huoronga[.]com

Nothing here looks dramatic at first glance. That’s the point. Many of this week’s threats begin with something ordinary, like an ad, a meeting invite, or a software update. Behind the scenes, the tactics are sharper. Access happens faster. Control is established sooner. Cleanup becomes harder. Here is a quick look at the signals worth paying attention to. AI-powered command executionKali Linux, an advanced penetration testing Linux distribution used for ethical hacking and network security assessments, has added an integration with Anthropic's Claude large language model through the Model Context Protocol (MCP) to issue commands in natural language and translate them into technical commands. Belarus-linked Android spywareResidentBat is an Android spyware implant used by Belarusian authorities for surveillance operations against journalists and civil society. Once installed, it provides operators with access to call logs, microphone recordings, SMS, encrypted messenger traffic, screen captures, and locally stored files. The malware, although first documented in December 2025, is assessed to date back to 2021. According to Censys, ResidentBat-associated infrastructure is concentrated in Europe and Russia: the Netherlands (5 hosts), Germany (2 hosts), Switzerland (2 hosts), and Russia (1 host) in a recent Platform view, using a narrow port range (7000-7257) for control traffic. Crypto phishing wavePhishing campaigns are impersonating cryptocurrency brokerage services like Bitpanda to harvest sensitive data under the pretext of reconfirming their information or risk having their accounts blocked. "Attempting to get multiple forms of information and identification, the attackers used tactics that would seem legitimate to the everyday user," Cofense said. "User information such as name verification, email, and password credentials, and location were all used in this attempt to harvest information under the guise of a multi-factor authentication process." Breakout times shrinkIn its 2026 Global Threat Report, CrowdStrike said adversaries became faster than ever before in 2025. "The average e-crime breakout time — the period between initial access and lateral movement onto another system — dropped to 29 minutes, a 65% increase in speed from 2024," the company said. One such intrusion undertaken by Luna Moth (aka Chatty Spider) targeting a law firm moved from initial access to data exfiltration in four minutes. Chief among the factors fueling this dramatic acceleration was the widespread abuse of legitimate credentials, which allowed attackers to blend into normal network traffic and bypass many traditional security controls. This was coupled with threat actors of varied motivations utilizing AI technology to accelerate and optimize their existing techniques. Some of the threat actors that have leveraged AI in their operations include Fancy Bear, Punk Spider (aka Akira), Blind Spider (aka Blind Eagle), Odyssey Spider (aka TA558), and an India-nexus hacking group called Frantic Tiger that has used Netlify and Cloudflare pages for credential-harvesting operations. The cybersecurity company said it observed an 89% increase in the number of attacks by AI-enabled adversaries compared to 2024 and a 42% year-over-year increase in zero-days exploited prior to public disclosure. In tandem, 67% of vulnerabilities exploited by China-nexus adversaries provided immediate system access, and 40% targeted edge devices that typically lack comprehensive monitoring. The vast majority of attacks, 82%, were free of malware — highlighting attackers' enduring shift toward hands-on-keyboard operations and the abuse of legitimate tools and credentials. 4-minute lateral movementIn a similar report, ReliaQuest said the fastest intrusions reached lateral movement in just 4 minutes, an 85% acceleration from last year, with data exfiltration taking place in 6 minutes. The statistic is fueled by attackers increasingly weaving AI and automation into their tradecraft. "As attackers increasingly secure valid credentials with elevated privileges, the time to react has drastically dropped," ReliaQuest said. "In 2025, the average breakout time (initial access to lateral movement) dropped to 34 minutes. In 47% of incidents, they secured high privileges before ever touching the network. This allows them to skip escalation, blend into traffic, and repurpose legitimate tools." ClickFix fuels Mac stealersMac users searching for popular software like Homebrew, 7-Zip, Notepad++, LibreOffice, and Final Cut Pro are the target of an active malvertising campaign powered by at least 35 hijacked Google advertiser accounts originating from countries including the U.S., Canada, Italy, Poland, Brazil, India, Saudi Arabia, Japan, China, Romania, Malta, Slovenia, Germany, the U.K., and the U.A.E. More than 200 malicious advertisements impersonating legitimate macOS software have been found. The end goal of these efforts is to direct users to fake pages that contain ClickFix-like instructions to deliver MacSync stealer. Another ClickFix campaign has been observed using fake CAPTCHA verification lures on bogus phishing pages to distribute stealer malware that can harvest data from web browsers, gaming apps like Steam, cryptocurrency wallets, and VPN apps. According to ReliaQuest data, a quarter of attacks used social engineering for initial access last year, with ClickFix responsible for delivering 59% of the top malware families. Encryption debate resurfacesMeta went ahead with a plan to encrypt the messaging services connected to its Facebook and Instagram apps despite internal warnings that it would hinder the social media giant's ability to flag child-exploitation cases to law enforcement, Reuters reported. The internal chat exchange dated March 2019 was filed in connection with a lawsuit brought by the U.S. state of New Mexico, accusing it of exposing children and teens to sexual exploitation on its platforms and profiting from it. In response to the concerns raised, Meta said it worked on additional safety features before it launched encrypted messaging on Facebook and Instagram in 2023. ActiveMQ flaw aids LockBitThreat actors are exploiting a now-patched security flaw in internet-facing Apache ActiveMQ servers (CVE-2023-46604) to deploy LockBit ransomware. "Despite being evicted after the initial intrusion, they successfully breached the same server on a second occasion 18 days later," The DFIR Report said. "After compromising the server, the threat actor used Metasploit, possibly along with Meterpreter, to perform post-exploitation activities. These activities included escalating privileges, accessing LSASS process memory, and moving laterally across the network. After regaining access following their eviction, the threat actor swiftly transitioned to deploying ransomware. They leveraged credentials extracted during their previous breach to deploy LockBit ransomware via RDP." The ransomware is suspected to be crafted using the leaked LockBit builder. Chrome crash-to-command trickTwo newly flagged Google Chrome extensions, Pixel Shield - Block Ads (ID: nlogodaofdghipmbdclajkkpheneldjd) and PageGuard - Phishing Protection (ID: mlaonedihngoginmmlaacpihnojcoocl), have been found to adopt the same playbook as CrashFix, where the browser is deliberately crashed, and the user is tricked into running a malicious command à la ClickFix. The most concerning aspect of this campaign is that the extensions actually work and offer the advertised functionality. "The original NexShield DoS created a billion chrome.runtime.connect() calls," Annex Security's John Tuckner said. "These variants use a different technique I'm calling the Promise Bomb because it crashes the browser by flooding Chrome's message passing system with millions of unresolvable promises." While the original NexShield used timer-based activation, the new variants have evolved to push notification-based command-and-control (C2), causing the denial-of-service to be triggered only when the C2 server sends a push notification containing a "newVersion" value ending in "2." This, in turn, gives the attacker selective remote control over when the crashes happen. WinRAR patch lag persistsCybersecurity firm Stairwell said more than 80% of the IT networks it monitors run versions of WinRAR vulnerable to CVE-2025-8088, a vulnerability that has been widely exploited by cybercrime and cyber espionage groups. "This finding underscores a persistent challenge in enterprise security when widely deployed, trusted software that quietly falls out of date and becomes a high-value target for attackers," Alex Hegyi said. Crypto IV reuse riskA new analysis from Trail of Bits has revealed that more than 723,000 open-source projects use cryptographic libraries with insecure defaults. The aes-js and pyaes libraries have been found to provide a default initialization vector (IV) in their AES-CTR API, leading to a large number of key/IV reuse bugs. "Reusing a key/IV pair leads to serious security issues: if you encrypt two messages in CTR mode or GCM with the same key and IV, then anybody with access to the ciphertexts can recover the XOR of the plaintexts, and that’s a very bad thing," Trail of Bits said. While neither library has been updated in years, strongSwan has released an update to address the problem in strongMan (CVE-2026-25998). AI audits smart contractsOpenAI and Paradigm have jointly announced EVMbench, a benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. "EVMbench draws on 120 curated vulnerabilities from 40 audits, with most sourced from open code audit competitions," OpenAI said. "EVMbench is intended both as a measurement tool and as a call to action. As agents improve, it becomes increasingly important for developers and security researchers to incorporate AI-assisted auditing into their workflows." Fake FSB extortion plotA Russian national has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service (FSB), according to local media reports. RBC reported that the suspect, Ruslan Satuchin, posed as an FSB officer and demanded a large payment from Conti. Although an investigation was formally launched in September 2025, the incident allegedly began in September 2022 when Satuchin contacted one of the members of the hacker group and extorted them to avoid criminal liability. Once a prolific ransomware gang, Conti shut down its operations in mid-2022 after splintering into small groups. Ad cloaking service exposedVaronis has disclosed details of a newly identified cybercrime service known as 1Campaign that enables threat actors to run malicious Google Ads for extended periods of time while evading scrutiny. The cloaking platform "passes Google's screening, filters out security researchers, and keeps phishing and crypto drainer pages online for as long as possible, funneling real users to attacker-controlled sites," Varonis security researcher Daniel Kelley said. "It combines real-time visitor filtering, fraud scoring, geographic targeting, and a bot guard script generator into a single dashboard." It's developed and maintained by a threat actor named DuppyMeister for over three years, along with offering Telegram channels for support. Traffic linked to 1Campaign has been distributed across the U.S., Canada, the Netherlands, China, Germany, France, Japan, Hungary, and Albania. Teams call drops macOS malwareA social engineering campaign has been observed using Microsoft Teams meetings to trick attendants into installing macOS malware. Daylight Security has assessed that the activity is consistent with an ongoing attack campaign orchestrated by North Korean threat actors under the name GhostCall. "During the call, the attacker claimed audio issues and coached the victim into running terminal commands that downloaded and executed malicious binaries," Daylight researchers Kyle Henson and Oren Biderman said. "Analysts observed staged downloads and execution from macOS cache and temporary paths, Keychain credential access, and outbound connections to newly created attacker-controlled domains." RAMP fallout reshapes undergroundLast month, law enforcement authorities from the U.S. seized the notorious RAMP cybercrime forum. The event has had a cascading impact, destabilising trust and accelerating fragmentation across the underground cybercrime ecosystem. There are also speculations that RAMP may have functioned as a honeypot or had been compromised long before its seizure. "Rather than consolidating around a single successor, ransomware actors are redistributing across both gated platforms like T1erOne and accessible forums such as Rehub," Rapid7 said. "This shift reflects adaptation, not decline. Disruption fractures trust and redistributes coordination across multiple platforms." Anonymous Fénix members detainedSpanish authorities have announced the arrest of four members of the Anonymous Fénix group for their involvement in distributed denial-of-service (DDoS) attacks. The suspects, whose names were not disclosed, targeted the websites of government ministries, political parties, and public institutions. Two of the group leaders were arrested in May 2025. The first attacks occurred in April 2023. The group is said to have intensified its activities beginning in September 2024, recruiting volunteers to mount DDoS attacks against targets of interest. Judicial spear-phish drops RATA spear-phishing campaign has been observed targeting Argentina's judicial sector that delivers a ZIP archive containing a Windows shortcut that, when launched, displays a decoy PDF to the victims, while stealthily dropping a Rust-based remote access trojan (RAT). "The campaign leverages highly authentic judicial decoy documents to exploit trust in court communications, enabling successful delivery of a covert remote access trojan and facilitating long-term access to sensitive legal and institutional data," Seqrite Labs said. Typosquat spreads ValleyRATA persuasive lookalike website of Huorong Security antivirus ("huoronga[.]com") has been used to deliver a RAT malware known as ValleyRAT. The campaign is the work of a Chinese cybercrime group called Silver Fox, which has a history of distributing trojanized versions of popular Chinese software and other popular programs through typosquatted domains to distribute trojanized installers responsible for deploying ValleyRAT. "Once it's installed, attackers can monitor the victim, steal sensitive information, and remotely control the system," Malwarebytes said. Repo-squatting via Google AdsUsers searching for developer tools have become the target of an ongoing campaign dubbed GPUGate that uses a malicious installer to deliver Hijack Loader and Atomic Stealer. "The attacker creates a throwaway GitHub account and forks the official GitHub Desktop repository," GMO Cybersecurity by Ierae said. "The attacker edits the download link in the README to point to their malicious installer and commits the change. Lastly, the attacker used sponsored ads for 'GitHub Desktop' to promote their commit, using an anchor in README.md to skip past GitHub's cautions." Victims who downloaded the malicious Windows installer would execute a multi-stage loader, while Mac victims received Atomic Stealer. These stories may seem separate, but they point in the same direction. Speed is increasing. Deception is improving. And attackers are finding new ways to blend into everyday activity. The warning signs are there for those who look closely. Small gaps, delayed patches, misplaced trust, and rushed clicks still make the biggest difference. Staying aware of these shifts is no longer optional. The details change each week. The pressure does not.

A convincing lookalike of the popular Huorong Security antivirus has been used to deliver ValleyRAT, a sophisticated Remote Access Trojan (RAT) built on the Winos4.0 framework, to users who believed they were improving their security. The campaign, attributed to the Silver Fox APT group—a Chinese-speaking threat group known for distributing trojanized versions of popular Chinese software—uses a typosquatted domain to serve a trojanized NSIS installer that deploys a full-featured backdoor with advanced user-mode stealth and injection capabilities. A fake site built to catch security-conscious users Huorong Security—known in Chinese as 火绒—is a free antivirus product developed by Beijing Huorong Network Technology Co., Ltd., and widely used across mainland China. The attackers registered huoronga[.]com—note the extra “a” at the end—as a near-perfect imitation of the legitimate huorong.cn. This typosquatting technique catches users who mistype the address or arrive via search engine poisoning or phishing links. The fake site looks convincing enough that most visitors would have no obvious reason to suspect anything is wrong. When a visitor clicks the download button, the request is silently routed through an intermediary domain (hndqiuebgibuiwqdhr[.]cyou) before the final payload is served from Cloudflare R2 storage—a legitimate cloud service chosen for its trusted reputation and availability. The file is named BR火绒445[.]zip, using the Chinese name for Huorong to maintain the disguise up to the moment of execution. What happens after you click download Inside the ZIP archive is a trojanized NSIS installer (Nullsoft Scriptable Install System), a legitimate open-source framework used by many real applications. Its use here is deliberate: an NSIS-built executable raises fewer red flags than a custom packer, and the installation experience feels normal. When executed, the installer drops a desktop shortcut named 火绒.lnk (Huorong.lnk), reinforcing the illusion that the antivirus installed successfully. At the same time, it extracts a cluster of files into the user’s Temp directory. Most are genuine supporting libraries or decoy executables meant to mimic a real installation, including copies of FFmpeg multimedia DLLs, a file posing as a .NET repair tool, and another mimicking a Huorong diagnostic utility. The malicious components include: WavesSvc64.exe: the main loader, disguised as a Waves audio service process DuiLib_u.dll: a hijacked DirectUI library used for DLL sideloading box.ini: an encrypted file containing shellcode How Windows is tricked into loading malware The core technique is DLL sideloading, a technique attackers use to trick Windows into loading a malicious file instead of a legitimate one. WavesSvc64.exe appears legitimate—its PDB path references a gaming application code directory—so Windows loads it without complaint. When it runs, Windows automatically loads DuiLib_u.dll alongside it. That DLL has been replaced with a malicious version that reads encrypted shellcode from box.ini, decrypts it, and executes it directly in memory. Rather than dropping a single monolithic backdoor executable, the chain culminates in in-memory shellcode execution loaded from files dropped to disk (e.g., box.ini) via DLL sideloading. The shellcode-based chain is consistent with the Catena loader pattern documented by Rapid7, where signed or legitimate-looking executables bundle attack code in .ini configuration files and use reflective injection to execute it while leaving a minimal forensic footprint. How the backdoor becomes permanent Behavioral analysis shows a methodical infection chain: 1. Defender exclusions The malware spawns PowerShell at high integrity level and instructs Windows Defender to ignore its persistence directory (AppData\Roaming\trvePath) and its main process (WavesSvc64.exe). After these commands execute, Windows Defender is less likely to scan the malware’s chosen path/process, materially reducing native detection. 2. Persistence It creates a scheduled task named Batteries (observed as C:\Windows\Tasks\Batteries.job). On every subsequent boot, the task launches WavesSvc64.exe /run from the persistence directory, reapplies Defender exclusions, and reconnects to command and control (C2). 3. File refresh To evade signature-based detection, the malware deletes and re-writes WavesSvc64.exe, DuiLib_u.dll, libexpat.dll, box.ini, and vcruntime140.dll. Deletion of these files alone may not fully remediate the infection, as the malware demonstrates the ability to re-write core components during execution. 4. Registry storage Configuration data, including the encoded C2 domain yandibaiji0203.[]com, is written to HKCU\SOFTWARE\IpDates_info. A secondary key at HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e stores encrypted binary data likely used for malware configuration or payload staging. How it avoids detection Beyond disabling Defender, ValleyRAT takes steps to avoid detection and analysis. It checks for debuggers and forensic tools by looking for characteristic window titles. It probes BIOS version, display adapters, and VirtualBox registry keys to detect virtual machines—the sandboxes researchers use to analyze malware safely. It also checks available memory and disk capacity, and inspects locale and language settings, likely as a geofencing measure to confirm it is running on a Chinese-language system before fully deploying. Command-and-control communications The Winos4.0 stager connects to its C2 server at 161.248.87.250 over TCP port 443. Using TCP 443 provides camouflage at the port level; however, inspection revealed a custom binary protocol rather than standard TLS-encrypted HTTPS. Network intrusion detection systems triggered Critical-severity alerts for Winos4.0 CnC login and server-response messages, and a high-severity alert for ProcessKiller C2 initialization. C2 traffic was observed originating from rundll32.exe, which executed with the command line “rundll32.exe”—lacking the typical , argument structure. In environments with command-line and parent-child process monitoring, this execution pattern is a high-confidence anomaly. Sandbox analysis extracted multiple WinosStager plugin DLLs from the rundll32 process, confirming the modular architecture that makes ValleyRAT particularly dangerous: capabilities are not bundled in a single monolithic binary but downloaded on demand. The ProcessKiller component is particularly concerning. Network telemetry indicates ProcessKiller C2 initialization, consistent with a module associated in prior reporting with terminating security software. Previous ValleyRAT/Winos4.0 campaigns targeted security products from Qihoo 360, Huorong, Tencent, and Kingsof—indicating the potential to terminate security software, including the product it impersonated as a lure. Post-compromise capabilities In short, once it’s installed, attackers can monitor the victim, steal sensitive information, and remotely control the system. Sandbox analysis confirmed the following behaviors once the malware has a foothold: Keylogging via a system-wide keyboard hook installed through SetWindowsHookExW in the rundll32 process, capturing every keystroke. Process injection: WavesSvc64.exe creates suspended processes and writes to the memory of other processes for stealth code execution. Credential access: the malware reads credential-related registry keys and touches browser cookie files. System reconnaissance: queries hostname, username, keyboard layout, locale, running processes, and physical drives. RWX memory regions created inside rundll32.exe consistent with in-memory execution, reducing reliance on additional dropped payload executables. Self-cleanup: deletes its own executed files and performs deletion of 10 or more additional files to obstruct forensic recovery. The malware creates mutexes including the dated string 2026. 2. 5 and the path C:\ProgramData\DisplaySessionContainers.log, and writes a log file at that location. Who’s behind this campaign? This campaign fits the established pattern of Silver Fox operations. The group has repeatedly used trojanized installers of widely trusted Chinese software to distribute ValleyRAT and the Winos4.0 framework. Previous lures included QQ Browser, LetsVPN, and gaming applications. Impersonating a security product raises the stakes. The victims are not just casual users—they are actively looking for protection. The targeting remains consistent. Chinese-language filenames, the Huorong lure, and built-in locale checks all point to a geographically focused campaign. However, the public leak of the ValleyRAT builder on GitHub in March 2025 significantly lowered the barrier to entry. Researchers identified approximately 6,000 related samples between November 2024 and November 2025, with 85% appearing in the latter half of that period. That increase suggests the tooling is spreading beyond a single operator. How to stay safe This campaign shows how easily trust can be turned against users. The attackers didn’t need a zero-day exploit. They needed a convincing website, a realistic installer, and the knowledge that many people will search for a product name and click the first result. When the lure is a security product, the deception is even more effective. Here’s what to check: Verify download sources. The legitimate Huorong Security website is huorong.cn. Always double-check the domain before downloading security software—a single extra character can lead to a malicious site. Monitor Windows Defender exclusions. Any Add-MpPreference command you did not initiate is a strong indicator of compromise. Audit exclusions regularly. Hunt for persistence artifacts. Search endpoints for a scheduled task or job named Batteries (artifact observed as C:\Windows\Tasks\Batteries.job ), the%APPDATA%\trvePath\ directory, and the registry keyHKCU\SOFTWARE\IpDates_info . Block outbound connections to 161.248.87.250 at the firewall and deploy IDS rules for Winos4.0 C2 signatures (ET SIDs 2052875, 2059975, and 2052262). Alert on process anomalies. Rundll32.exe without a legitimate DLL argument, and WavesSvc64.exe outside a genuine Waves Audio installation, are high-confidence indicators. Malwarebytes detects and blocks known variants of ValleyRAT and its associated infrastructure. Indicators of Compromise (IOCs) Infrastructure Fake websites: - huoronga[.]com - huorongcn[.]com - huorongh[.]com - huorongpc[.]com - huorongs[.]com Redirect domain: hndqiuebgibuiwqdhr[.]cyou Payload host: pub-b7ce0512b9744e2db68f993e355a03f9.r2[.]dev C2 IP: 161.248.87[.]250 (TCP 443, custom binary protocol) Encoded C2 domain: yandibaiji0203[.]com File hashes (SHA-256) 72889737c11c36e3ecd77bf6023ec6f2e31aecbc441d0bdf312c5762d073b1f4 (NSIS installer) db8cbf938da72be4d1a774836b2b5eb107c6b54defe0ae631ddc43de0bda8a7e (WavesSvc64.exe) d0ac4eb544bc848c6eed4ef4617b13f9ef259054fe9e35d9df02267d5a1c26b2 (DuiLib_u.dll) 07aaaa2d3f2e52849906ec0073b61e451e0025ef2523dafbd6ae85ddfa587b4d (WinosStager DLL #1) 66e324ea04c4abbad6db4f638b07e2e560613e481ff588e0148e33e23a5052a9 (WinosStager DLL #2) 47df12b0b01ddca9eb116127bf84f63eb31e80cec33e4e6042dff1447de8f45f (WinosStager DLL #3) Host-based indicators Scheduled task named Batteries atC:\Windows\Tasks\Batteries.job Persistence directory: %APPDATA%\trvePath\ Registry key: HKCU\SOFTWARE\IpDates_info Registry key: HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e Log file: C:\ProgramData\DisplaySessionContainers.log Processes: WavesSvc64.exe ,rundll32.exe (without DLL argument) MITRE ATT&CK T1189 — Drive-by Compromise (Initial Access) T1059.001 — PowerShell (Execution) T1053.005 — Scheduled Task (Persistence) T1562.001 — Impair Defenses: Disable or Modify Tools (Defense Evasion) T1574.002 — DLL Side-Loading (Defense Evasion) T1027 — Obfuscated Files or Information (Defense Evasion) T1218.011 — Rundll32 (Defense Evasion) T1555 — Credentials from Password Stores (Credential Access) T1082 — System Information Discovery (Discovery) T1057 — Process Discovery (Discovery) T1056.001 — Keylogging (Collection) T1071 — Application Layer Protocol (Command and Control) T1070.004 — Indicator Removal: File Deletion (Defense Evasion) Something feel off? Check it before you click. Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.