Buhtrap RAT Resurfaces in New Campaign Targeting Russian Accountants via Search Ads
Specialists from F6 have uncovered a new campaign distributing the Buhtrap RAT remote access trojan. The attackers continue their established tactic of targeting accountants and lawyers with counterfeit professional websites promoted through paid search engine advertisements.
The latest decoy closely replicates the legitimate resource Glavnaya Kniga Bukhgaltera. Visitors arrive seeking a required document and click the download button, only to receive a ZIP archive instead of a harmless file. JavaScript code on the page intercepts the request and dynamically generates a link to the malicious archive, whose filename incorporates the current date and time.
Inside the archive, victims find an executable such as Obrazets dokumenta pod indeksom 1.exe. Upon execution, Buhtrap RAT establishes persistence on the system and connects to the attackers’ command server. The trojan grants remote control over the compromised machine and is deployed in operations against Russian organizations.
Researchers at F6 noted that the infection chain has seen minimal changes compared with the previous campaign. The main update involves refreshed network infrastructure rather than new techniques. Buhtrap has been active since 2014 both as malware and as the name of the associated criminal group. Following the public release of its source code in 2016, the tool became available to various financially motivated threat actors.
Among the identified decoy domains are glavaudit.org, buhotchet.com, and audit24.org. Security experts recommend that users carefully verify website addresses and refrain from launching executable files that masquerade as documents.
Related articles
Smartphone Spyware: How Devices Collect and Exfiltrate Data Even Without Internet Access
Modern smartphones continue gathering sensor data including microphone, camera, gyroscope, and satellite navigation even when Wi-Fi and mobile data are disabled. Information is stored locally and transmitted only when connectivity is restored. The Find My Device feature from Google and Find My from Apple allow location reporting for hours after the device is powered off via a separate Bluetooth chip. In August 2026, ThreatFabric disclosed the Manic trojan that uses Wi-Fi Direct, Bluetooth RFCOMM, and BLE GATT to relay encrypted data through nearby infected devices when direct internet access is unavailable. The malware supports multi-hop routing of up to four intermediate devices. Everyday users face greater risk from over-privileged applications and pre-installed malware on gray-market devices than from sophisticated offline exfiltration techniques. A detailed checklist covers purchase hygiene, permission audits, and recovery steps after suspected compromise.
Reconstructed Stuxnet Source Code Published on GitHub with Build Instructions
An unknown researcher has released a reconstructed version of the Stuxnet worm source code on GitHub, including reverse-engineering results and assembly instructions. Stuxnet was discovered in 2010 and is widely attributed to the joint US-Israeli Olympic Games operation targeting Iran's Natanz uranium enrichment facility. The malware specifically attacked Siemens industrial controllers by altering frequency converter operations to physically damage centrifuge rotors while falsifying operator displays. Propagation relied on USB drives, network shares, and a Windows Print Spooler vulnerability, combined with stolen Realtek and JMicron driver-signing certificates. The worm also injected itself into Siemens WinCC and Step 7 software to intercept communications with programmable logic controllers. Due to a flaw in its environment checks, Stuxnet escaped the target network and spread publicly before its built-in June 2012 self-destruct date. Researchers are advised to analyze the code only inside fully isolated virtual machines without network access.
Researchers Create 0-Click WeChat Worm That Hijacks Accounts via Incoming Calls
Security researchers at Calif have developed a 0-click worm capable of compromising WeChat accounts through incoming voice calls without any user interaction. The exploit requires only that the attacker already exists in the victim's contact list and works across Android and iOS devices. In demonstrations, an infected Android device called an iPhone to seize control of its WeChat account while the call continued ringing, after which the compromised iPhone targeted another Android device. The worm spreads automatically between trusted contacts, functioning like a classic network worm but using WeChat profiles as propagation nodes. Even if the victim answers or declines the call, the exploit can persist or be retried, for example during nighttime hours. After account takeover, attackers gain full control to read and send messages, make calls, and impersonate the owner, while the underlying smartphone itself remains unaffected. Tencent received notification in July, released patches in versions 8.0.77 for Android and 8.0.76 for iOS, and server-side blocking was confirmed by late August, with no real-world attacks observed so far.
Website Protection Against Bots: Six Years of Traffic Filtering Evolution from Behavioral Bots to Multi-Layer Analytics
The article traces the author's journey starting in 2020 when anomalous traffic from social networks began flooding websites, initially appearing as visits from Twitter, Instagram, YouTube, and VKontakte. Early attempts using .htaccess rules to block referrers failed as bots dynamically switched to direct or external domain transitions. Server-side JavaScript and cookie checks altered bot behavior but did not stop the flow, revealing that successful browser checks only confirm technical capability rather than human presence. IP blocking of ranges like 31.173.80.0/21 and 178.176.64.0/19 provided temporary relief until mobile proxies rotated addresses, exposing the limits of static blacklists. IPv6 adoption further demonstrated how address-family-specific rules quickly become obsolete. Fingerprint spoofing and constant rotation of digital prints made single-signal identification unreliable. The core lesson emphasizes real-time filtering at the edge over post-hoc analytics exclusion to prevent bots from reaching the web server at all.