Search/telegram[.]org
● IOC

telegram[.]org

View graph Watch Export
Type
DOMAIN
Source
News extraction
First seen
Aug 7, 2025
Last seen
Mar 24, 2026
Look up on VirusTotal
Reported by
3
Stryker Says Malicious File Found During Probe Into Iran-Linked AttackSecurityWeekMar 24, 2026FBI warns of Russian, Iranian cyber activity involving messaging platformsRecorded FutureMar 23, 2026New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud StealerUnit42 PaloAltoAug 7, 2025
Related Stories
2
FBI warns of Russian, Iranian cyber activity involving messaging platforms
Threat actors with ties to Iran successfully broke into the personal email account of Kash Patel, the director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents to the internet. Handala Hack Team, which carried out the breach, said on its website that Patel "will now find his name among the list of successfully hacked victims." In a statement shared with Reuters, the FBI confirmed Patel's emails had been targeted, and noted necessary steps have been taken to "mitigate potential risks associated with this activity." The agency also said the published data was "historical in nature and involves no government information." The leak includes emails from 2010 and 2019 allegedly sent by Patel. Handala Hack is assessed to be a pro-Iranian, pro-Palestinian hacktivist persona adopted by Iran's Ministry of Intelligence and Security (MOIS). It's tracked by the cybersecurity community under the monikers Banished Kitten, Cobalt Mystique, Red Sandstorm, and Void Manticore, with the group also operating another persona called Homeland Justice to target Albanian entities since mid-2022. A third persona linked to the MOIS-affiliated adversary is Karma, which is said to have been likely completely replaced by Handala Hack since late 2023. Data gathered by StealthMole has revealed that Handala's online presence extends beyond messaging platforms and cybercrime forums like BreachForums to publicize its activities, maintaining a layered infrastructure that includes surface web domains, Tor-hosted services, and external file-hosting platforms such as MEGA. "Handala has consistently targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access," Check Point said in a report published this month. "Throughout the last months, we identified hundreds of logon and brute-force attempts against organizational VPN infrastructure linked to Handala-associated infrastructure." Attacks mounted by the proxy group are known to leverage RDP for lateral movement and initiate destructive operations by dropping wiper malware families such as Handala Wiper and Handala PowerShell Wiper via Group Policy logon scripts. Also used are legitimate disk encryption utilities like VeraCrypt to complicate recovery efforts. "Unlike financially motivated cybercriminal groups, Handala-associated activity has historically emphasized disruption, psychological impact, and geopolitical signaling," Flashpoint said. "Operations attributed to the persona frequently align with periods of heightened geopolitical tension and often target organizations with symbolic or strategic value." The development comes against the backdrop of the U.S.-Israel-Iran conflict, prompting Iran to go on a retaliatory cyber offensive against Western targets. Notably, Handala Hack claimed credit for crippling the networks of medical devices and services provider Stryker by deleting a huge trove of company data and wiping thousands of employee devices. The attack is the first confirmed destructive wiper operation targeting a U.S. Fortune 500 company. In an update issued on its website this week, Stryker said "the incident is contained," adding it "reacted quickly to not only regain access but to remove the unauthorized party from our environment" by dismantling the persistence mechanisms installed. The breach, it stated, was confined to its internal Microsoft environment. The threat actors have been found to use a malicious file to run commands that allowed them to conceal their actions. However, the file does not possess any capabilities to spread across the network, Stryker pointed out. Palo Alto Networks Unit 42 said the primary vector for recent destructive operations from Handala Hack likely involves the "exploitation of identity through phishing and administrative access through Microsoft Intune." Hudson Rock has found evidence that compromised credentials associated with Microsoft infrastructure obtained via infostealer malware may have been used to pull off the hack. In the wake of the breach, both Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) have released guidance on hardening Windows domains and fortifying Intune to defend against similar attacks. This includes using the principle of least privilege, enforcing phishing-resistant multi-factor authentication (MFA), and enabling multi-admin approval in Intune for sensitive changes. Flashpoint has characterized the attack on Stryker as a dangerous shift in supply chain threats, as state-linked cyber activity targeting critical suppliers and logistics providers can have cascading impacts across the entire healthcare ecosystem. DoJ Takes Down Pro-Iranian Hacker Domains Handala Hack's leak of Patel's personal emails comes in response to a court-authorized operation that led to the seizure of four domains operated by MOIS since 2022 as part of an effort to disrupt its malicious activities in cyberspace. The U.S. government is also offering a $10 million reward for information on members of the group. The names of the seized domains are listed below - justicehomeland[.]org handala-hack[.]to karmabelow80[.]org handala-redwanted[.]to "The seized domains [...] were used by the MOIS in furtherance of attempted psychological operations targeting adversaries of the regime by claiming credit for hacking activity, posting sensitive data stolen during such hacks, and calling for the killing of journalists, regime dissidents, and Israeli persons," the U.S. Department of Justice (DoJ) said. This included the names and sensitive information of about 190 individuals associated with or employed by the Israeli Defense Force (IDF) and/or Israeli government, and 851 GB of confidential data from members of the Sanzer Hasidic Jewish community. In addition, an email address linked to the group ("handala_team@outlook[.]com") is alleged to have been used to send death threats to Iranian dissidents and journalists living in the U.S. and elsewhere. In a separate advisory, the FBI revealed that Handala Hack and other MOIS cyber actors have employed social engineering tactics to engage with prospective victims on social messaging applications to deliver Windows malware capable of enabling persistent remote access using a Telegram bot by masquerading the first-stage payload as commonly used programs like Pictory, KeePass, Telegram, or WhatsApp. Using Telegram (or other legitimate services) as C2 is a common tactic by threat actors to hide malicious activity among normal network traffic, and significantly reduce the likelihood of detection. Related malware artifacts found on compromised devices have revealed added capabilities to record audio and screen while a Zoom session was active. The attacks have targeted dissidents, opposition groups, and journalists, per the FBI. "MOIS cyber actors are responsible for using Telegram as a command-and-control (C2) infrastructure to push malware targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups around the world," the bureau said. "This malware resulted in intelligence collection, data leaks, and reputational harm against the targeted parties." Handala Hack has since resurfaced on a different clearnet domain, "handala-team[.]to," where it described the domain seizures as "desperate attempts by the United States and its allies to silence the voice of Handala." The ongoing conflict has also prompted fresh warnings that it risks turning critical infrastructure sector operators into lucrative targets, even as it has triggered a surge in DDoS attacks, website defacements, and hack-and-leak operations against Israel and Western organizations. Hacktivists entities have also engaged in psychological warfare and influence operations with an aim to sow fear and confusion among the targeted populations. In recent weeks, the energy sector in the Middle East has drawn the attention of a relatively new cybercriminal group called Nasir Security. The group, instead of directly targeting energy companies, has gone after their contractors and third-parties to leak internal data, leading to "incorrect assumptions" about the origin of hacks. "The group is attacking supply chain vendors involved in engineering, safety, and construction," Resecurity said. "The supply chain attacks attributed to Nasir Security are likely carried out by cyber-mercenaries or individuals hired or sponsored by Iran or its proxies." "The cyber activity tied to this conflict is becoming increasingly decentralized and destructive," Kathryn Raines, cyber threat intelligence team lead for the National Security Solutions at Flashpoint, said in a statement. "Groups like Handala and Fatimion are targeting private-sector organizations with attacks designed to erase data, disrupt services, and introduce uncertainty for both businesses and the public. At the same time, we're seeing a greater use of legitimate administrative tools in these cyber operations, making it significantly harder for traditional security controls to detect." That's not all. MOIS-linked actors have been increasingly engaging with the cybercrime ecosystem to support its objectives and provide a cover for its malicious activity. This includes Handala's integration of Rhadamanthys stealer into its operations and MuddyWater's use of the Tsundere botnet (aka Dindoor) and Fakeset, the latter of which is a downloader used to deliver CastleLoader. "Such engagement offers a dual advantage: it enhances operational capabilities through access to mature criminal tooling and resilient infrastructure, while complicating attribution and contributing to recurring confusion around Iranian threat activity," Check Point said. "The use of such tools has created significant confusion, leading to misattribution and flawed pivoting, and clustering together activities that are not necessarily related. This demonstrates that the use of criminal software can be effective for obfuscation, and highlights the need for extreme caution when analyzing overlapping clusters."
1 shared
Apr 2, 2026
How CISOs Can Survive the Era of Geopolitical Cyberattacks
A five-step playbook to stop Iranian wiper campaigns before they spread Geopolitical tensions are increasingly spilling into cyberspace. For CISOs, that means preparing for attacks that are not motivated by money but by disruption. Nation-state actors and politically aligned groups are increasingly deploying destructive malware designed to cripple organizations and critical infrastructure. Unlike ransomware groups that want payment, these attackers want operational chaos. Iranian wiper campaigns are a clear example of this shift. These attacks are designed to destroy systems, halt operations, and create cascading real-world consequences. They often target organizations that sit in critical supply chains, healthcare ecosystems, or national infrastructure. For security leaders, the question is no longer just how to prevent intrusions—it is how to survive them. Recent incidents highlight the potential scale. In March 2026, the Iran-linked group Handala attacked Stryker, a Fortune 500 manufacturer of medical technologies used in hospitals worldwide. The attackers reportedly wiped more than tens of thousands of devices across the company’s global network, disrupting operations in 79 countries. Thousands of employees were impacted as manufacturing, order processing, and logistics slowed dramatically. Events like this reflect a new reality: cybersecurity incidents are increasingly tied to geopolitical conflict. But despite the headlines, destructive cyber campaigns follow predictable operational patterns. When defenders understand those patterns, they can limit the damage—even when attackers successfully breach the perimeter. How Iranian wiper attacks typically unfold Threat intelligence research into the Handala / Void Manticore cluster shows that many Iranian destructive campaigns rely heavily on manual operations rather than advanced malware. Attackers typically: Gain initial access through stolen VPN credentials Conduct hands-on activity inside the environment Move laterally using administrative tools Escalate privileges Deploy multiple wiping mechanisms simultaneously Operators frequently rely on tools already present in enterprise environments, including: RDP PowerShell remoting WMI SMB SSH Because these tools are legitimate administrative utilities, attackers can often move across networks without triggering traditional malware detection systems. Researchers have also observed operators establishing covert access paths using tunneling tools such as NetBird, enabling them to maintain persistent connectivity inside victim environments. In other words, destructive attacks often succeed not because the malware is sophisticated, but because attackers can move freely inside networks once they gain access. Stopping these campaigns therefore requires focusing on containment and internal control—not just perimeter defense. Reactive security can’t keep up with modern attacks - cyber resilience requires limiting lateral movement before damage spreads. Join Zero Networks to learn how automated containment and identity-driven controls can quickly reduce risk and help you prove resilience to auditors, regulators, and the business. Register for the Webinar A five-step containment strategy for CISOs Based on observed tactics in recent campaigns, CISOs can significantly reduce the impact of destructive attacks by implementing several key controls. 1. Stop credential theft from becoming full network access Most destructive campaigns begin with compromised credentials obtained through phishing, credential reuse, or access brokers. In many environments, successful VPN authentication grants broad internal network access. This is exactly what attackers rely on. Organizations should instead implement: Identity-aware access controls rather than flat network connectivity MFA enforced when accessing administrative services, not just during VPN login Continuous visibility into which identities are accessing which systems Even if attackers authenticate successfully, they should not be able to immediately reach administrative services. 2. Prevent lateral movement through administrative ports Iranian operators frequently move laterally using standard administrative protocols already present in the environment. Because these services are often left open for operational convenience, attackers can pivot rapidly between systems. A more resilient model includes: Default-deny policies for administrative ports Access that opens only after verified authentication Real-time visibility into system-to-system connectivity This significantly reduces the number of pathways attackers can exploit. 3. Restrict privileged accounts to the systems they actually manage Many environments still grant administrators broad access across large portions of the network. That convenience creates risk. If attackers compromise a privileged account during an intrusion, they can often reach nearly every system in the environment. Organizations should instead: Segment privileged access based on role and environment Limit administrators to the specific systems they manage Continuously monitor privileged access activity Reducing the scope of administrative access dramatically limits potential blast radius. 4. Detect unauthorized access paths and tunnels Recent threat intelligence reports show Iranian operators using tunneling tools to maintain covert connectivity inside victim networks. These tunnels can bypass traditional perimeter monitoring. Defenders therefore need visibility inside the network, including: Monitoring east-west connectivity Establishing baselines for administrative communication Detecting unusual connection paths or tunneling behavior When abnormal connectivity patterns appear, defenders can intervene before destructive activity begins. 5. Contain destructive activity before it spreads When wiper malware begins executing, attackers often deploy multiple wiping methods simultaneously to maximize damage. At this stage, speed matters. Organizations that survive destructive incidents focus on containment. Key capabilities include: Automated isolation of compromised systems Immediate restriction of administrative access paths Rapid ring-fencing of affected hosts If containment happens quickly enough, the attack may impact only a limited number of systems instead of spreading across the entire environment. The strategic lesson for CISOs Iranian destructive campaigns highlight an uncomfortable truth: attackers do not need sophisticated malware when networks allow unrestricted internal access. The most effective defense is not simply detecting malicious files earlier. It is removing the attacker’s ability to move. Organizations that consistently limit the impact of destructive attacks share three core capabilities: Visibility into who can access what across the environment Control over administrative services and privileged access Automated containment that limits blast radius Attackers may still get inside the network. But if they cannot move, they cannot destroy the environment. And in an era of geopolitical cyber conflict, that capability may determine whether an organization shuts down—or keeps operating. Sponsored and written by Zero Networks.
1 shared
Mar 24, 2026
Related Indicators
6
domainjusticehomeland[.]orgsame storydomainhandala-hack[.]tosame storydomainkarmabelow80[.]orgsame storydomainhandala-redwanted[.]tosame storydomainoutlook[.]comsame storydomainhandala-team[.]tosame story
Connections
3 relationships
Stryker Says Malicious File Found During Probe Into Iran-Linked Attack
Medical technology giant Stryker has shared an update regarding its investigation into the recent Iran-linked cyberattack, revealing that a malicious file used by the attackers has been identified. The Stryker incident came to light on March 11, with the hacker group Handala taking credit for the attack. Handala, widely believed to be a hacktivist persona controlled by Iran’s Ministry of Intelligence and Security (MOIS), claimed to have wiped more than 200,000 devices, forcing Stryker to shut down offices in dozens of countries. Some early reports indicated that Handala used wiper malware in the attack — the group has been known to use such malware — but Stryker said it found no evidence of malware or ransomware being deployed on its systems. The most likely scenario based on the evidence available to date is that the hackers wiped systems by abusing Stryker’s Microsoft Intune instance, which is used to remotely manage desktop and mobile endpoints and applications within the organization. There is some indication that Handala leveraged credentials obtained via infostealer malware to gain access. Stryker said the incident disrupted order processing, manufacturing, and shipping. In a statement issued on Monday, the company said it has made “meaningful progress” in restoring impacted systems. For the first time, the company has also shared some technical information from the investigation into the incident. “Early in our investigation, we believed there was no indication of ransomware or malware,” Stryker said. “Further into the course of our investigation, alongside Palo Alto Networks Unit 42 and other experts, we identified that the threat actor used a malicious file to run commands which allowed them to hide their activity while in our systems.” It added, “To be clear, this file was not capable of spreading — either inside or outside of our environment. Most importantly, at no point has our investigation identified malicious activity directed towards our customers, suppliers, vendors or partners.” Based on this brief description, the malicious file mentioned by Stryker may have been a small custom binary or script rather than actual malware. However, this shows that the hackers deployed their own tools on the compromised systems and did not rely solely on existing software to carry out their activities. In addition to sharing updates on its investigation and restoration efforts, Stryker has made public an assessment from Palo Alto Networks to show that the incident has been contained. The US government has officially linked Handala to Iran’s MOIS and has taken down several websites used by the threat actor. In addition, the FBI has issued an alert sharing information about attacks allegedly carried out by MOIS threat actors such as Handala, including the malware they use. “FBI obtained malware samples through investigations. The samples were categorized as masquerading malware (stage 1), persistent implant (stage 2), and related stage 2 malware that contained additional or unique functions. Stage 1 usually masqueraded as commonly used applications like Pictory, KeePass, and Telegram and contained the binaries for the next stage of malware. The persistent implant malware spawned following the masquerading malware’s execution and possible user interaction with the malicious application. At this stage, the Iran MOIS cyber actors configured a command and control (C2) using a Telegram bot, allowing bidirectional communication between the compromised device and api.telegram[.]org. FBI considered the masquerading malware and persistent implant to be core functionality for the malware campaign.” Stryker has confirmed that it is working with US government agencies in its investigation of the incident, but the malware described in the FBI alert is unlikely to be related to the attack on the medtech company if indeed no malware was involved. Related: Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability Related: Tycoon 2FA Fully Operational Despite Law Enforcement Takedown
securityweek.comMar 24, 2026extracted
FBI warns of Russian, Iranian cyber activity involving messaging platforms
FBI warns of Russian, Iranian cyber activity involving messaging platforms The FBI warned Friday in two separate notices about Russian and Iranian cyber campaigns involving messaging platforms. Russia’s intelligence services are allegedly targeting commercial applications like Signal, compromising the accounts of current and former U.S. government officials, military personnel, political figures and journalists. The FBI, alongside the Cybersecurity and Infrastructure Security Agency (CISA), said the global campaign “has resulted in unauthorized access” to thousands of accounts of accounts. Russian actors are sending phishing messages made to look like automated support notices. The messages are designed to make victims think they need to take an action like clicking a link or providing verification codes and account PINs. “If the user performs any of the requested actions, they unwittingly provide the actors with unauthorized access to their account either by adding the attacker's device as a linked device or through a full account takeover. As the campaign evolves, actors may use additional techniques, such as malware to infect the victim,” the agencies said. “After compromising an account, malicious actors can view the victims' messages and contact lists, send messages, and conduct additional phishing against other [messaging] accounts.” While the notice focuses on Signal accounts, the FBI said it could apply to any messaging app. They urged people to be wary of unverified messages and “strengthen personal cybersecurity.” The advisory reiterates that there is no vulnerability with Signal or other messaging apps and the campaign is specifically designed to get around encryption by compromising the users themselves. During congressional testimony last year, Director of National Intelligence Tulsi Gabbard highlighted guidance released last year by CISA following the breach of U.S. telecom networks by Chinese hackers that urged “highly targeted individuals” to use “end-to-end encrypted communications.” She noted Signal comes pre-installed on federal government devices. In December, President Donald Trump signed a Pentagon policy bill that requires the Defense secretary to ensure DOD senior leaders are provided mobile phones with “enhanced cybersecurity protections,” including data encryption. The Pentagon’s inspector general previously issued a report that found Defense Secretary Pete Hegseth broke existing department rules for handling sensitive information and potentially put troops in danger when he used Signal to discuss the then-pending U.S. military strike in Yemen. After President Donald Trump took office last year, The Atlantic released a full transcript of a Signal conversation among Cabinet-level officials ahead of a strike on the Houthi armed group in Yemen after a journalist was mistakenly added. The chat members spoke openly about strike timings and kinds of aircraft used. Another watchdog report concluded the Defense Department lacks a secure messaging platform that could help coordinate sensitive operations. Handala Hack The FBI released another flash alert on Friday detailing how Iran’s Ministry of Intelligence and Security (MOIS) is using the messaging platform Telegram as infrastructure to communicate with malware used to infect the devices of Iranian dissidents, journalists and others. The malware allows MOIS to steal information and monitor those being targeted. The threat actors made the malware look like commonly used programs or services on Windows machines. Infected devices are connected to bots on Telegram “that enabled remote user access to exfiltrate screen captures or files from the victim devices.” The FBI tied the use of Telegram directly to the alleged Iranian group known as Handala Hack, which recently took credit for an attack on medical device company Stryker. The agnecy said the malware was in some cases initially made to look like AI video generator Pictory, password manager KeePass, or Telegram before it was opened and connected to a government-controlled Telegram bot, which allowed “bidirectional communication between the compromised device and api.telegram[.]org.” At least one victim was contacted through social media messaging apps, with the hackers pretending to be part of technical support for the app. The Iranian cyber actors “then convinced the victim to accept a file transfer consisting of the masquerading stage 1 malware.” Additional malware was downloaded once initial access was established on the victim’s system. The malware allowed for screen and audio recordings, cache captures, file compression, file deletion and more. “Based on multiple observations, stage 1 of the malware appeared to be tailored to the victim’s pattern of life to increase likelihood of victim downloading the malware, which indicates the Iranian cyber actors likely performed target reconnaissance prior to engaging with the victim,” the advisory said. Several experts said the use of Telegram as a key link in a compromise is a growing trend among cybercriminals and statebacked actors who use it as command-and-control infrastructure. Ensar Seker, CISO at SOCRadar, said Telegram allows threat actors to blend malicious traffic into trusted, encrypted platforms. “By leveraging a widely used application like Telegram, groups such as Handala significantly reduce the likelihood of detection, because security controls are often tuned to allow this traffic by default,” Seker said. “The bigger implication is that encrypted messaging platforms are becoming dual-use infrastructure for both communication and covert operations. Security teams need to reassess their trust assumptions and implement visibility controls around sanctioned apps, including logging, anomaly detection, and strict access policies.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
therecord.mediaMar 23, 2026extracted
New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer
Unit 42 researchers recently observed a shift in the delivery method in the distribution of DarkCloud Stealer and the obfuscation techniques used to complicate analysis. First seen in early April 2025, these new methods and techniques include an additional infection chain for DarkCloud Stealer. This chain involves obfuscation by ConfuserEx and a final payload written in Visual Basic 6 (VB6). We previously identified a series of attacks linked to the distribution of DarkCloud Stealer. It also leveraged AutoIt to bypass detection systems. We documented these details in DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt. Palo Alto Networks customers are better protected through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. We have observed three slightly different attack chains delivering the same final DarkCloud Stealer payload in recent attacks. Each attack chain starts with a phishing email that contains either a tarball (TAR), Roshal (RAR) or a 7-Zip (7Z) archive. Both the TAR or RAR versions contain a JavaScript (JS) file, while the 7Z version contains a Windows Script File (WSF). The threat actor is at a point in development that, for all infection chain paths, almost every stage is obfuscated or protected. Figure 1 shows an overview of the different infection chains of these recent DarkCloud Stealer campaigns. In the chains initiated by a JS script, executing the script downloads and executes a PowerShell (PS1) file from an open directory server. The PS1 file then drops an executable (EXE) file that is the ConfuserEx-protected version of the final DarkCloud payload. Looking at the JS file here in Figure 2, the script is obfuscated by the tool javascript-obfuscator. Figure 3 below shows the deobfuscated version of the same script. In summary, the script: Uses ActiveXObject('MSXML2.XMLHTTP') object to obtain the next stage PS1 script at hxxp[:]//176.65.142[.]190/BLACKYY/newbag.ps1 Uses ActiveXObject('Scripting.FileSystemObject') object to drop the PS1 file as a random 8-character lowercase name in the C:\Temp folder. Uses ActiveXObject('WScript.Shell') object to run a PowerShell command to execute the PS1 file. Figure 4 illustrates an open directory server hosting many malicious PS1 files. In this case, the kay.ps1 is the next stage PS1 sample that the JS script downloaded and executed. The infection chain initiated by a 7Z archive drops a WSF file. The WSF file mainly consists of a single tag, which contains a tag. The JScript code is again heavily obfuscated, but in a different way than the JS file shown in Figure 2. It also uses ActiveXObject objects to download and execute a PS1 file from the same open directory server. However, the PS1 script associated with this WSF downloader is different. Next, we will focus on the JS-based infection chain that runs the kay.ps1 PowerShell script. This PS1 also has two layers of encryption scheme. Figure 5 shows partial code snippets from the first layer. The snippet uses Invoke-Expression (a PowerShell command that executes a string as if it were a command) to invoke another PowerShell expression that is both Base64-encoded and AES-encrypted. Figure 6 shows a code snippet from the invoked PS1 expression, revealing its core functionality. The code reveals that an EXE file is written to the %tmp% folder with a randomly generated 8-character upper- or lower-case filename. The script then executes the dropped EXE file using the Start-Process command. In the following section, we delve deeper into the analysis of the 32-bit .NET malware sample. This malware sample contains the final DarkCloud executable written in VB6 and wrapped in a layer of ConfuserEx obfuscation. ConfuserEx 2 is an open-source protector for .NET applications. Files protected with ConfuserEx are watermarked with a ConfusedByAttribute attribute. ConfuserEx comes with many features and protections such as: Anti-tampering (method encryption): This protects the application from unauthorized modification. This is accomplished by only decrypting the code of method bodies at runtime. This decryption is performed in the module constructor ( .cctor), which executes before reaching the main entry point. Symbol renaming: This changes class, method and variable names to random, meaningless, non-American Standard Code for Information Interchange (ASCII) printable identifiers. Control flow obfuscation: This alters the code structure with opaque predicates (cf. control flow flattening). Method reference hiding: This is also known as proxy call method obfuscation (this will be later described in more detail). Constant encoding: This encodes constants (e.g., strings using fixed reversible transformations. The malware author applied these protections to the analyzed malware sample. First, we can adapt the AntiTamperKiller code to defeat anti-tampering protection. This transformed the sample's .NET code, as Figure 7 shows. The method body code consists of bogus invalid .NET instructions into the deobfuscated code seen in Figure 8, where the real method body code is now visible. In particular, we extracted the specific parameters of the anti-tampering protection: Key 1: 0xc225d58c Key 2: 0xa2e32024 Key 3: 0xdcc95ec9 Key 4: 0x00000000 Name hash: 0xe0cbeae4 Internal key: 0x3dbb2819 Next, we still have more cleanup work to do on the partially deobfuscated sample. We then applied de4dot-cex (a fork of de4dot, a generic .NET deobfuscator and unpacker, which includes support for ConfuserEx deobfuscation) to the sample, using the -p crx command-line switch. This transforms the .NET sample’s code seen in Figure 8 into the code shown in Figure 9, by renaming the obfuscated symbols and reverting the control flow flattening. Thereafter, proxy call methods can be fixed using the proxy call remover tool. Proxy call method obfuscation is a technique that replaces direct method calls with calls to intermediate (i.e., proxy) methods. These proxy methods often do almost nothing besides forwarding the original call. However, they make control flow more difficult for the analyst to follow, thus hindering the code decompilation process. This reduces code readability and increases the effort required to fully understand the entire program logic. Removing these proxy call methods resulted in the simplified code seen in Figure 10. The Class8.smethod_10 method is revealed as the standard Convert.FromBase64String method. Eventually, the final DarkCloud VB6 payload (which is in Triple Data Encryption Standard (3DES) encrypted form shown in Figure 11) is decrypted and executed. The Base64-encoded key, initialization vector (IV) and ciphertext are stored as strings within the .byte_0 variable in Length-Value format, as shown in Figure 12. The standard Type-Length-Value (TLV) format (TLV) format typically includes a type identifier, but in this case, it’s omitted because all values are strings. For instance, the cryptographic key iA9B1uKFddQdqiLSSuzvD2GhL1o2Jv+v (also shown in Figure 11) is stored as a 32-byte string. The length is specified at offset 60 in little-endian format, with the string value beginning at offset 64. The .byte_0 variable value is initialized in the module constructor ( .cctor), through a series of exclusive OR (XOR) and bitwise (arithmetic bit shift) operations on a hard-coded 100,560-element unsigned integer array. After initialization, other generic .NET methods, each accepting a single integer id as parameter, use this array to index the initialized .byte_0 variable and return a string. Figure 13 shows one such method, .smethod_6. RunPE, or process hollowing, is a process injection technique. Process hollowing works by first creating a fresh instance of a (usually legitimate) process in a suspended state. The process memory is then overwritten with code from another (usually malicious) executable. Subsequently, the process thread resumes at the entry point of the overwritten code, so that the malicious code now runs in the context of the benign process. The ConfuserEx protected process uses process hollowing to inject the final VB6 payload. After decryption, the final VB6 payload named holographies.exe, is injected into a new native Portable Executable (PE) process spawned by the initial ConfuserEx process. The process used for injection is RegAsm.exe, a legitimate utility that comes with the default installed .NET Framework SDK on Windows. The presence of the string DarkCloud within the final VB6 payload (shown in Figure 14) confirms its affiliation with the DarkCloud malware family. Additionally, critical strings within the payload are encrypted using the Rivest Cipher 4 (RC4) stream cipher algorithm, with each ciphertext typically using a unique key. For instance, the ciphertext 58364B6DB1C7D797DFA59186B4 paired with the key sMgSInEGpSAgkfcMSUPDDFCVSTyhowuHorsctkyTMYZh decrypts to the string WScript.Shell. These sensitive strings can be broadly categorized as: Regular expressions Credit card names Registry paths Directory and file paths (including file extensions) Telegram API credentials (used for C2 purposes) Other miscellaneous strings DarkCloud Stealer is typical of an evolution in cyberthreats, leveraging obfuscation techniques and intricate payload structures to evade traditional detection mechanisms. The developers of the malware complicated its analysis by adopting ConfuserEx and a VB6 payload in its infection chain. The shift in delivery methods observed in April 2025 indicates an evolving evasion strategy. This highlights the need for security professionals to adopt proactive, behavior-based approaches to threat detection and mitigation. Palo Alto Networks customers are better protected from the threats discussed above through the following products: The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module. Cortex Cloud customers are better protected from DarkCloud Stealer through the proper placement of Cortex Cloud XDR endpoint agent and serverless agents within a cloud environment. Designed to protect a cloud’s posture and runtime operations against these threats, Cortex Cloud helps detect and prevent the malicious operations or configuration alterations or exploitations discussed within this article. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 00080005045107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. Malware distribution URL hxxp[:]//176.65.142[.]190 C2 URL hxxps[:]//api.telegram[.]org/bot7684022823:AAFw0jHSu-b4qs6N7yC88nUOR8ovPrCdIrs/sendMessage?chat_id=6542615755 DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt – Unit 42, Palo Alto Networks .NET Hooking - Harmonizing Managed Territory – Jiří Vinopal, Check Point Research
unit42.paloaltonetworks.comAug 7, 2025extracted