New Malware Campaign Targets Manufacturing and Government Sectors

Scworld

New Malware Campaign Targets Manufacturing and Government Sectors

First seen 22 Dec 2025, 18:58 UTC • •36.9

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A sophisticated malware attack campaign has targeted manufacturing and government organizations in Europe and the Middle East, particularly in Italy, Finland, and Saudi Arabia. The campaign employs obfuscation techniques and a unique User Account Control (UAC) bypass to deploy a commodity loader that delivers Remote Access Trojans (RATs) and information-stealing payloads through various infection vectors, including illicit SVG files and Office files exploiting CVE-2017-11882.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 227d ago How this analysis works

More articles in this cluster (4)

Threat Graph

22 entities, 29 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Malware
Phishing
Steganography
T1047 - Windows Management Instrumentation
T1055.012 - Process Hollowing
T1055 - Process Injection
T1059.001 - PowerShell
T1059.005 - Visual Basic

Vulnerability (1)

CVE-2017-11882

Malware (8)

Async Rat
AsyncRAT
Dcrat
DC Rat
Katz Stealer
PureLog Stealer
Remcos
Remcos RAT

Affected Platform (2)

NET Framework
Windows

Tool (3)

PowerShell
RegAsm.exe
TaskScheduler Library

Relationships

Async Rat exploits CVE-2017-11882
AsyncRAT exploits CVE-2017-11882
Dcrat exploits CVE-2017-11882
DC Rat exploits CVE-2017-11882
Katz Stealer exploits CVE-2017-11882
PureLog Stealer exploits CVE-2017-11882
Remcos exploits CVE-2017-11882
Remcos RAT exploits CVE-2017-11882
PowerShell exploits CVE-2017-11882
RegAsm.exe exploits CVE-2017-11882
TaskScheduler Library exploits CVE-2017-11882
CVE-2017-11882 targets NET Framework
CVE-2017-11882 targets Windows
Malware targets NET Framework
Malware targets Windows
Phishing targets NET Framework
Phishing targets Windows
Steganography targets NET Framework
Steganography targets Windows
T1047 - Windows Management Instrumentation targets NET Framework
T1047 - Windows Management Instrumentation targets Windows
T1055.012 - Process Hollowing targets NET Framework
T1055.012 - Process Hollowing targets Windows
T1055 - Process Injection targets NET Framework
T1055 - Process Injection targets Windows
T1059.001 - PowerShell targets NET Framework
T1059.001 - PowerShell targets Windows
T1059.005 - Visual Basic targets NET Framework
T1059.005 - Visual Basic targets Windows

Following this threat?

Track Async Rat and CVE-2017-11882 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

.NET Vulnerability CVE-2026-111497 Requires Immediate Action On October 25, 2026, Microsoft released out-of-band security updates for.NET addressing CVE-2026-111497, a vulnerability in the Brotli decompression algorithm that allows unauthorized attackers to elevate privileges over a network. The flaw affects.NET versions 8, 9, 10, and 11, particularly in applications that…

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…