEM telemetry.

Read the article

6. DragonForce hackers abuse Microsoft Teams relay channels to hide Backdoor.Turn C2 traffic

The Hacker News · Jun 18, 2026

DragonForce, a threat group with ties to both ransomware deployment and hacktivist operations, has adopted a new C2 evasion technique: routing Backdoor.Turn command-and-control traffic through Microsoft Teams external-relay channels. By abusing legitimate Teams infrastructure to tunnel implant communications, the group blends malicious traffic into TLS-encrypted Microsoft service flows that most proxy and DLP controls permit unconditionally. This renders IP-reputation and domain-block approaches ineffective. Detection must shift to behavioral signals: anomalous Teams process network activity outside normal communication patterns, unexpected Teams API calls from non-human accounts, and Backdoor.Turn implant artefacts on disk. Organizations running Teams should review external-access and relay policies and restrict guest/external federation to approved tenants only.

Read the article

7. China-linked SprySOCKS backdoor expands to Windows (FishMonger/ESET research)

The Hacker News · Jun 16, 2026

ESET researchers document a cross-platform expansion of SprySOCKS, a backdoor previously observed only on Linux systems and attributed to the Chinese-nexus actor FishMonger (also tracked as Earth Lusca). The new Windows variant uses a DLL sideloading chain to establish persistence, implements the same SOCKS5-proxy C2 protocol as its Linux counterpart, and targets government and research institutions across Southeast Asia and Europe. Having the same C2 protocol on both platforms enables unified operator tooling across mixed-OS environments — a significant capability maturation. Detection: hunt for unsigned DLLs sideloaded by signed Microsoft binaries in non-standard paths, anomalous SOCKS5 tunnel establishment from workstation processes, and SprySOCKS network indicators published with the ESET report.

Read the article

8. UAT-8302: China-nexus APT’s box full of malware — multi-tool campaign anatomy · FOUNDATIONAL

Cisco Talos · May 13, 2026

Cisco Talos profiles UAT-8302, a China-nexus threat actor deploying an unusually broad set of custom and commodity malware families within single intrusion chains — including PlugX, ShadowPad, a custom keylogger, a bespoke data-staging tool, and multiple living-off-the-land binaries — against government, telecoms, and critical-infrastructure targets in Asia and the Middle East. The report’s value for detection engineering is the multi-stage correlation: UAT-8302 is not a one-tool actor, and endpoint detections that focus only on individual family signatures will miss intrusions where one family is swapped for another. Build coverage on the group’s behavioral patterns — specific WMI lateral-movement commands, staging directory paths, and encrypted archive exfil over WebDAV — rather than relying solely on family-specific YARA.

Read the article

9. New Rokarolla Android malware targets 217 banking and cryptocurrency applications

BleepingComputer · Jun 17, 2026

Rokarolla is a newly documented Android banking trojan targeting 217 banking, payment, and cryptocurrency applications across multiple geographies. It combines overlay attacks (rendering fake login screens over legitimate apps to harvest credentials), keylogging, and SMS interception to bypass 2FA — a standard but highly effective capability stack for financial-fraud trojans. Distribution leverages sideloaded APKs delivered through phishing SMS and social-engineering lures. For analysts supporting mobile-threat intelligence: pull the published package names and certificate hashes to build detection content for MDM policies, and add the C2 domains to threat-intel blocklists. The breadth of 217 targeted apps suggests a commodity toolkit for sale rather than a purpose-built tool, meaning variants targeting additional app sets are likely.

Read the article

10. Fileless Phantom Stealer targets browser credentials — lives entirely in memory

Dark Reading · Jun 16, 2026

Phantom Stealer is a fileless credential-theft tool designed to extract saved passwords, session cookies, and autofill data from Chrome, Edge, Firefox, and Brave without writing executable artifacts to disk. The stealer runs entirely in memory via a reflective DLL injection chain, making traditional file-hash-based AV detection ineffective and complicating forensic recovery. Exfiltration routes stolen data over encrypted HTTPS to an attacker-controlled endpoint. Detection must rely on behavioral signals: process memory writes into browser process space from unexpected parent processes, ReadProcessMemory calls targeting browser PID profiles, and anomalous HTTPS POSTs of compressed browser-profile data. Teams relying solely on endpoint AV without memory-inspection capabilities are blind to this family.

Read the article

11. Microsoft details Windows crypto-clipper spread by USB LNK worm with Tor C2

The Hacker News · Jun 20, 2026

Microsoft Threat Intelligence details a cryptocurrency clipboard-hijacker with an unusual propagation mechanism: it spreads as a malicious LNK file via USB drives, silently replaces cryptocurrency wallet addresses in clipboard contents, and routes C2 traffic through Tor hidden services to obstruct takedowns and infrastructure tracking. The USB-worm vector is a deliberate choice — it reaches air-gapped or corporate machines that never touch phishing email, and LNK auto-execution via Windows Explorer requires no user elevation. Detection priorities: monitor for LNK files created on removable drives, clipboard-access API calls from processes without a UI window, and Tor-binary execution or connections to known Tor guard nodes. The Tor C2 channel also signals that the operator is resilient to domain-based takedown.

Read the article

12. ‘Popa’ botnet linked to a publicly traded Israeli firm (Krebs investigation)

Krebs on Security · Jun 18, 2026

Brian Krebs documents infrastructure and corporate-registration evidence linking the Popa botnet — a residential-proxy and click-fraud operation built on compromised consumer devices — to a publicly traded Israeli technology company. The investigation traces Popa’s C2 infrastructure, software distribution chains, and WHOIS history to entities connected to the firm. Corporate-linked botnets occupy an unusual legal gray zone and rarely face the rapid takedown pressure applied to purely criminal operations, giving them extended operational lifespans. For threat intelligence teams, the registration and infrastructure pivots detailed in the Krebs report provide enrichment anchors for hunting Popa implants, and the residential-proxy node set is relevant to any organization tracking anomalous authentication traffic from residential IP ranges.

Read the article

13. Steam Workshop abused to spread malware via Wallpaper Engine app

BleepingComputer · Jun 16, 2026

Attackers have abused Steam Workshop — Valve’s user-generated content platform — to distribute malware-laced packages disguised as legitimate Wallpaper Engine themes and assets. Because Steam Workshop content is downloaded and executed by a trusted, signed application already present on the endpoint, many security controls do not flag the execution chain. The abuse pattern mirrors earlier attacks against game-mod platforms and highlights the risk of any trusted software update or user-content delivery channel that bypasses standard download-reputation checks. Endpoint detection should monitor for unusual child process launches from wallpaper32.exe or wallpaper64.exe, script execution or binary drops from Steam Workshop content directories, and outbound connections from those processes to non-Valve infrastructure.

Read the article

14. Klue OAuth breach linked to ‘Icarus’ Salesforce data-theft attacks

BleepingComputer · Jun 18, 2026

The Icarus threat actor exploited an OAuth misconfiguration at Klue (a competitive-intelligence SaaS platform) to obtain long-lived access tokens, then pivoted those credentials into Salesforce environments at downstream Klue customers to exfiltrate CRM data. The attack chain illustrates a recurring SaaS-to-SaaS lateral-movement pattern: compromise a smaller, less-hardened OAuth app that holds delegated permissions into a high-value platform, then exploit the transitive trust. Defender priorities: audit OAuth application grants across your Salesforce org for third-party apps with excessive scopes, review Salesforce data-access logs for anomalous bulk export activity in the breach window, and rotate any tokens issued to Klue integrations. The incident is also a prompt to enforce the principle of least privilege on all SaaS OAuth integrations.

Read the article

15. AutoJack: how a single web page achieves RCE on the host running an AI agent

Microsoft Security Blog · Jun 18, 2026

Microsoft’s primary technical analysis of AutoJack details how a single maliciously crafted web page can achieve remote code execution on the host machine running an AI coding or browser agent. The attack exploits the agent’s willingness to act on instructions embedded in web content — a prompt-injection variant — chaining page-level JavaScript execution into agent-tool-call abuse to write and execute arbitrary files on the host filesystem. This is a significant threat-surface expansion: any developer or analyst running an AI agent that browses the web or processes untrusted URLs becomes a target. Microsoft documents the specific tool-call sequences that constitute exploitation and provides detection guidance. Security teams should treat AI-agent processes as high-risk execution contexts, monitor for unexpected file writes and process launches from agent processes, and follow mitigations outlined in the report.

Read the article

16. Proving what a military AI model will actually do is the real problem

Help Net Security · Jun 15, 2026

This piece examines the unsolved verification and validation problem for AI systems deployed in military and government security-critical contexts: even with full model access, proving that a model will behave as intended across all operational inputs remains computationally intractable with current techniques. The implications for malware analysts and IR teams extend beyond military settings — the same verification gap applies to any AI system used in security tooling, SOAR orchestration, or autonomous response. An adversary who understands a model’s failure modes can engineer inputs that cause it to mis-triage, mis-classify, or take unintended autonomous actions. The article frames the problem rigorously and is relevant context for any team evaluating AI-assisted detection systems or automated response capabilities where incorrect behavior has high-consequence outcomes.

Read the article

On our watch list

1. RoguePlanet patch timeline. CVE-2026-47281 remains unpatched with a public PoC and confirmed in-the-wild exploitation. Microsoft has not published a mitigation or out-of-band fix as of this edition. Watch for an emergency patch or official mitigation guidance; until one ships, treat every low-privilege foothold in your environment as SYSTEM-capable and prioritize behavioral detection on Defender-adjacent process launches.
2. Post-takedown Evil Corp activity. The SocGholish infrastructure seizure removes a major initial-access pipeline but not the organization behind it. Expect Evil Corp affiliates to accelerate deployment of backup loaders (historically SocGholish has run alongside Gootloader and FakeUpdates). Track for new drive-by delivery campaigns adopting similar social-engineering templates within the next two to four weeks.
3. AutoJack operationalization. The publication of Microsoft’s technical AutoJack writeup alongside The Hacker News’ coverage of the attack concept gives threat actors a clear blueprint. We expect AutoJack-style prompt-injection-to-RCE chains to appear in commodity attack toolkits and criminal forums within weeks, targeting developers and analysts running local AI agents. Monitor vendor advisories from AI agent framework maintainers for sandbox and tool-call restriction updates.
4. GentleKiller BYOVD driver tracking. The specific vulnerable signed driver deployed by GentleKiller is likely to be rotated as signature-based detection matures. Track Microsoft’s vulnerable driver blocklist updates and LOLBAS additions; any new entry tied to kernel-level process termination is likely a GentleKiller variant or successor adopting a freshly abused driver.

Malware Analysis Weekly · a Newshunter publication

Weekly news items are from the previous seven to ten days. Foundational reading is refreshed each week.

Unsubscribe · View in browser

*|LIST:ADDRESS|*

Curated by the Security Radar threat-intelligence team.

Newsletter design, layout, and editorial curation © 2026 Security Radar LLC. All rights reserved.

Article titles and summaries are excerpted for review and commentary; all linked articles remain the copyright of their respective publishers and authors.