{"id":9783,"date":"2026-01-10T10:03:47","date_gmt":"2026-01-10T10:03:47","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/10\/phishing-campaign-uses-maduro-arrest-story-to-deliver-backdoor-malware\/"},"modified":"2026-01-10T10:03:47","modified_gmt":"2026-01-10T10:03:47","slug":"phishing-campaign-uses-maduro-arrest-story-to-deliver-backdoor-malware","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/10\/phishing-campaign-uses-maduro-arrest-story-to-deliver-backdoor-malware\/","title":{"rendered":"Phishing Campaign Uses Maduro Arrest Story to Deliver Backdoor Malware"},"content":{"rendered":"

Phishing Campaign Uses Maduro Arrest Story to Deliver Backdoor Malware
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cybercriminals are leveraging the recent arrest of Venezuelan President Nicol\u00e1s Maduro to distribute sophisticated backdoor malware<\/a>. <\/p>\n

The threat actors exploited news surrounding Maduro\u2019s arrest on January 3, 2025, demonstrating how geopolitical events continue to serve as effective lures for malicious campaigns.<\/p>\n

The attack likely begins with a spear-phishing email containing a zip archive named \u201cUS now deciding what\u2019s next for Venezuela.zip\u201d. <\/p>\n

Inside, victims find an executable file titled \u201cMaduro to be taken to New York.exe\u201d alongside a malicious dynamic-link library called \u201ckugou.dll\u201d. <\/p>\n

\"
\u00a0DLL called with LoadLibraryW<\/figcaption><\/figure>\n

The executable is a legitimate KuGou binary, but has been weaponized via DLL hijacking to load the malicious library, according to Darktrace security researchers<\/a>.<\/p>\n

Malware Behavior<\/strong><\/h2>\n

Once executed, the malware creates a directory at C:ProgramDataTechnology360NB and copies itself, renaming the files. <\/p>\n

\"
\u00a0Folder \u201cTechnology360NB\u201d created<\/figcaption><\/figure>\n

It establishes persistence by adding a registry key at \u201cHKCUSoftwareMicrosoftWindowsCurrentVersionRunLite360\u201d that runs automatically at system startup. <\/p>\n

The malware then displays a dialog box prompting users to restart their computer, which triggers the malicious payload<\/a>.<\/p>\n

\n
\"Message
Message box prompting user to restart<\/figcaption><\/figure>\n<\/div>\n

After the system restarts, the malware initiates regular encrypted <\/a>connections to a command-and-control server at 172.81.60[.]97 on port 443. <\/p>\n

These periodic connections enable the malware to receive instructions and configurations from the attackers.<\/p>\n

The campaign shares similarities with previous operations by Mustang Panda, a Chinese threat group known for exploiting current events such as the Ukraine war, Tibet-related conventions, and Taiwan-related topics. <\/p>\n

However, researchers note that there is insufficient evidence to attribute this activity to any specific group definitively.<\/p>\n

This incident highlights the ongoing threat of geopolitical-themed phishing campaigns<\/a>. <\/p>\n

Organizations and individuals should exercise extreme caution when opening email attachments, especially those referencing breaking news or world events.<\/p>\n

Indicators of Compromise (IoCs)<\/strong><\/p>\n