Malware

MISTPEN

According to Mandiant, MISTPEN is a lightweight backdoor written in C whose main functionality is to download and execute Portable Executable (PE) files. The backdoor is a modification of the open-source Notepad++ binhex plugin v2.0.0.1 where the creation of a thread that executes the malicious code has been added to the DllMain function.

Indicators of Compromise 7

Domain enveil[.]online Domain envell[.]xyz Domain uxtramine[.]org Filename OneScreenCapture64.dll Filename Release_GetInfoPlugin_x64.dll Filename Release_PvPlugin_x64.dll Filename libmupdf.dll

MITRE ATT&CK TTPs 9

T1055
Process Injection
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1085
T1085
 T1090
Proxy
Command And Control
 T1134
Access Token Manipulation
Defense Evasion
 T1203
Exploitation for Client Execution
Execution
 T1218
System Binary Proxy Execution
Defense Evasion
 T1480
Execution Guardrails
Defense Evasion
 T1548
Abuse Elevation Control Mechanism
Privilege Escalation

Source Articles

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
The North Korean threat actor Lazarus Group has exploited a Windows zero-day vulnerability, CVE-2026-68820, in the AFD.sys driver to escalate privileges to SYSTEM and deploy a new in-memory backdoor named Troy. The attack is part of Operation Dream Job, a long-running cyber espionage campaign using fake job offers on LinkedIn to lure victims into downloading trojanized software or opening malicious PDFs. Two infection chains were observed: one using DLL side-loading with the malicious libmupdf.dll and another via a trojanized SecurityPDF viewer that triggers payload execution upon detecting a specific marker in a PDF. The attackers also use compromised legitimate infrastructure, including WordPress, SharePoint, and vulnerable Roundcube servers (CVE-2025-49113), to host C2 communications and distribute the ForestTiger (ScoringMathTea) backdoor.
hacker-news ·3h ago