Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from the F6 cyber-intelligence department have uncovered a new cybercrime cluster they track as Malinsure. The group uses phishing emails themed around voluntary medical insurance (DMS) to deliver a previously unknown backdoor named SafeMostSSH.
The campaign began surfacing in July 2026 when F6 analysts found samples uploaded from Russia to public sandboxes. The samples could not be attributed to any known malware family, prompting the creation of a new cluster designation derived from the insurance-themed lures.
Initial access relies on emails sent from addresses such as mutewinter78@gmail.com. The messages carry PDF attachments titled “ДМС обновления.pdf” or similar that instruct recipients to open a link leading to an RAR archive hosted on domains mimicking legitimate company file-sharing services.
Inside the archives are a renamed legitimate Microsoft executable (winword.exe or powerpnt.exe), a decoy document, and one or two DLLs. Execution triggers DLL Side-Loading of the malicious library, which then uses the LOLbin msiexec.exe with the command “msiexec.exe /Passive /Quiet -z” to invoke DllUnregisterServer and achieve persistence.
SafeMostSSH is a multi-stage backdoor that restores itself from a hidden backup, obtains new C2 addresses by parsing public posts on vc.ru, and establishes a reverse SSH tunnel to attacker infrastructure. The group has also experimented with HTML and SHTML files that embed base64- or hex-encoded payloads to drop the same archive components.
Observed lures reference Russian insurance firms, financial institutions, and fuel-energy companies. Infrastructure elements such as gosuslugi.email and minfin.support suggest a broad targeting scope within Russia.
Related articles
Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts
Users of Chromium-based browsers including Chrome, Brave, and Opera have encountered persistent pop-up windows demanding immediate browser updates. These alerts originate from compromised extensions that dynamically load malicious VBS scripts or EXE files instead of delivering legitimate updates. The deceptive messages appear during normal browsing and instruct users to download and manually execute suspicious files. Earlier incidents were traced to the QuickLens extension, while current reports implicate Enable Right Click & Copy Smart Unlock + OCR and similar utilities still available in the Chrome Web Store. Attackers achieve persistence by purchasing popular extensions or hijacking developer accounts to push malicious updates. Full system scans often fail to detect the threat because the browser itself remains clean until the user triggers the payload. Security experts recommend verifying updates exclusively through the browser's built-in menu rather than clicking any on-screen prompts.
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Researchers at Palo Alto Networks Unit 42 have identified Kimwolf v7, an updated botnet that compromises Android set-top boxes and other IoT devices to conduct DDoS attacks. The malware now employs HTTP/2 flooding with realistic browser fingerprints to blend malicious traffic with legitimate user activity. Command-and-control infrastructure is hardened through Ethereum Name Service lookups and public Ethereum RPC services, with a Tor fallback address embedded in the binary. Operators have removed scanning, exploitation, and brute-force capabilities from this version, indicating a division of labor where a separate loader handles initial infection. The botnet uses 15 numbered methods focused on high-performance UDP floods optimized for ARM processors. Infections typically occur through residential proxies targeting devices with open Android Debug Bridge on port 5555, after which the malware masquerades as system processes. Unit 42 advises treating Android set-top boxes as untrusted devices and disabling ADB or restricting it to USB access only.
Google Play Apps Hide Anatsa Banking Trojan Using Stealthy Loaders
Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage, with one identified case involving a modified PDF reader that displays a fake update prompt to trick users into installing an additional component. Another loader discovered in the Cleanova application collects data from analytics SDKs, including installation source details, and forwards this information to a command-and-control server. The server then decides whether to deliver the malicious payload based on predefined criteria, leaving the code inactive for non-targeted victims to evade automated analysis. Once Anatsa is installed, the threat can facilitate theft of credentials used for financial services and enable fraudulent transactions. Banking trojans represented 30.77 percent of detected malicious mobile applications in the second quarter of 2026, during which more than 1.99 million attacks involving malware, adware, or unwanted programs were blocked and 93,574 banking trojan installation packages were identified.
Android Banking Trojans Hide in Droppers to Bypass Google Play Checks
Kaspersky solutions blocked 1.99 million attacks involving Android malware, adware and potentially unwanted programs in the second quarter of 2026, down from 2.68 million the previous quarter. Researchers still recorded 304,000 malicious installation packages, among them 93,600 banking trojans that retained the largest share at 30.77 percent. Operators increasingly rely on droppers that pass initial store review and later download the real payload. One PDF reader application distributed through Google Play displayed a fake update prompt that installed the Anatsa banking trojan. The Cleanova dropper collected installation-source data and delivered its payload only under attacker-chosen conditions, avoiding analysis environments. The share of users hit by Trojan-Dropper.AndroidOS.Banker.dd rose sharply from 0.01 percent to 2.16 percent, while the Mamont and Creduz families continued to expand with new variants.