Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from the F6 cyber-intelligence department have uncovered a new cybercrime cluster they track as Malinsure. The group uses phishing emails themed around voluntary medical insurance (DMS) to deliver a previously unknown backdoor named SafeMostSSH.
The campaign began surfacing in July 2026 when F6 analysts found samples uploaded from Russia to public sandboxes. The samples could not be attributed to any known malware family, prompting the creation of a new cluster designation derived from the insurance-themed lures.
Initial access relies on emails sent from addresses such as mutewinter78@gmail.com. The messages carry PDF attachments titled “ДМС обновления.pdf” or similar that instruct recipients to open a link leading to an RAR archive hosted on domains mimicking legitimate company file-sharing services.
Inside the archives are a renamed legitimate Microsoft executable (winword.exe or powerpnt.exe), a decoy document, and one or two DLLs. Execution triggers DLL Side-Loading of the malicious library, which then uses the LOLbin msiexec.exe with the command “msiexec.exe /Passive /Quiet -z” to invoke DllUnregisterServer and achieve persistence.
SafeMostSSH is a multi-stage backdoor that restores itself from a hidden backup, obtains new C2 addresses by parsing public posts on vc.ru, and establishes a reverse SSH tunnel to attacker infrastructure. The group has also experimented with HTML and SHTML files that embed base64- or hex-encoded payloads to drop the same archive components.
Observed lures reference Russian insurance firms, financial institutions, and fuel-energy companies. Infrastructure elements such as gosuslugi.email and minfin.support suggest a broad targeting scope within Russia.
Related articles
Brazilian Malware BraZetsu Uses AI to Map and Sell Compromised Corporate Networks
Researchers have identified a new Windows malware called BraZetsu developed by the Brazilian actor Exilware. The tool maps compromised corporate networks, identifies high-value systems, and prepares access for sale to other criminals. The operation primarily targets Brazil and other countries in Latin America and the Iberian Peninsula. BraZetsu is written in Python with a modular architecture and maintains WebSocket communication with its command-and-control server. It searches for banking software, ERPs, e-commerce platforms, industrial environments, development tools, backup systems, and security solutions. The malware also looks for Brazilian CNAB financial files, digital certificates, and browser history. Evidence suggests heavy use of generative AI during development, with an AI component on the server that may classify stolen files and prioritize valuable machines.
Callfuscated: Reverse Engineering a Stack-Based VM Protected by MBA, Opaque Predicates and Call-Based Jumps
A detailed technical write-up examines the HackTheBox challenge Callfuscated, which combines virtualization, mixed Boolean-arithmetic expressions, opaque predicates and junk instructions. The author first converts call-pop sequences into direct jumps by proving that register r8 is never read, then removes the resulting NOPs to obtain clean code. The resulting binary reveals a classic stack-based virtual machine whose handlers invoke heavily obfuscated functions. Triton is used to lift these functions into AST form, after which the CoBRA solver simplifies the MBA expressions into the original operations: addition, subtraction, multiplication, XOR, OR and AND. With semantics recovered, the author captures the bytecode at runtime, writes a C translator that emits readable operations, compiles the output and obtains a clean decompiled routine that checks the flag.
Backblaze Responds in Minutes While reg.ru Delays Action on Banking Trojan Infrastructure
A detailed reverse-engineering report reveals a sophisticated Android banking Trojan distributed via Telegram spam that disables antivirus apps, intercepts SMS one-time codes, and exfiltrates banking credentials. The malware uses AES-encrypted assets, a custom binary protocol over sockets, and multiple modules for screen streaming, keylogging, microphone access, and remote control. Infrastructure analysis traced the payload to an S3-compatible bucket on Backblaze, four command-and-control domains, and a VPS, with the domains registered through reg.ru. Notifications sent to Backblaze resulted in account termination within 11 minutes, while reg.ru responded only after a week with a statement refusing action without a court order. The same signing certificate appears across multiple variants, allowing rapid infrastructure rotation that keeps the campaign active despite takedown attempts. Kaspersky and CERT teams were also notified but produced no visible results within the observed period.
SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a passive Windows backdoor that stays dormant in memory until it receives one specially crafted encrypted network packet. Upon activation the implant decrypts and executes custom bytecode written in a proprietary 23-instruction language, eliminating traditional beaconing and reducing network indicators. The malware is delivered as a 64-bit DLL that impersonates dpapi.dll and is loaded via DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous and NullSessionPipes. Configuration is protected with AES-256-CCM and the sample contains no confirmed victims or attributed infrastructure. Researchers have released YARA rules and read-only scanning utilities to detect the implant and its artifacts.