Threat reportMalwareTL-2026-1833
Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys QuasarRAT, UltraVNC and Updated Notifier Backdoor
Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys (TL-2026-1833), also tracked as HeptaX Campaign, is a high-severity malware campaign, first published 2026-08-03. It is attributed to Larva-24009 with medium confidence, affects Microsoft Windows, maps to 37 MITRE ATT&CK techniques (T1005, T1010, T1016), and is covered by 9 detection rules and 38 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 37MITRE ATT&CK
- Actors
- 1Larva-24009
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 38Indicators of compromise
Key facts for TL-2026-1833
- Threat ID
- TL-2026-1833
- Also known as
- HeptaX Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Larva-24009
- Attribution confidence
- MEDIUM
- Motivation
- UNKNOWN
- Target sectors
- health, blockchain, finance, music, content-creation, enterprise
- Target regions
- south korea, Global
- Detection rules
- 9
- Indicators of compromise
- 38
Malware and tooling in Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys
Malware and tooling: Notifier, Quasar RAT, ChromePassView, LastActivityView, Network Password Recovery, UltraVNC Server, WebBrowserBookmarksView
How Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys works
ASEC reports continued activity by Larva-24009 (aka HeptaX per Cyble), a threat group active since at least 2023 that uses LNK-based spear phishing to deploy a PowerShell backdoor, the updated Notifier v2.1 malware (now reporting infection status via the Telegram Bot API), QuasarRAT, and an UltraVNC Server for remote control, alongside NirSoft credential-recovery tools and a custom keylogger. The actor also creates a hidden backdoor account named "_BootUEFI_" and persists via disguised Task Scheduler entries.
Larva-24009, tracked independently by Cyble as "HeptaX" since a October 2024 report on unauthorized RDP-access tradecraft, has been active since at least 2023 running spear-phishing campaigns against a broad, non-specialized set of enterprise victims (healthcare, blockchain, finance, music/content creation) primarily in and around Korea but with global reach. On 2026-08-03 ASEC published a follow-up report documenting the group's continued and evolved operations.
The infection chain begins with a phishing email carrying a decoy LNK file disguised as a business document (hospital surveys, blockchain proposals, project proposals, resumes) — for example `NovaCX_Agency_Updated_2026047_091100_version_1_8.Docx.Lnk`. Execution of the LNK triggers an obfuscated PowerShell command that drops decoy files into `%TEMP%` while downloading further staged PowerShell scripts from the actor's C2 (`217.77.6.50`, endpoints under `/Res/`). These scripts install a custom PowerShell backdoor capable of screenshot capture and disabling Windows Defender, and deploy the updated Notifier malware (v2.1), which now reports infection status to the operators over the Telegram Bot API rather than only to the actor's own PHP-based C2 panel — a defense-evasion improvement that blends exfiltration traffic with legitimate, hard-to-block Telegram infrastructure.
For hands-on-keyboard access the actor installs QuasarRAT (an open-source, actively-maintained .NET RAT the group has used as its primary commodity RAT since at least 2024, having previously relied on njRAT) and an UltraVNC Server listening on the standard VNC ports 5800/5900, giving redundant remote-control channels. A batch script creates a hidden local backdoor account named "_BootUEFI_" (styled to blend in with UEFI/firmware-related system processes) for persistent, unauthorized access; the group's related HeptaX tradecraft (per Cyble, October 2024) additionally lowers Terminal Services authentication requirements to simplify unauthorized RDP logons and has been observed using the very similar account name "__BootUEFI__" with a static password, indicating a durable, reused TTP across campaign waves rather than a one-off artifact. Persistence for the PowerShell/Notifier components is established via Task Scheduler entries disguised as legitimate system tasks ("Intel(R) Ethernet3 Connection 1219-LM", "GoogleUpdateTaskMachineCoreUA2{...}", "GoogleUpdateTaskMachineCoreUA6{...}").
Credential and browsing-history harvesting is performed with a suite of legitimate NirSoft utilities (ChromePassView, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) — a dual-use-tool pattern also documented in other financially- and espionage-motivated intrusions — plus a custom keylogger that writes captured keystrokes to `%ALLUSERSPROFILE%\Microsoft\OneDrive\log.Log` / `logv.Log`, a path chosen to masquerade as legitimate OneDrive telemetry. No CVE or software vulnerability is involved; the entire chain relies on social engineering (LNK execution) and living-off-the-land/dual-use tooling rather than exploitation.
Infrastructure pivoting against ASEC's prior October 2024 Larva-24009 report and Cyble's HeptaX report shows the group reusing infrastructure patterns (disposable `.shop`/`.site`/`.online` C2 domains, PHP-based C2 panels under `/Res/` or `/up/`) across at least two documented campaign waves (October 2024 and August 2026), with decoy-file embedded timestamps (e.g. `NovaCX_Interview_QA+Updated_20260420_162448_version_4_4.Docx.Lnk`) suggesting an intermediate wave in April 2026. A BeaconBeagle correlation check against the current C2 IP (`217.77.6.50`) and domains (`mainsec.site`, `aonexa.shop`) returned no existing indexed C2 configuration matches, consistent with newly-provisioned, campaign-specific infrastructure rather than long-lived shared C2.
MITRE ATT&CK techniques used in TL-2026-1833
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture; T1125 Video Capture
Discovery
T1010 Application Window Discovery; T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery; T1614 System Location Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol
Defense Evasion
T1036 Masquerading; T1564.001 Hidden Files and Directories; T1564.003 Hidden Window
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task; T1098 Account Manipulation; T1136.001 Local Account; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1095 Non-Application Layer Protocol; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography
defense-impairment
T1112 Modify Registry; T1553.002 Code Signing; T1685 Disable or Modify Tools
Privilege Escalation
T1548.002 Bypass User Account Control
Credential Access
T1552.001 Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys
- Microsoft — Windows
Vulnerable versions: Any Windows version susceptible to LNK-based social engineering; no software vulnerability is exploited
Remediation for Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys
Immediate actions
- Block the identified C2 domains (aonexa.shop, mainsec.site, final.mainsec2.site, pozeny.shop, serverdock.online) and IP 217.77.6.50 at DNS resolver, firewall, and web proxy layers.
- Audit local Administrators/Users groups on all Windows endpoints for unauthorized accounts named '_BootUEFI_', '__BootUEFI__', or similarly UEFI/firmware-themed and remove them immediately.
- Enumerate Task Scheduler on endpoints for entries disguised as 'Intel(R) Ethernet3 Connection 1219-LM' or 'GoogleUpdateTaskMachineCoreUA*{F84AE75F-E9CE-4FC0-9BC8-998371F0931}' and remove unauthorized tasks.
- Isolate and reimage any host that executed a matching LNK file or shows a matching file hash; rotate all locally-stored browser and Windows credentials on affected hosts.
- Hunt for outbound TCP connections on ports 5800/5900 (UltraVNC) and unexpected api.telegram.org traffic from non-Telegram-approved processes.
Workarounds
- Disable automatic LNK file execution from Outlook/email clients and Windows Explorer preview via Group Policy where operationally feasible.
- Block or tightly monitor outbound traffic to api.telegram.org on hosts/segments where Telegram is not a business-approved application, to disrupt Notifier's Telegram-based status-reporting channel.
Longer-term hardening
- Deploy application allowlisting / attachment execution controls to block LNK file execution from email attachments and extracted archives.
- Enable PowerShell Script Block Logging, Module Logging, and Constrained Language Mode to detect and limit obfuscated PowerShell backdoors.
- Deploy EDR with behavioral detection tuned for QuasarRAT, UltraVNC Server installation/beaconing, and execution of NirSoft credential-recovery utilities (ChromePassView, WebBrowserPassView family, Network Password Recovery, LastActivityView).
- Restrict or closely monitor RDP/VNC exposure; enforce MFA and disable NLA-bypass configuration changes to Terminal Services.
- Baseline and alert on newly-created local/Task Scheduler accounts and tasks outside of approved change-management workflows.
Timeline of Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys
- Larva-24009 assessed by ASEC to have been active since at least 2023, initially targeting global victims with spear-phishing and PowerShell-based malware (exact onset date not disclosed in source reporting).
- ASEC publishes the first detailed case report on Larva-24009's spear-phishing attacks, documenting LNK-triggered PowerShell chains, njRAT/QuasarRAT deployment, UltraVNC installation, and a custom keylogger; confirms Korean victims alongside prior global targeting.
- Cyble Research and Intelligence Labs (CRIL) independently publishes the "HeptaX" report describing a matching multi-stage LNK > PowerShell > BAT infection chain that creates a hidden admin account ("__BootUEFI__") and modifies Terminal Services settings to simplify unauthorized RDP access, indicating shared or closely related tradecraft with Larva-24009.
- Decoy LNK file "NovaCX_Interview_QA+Updated_20260420_162448_version_4_4.Docx.Lnk" carries an embedded build timestamp consistent with an intermediate campaign wave between the October 2024 and August 2026 reporting.
- ASEC publishes the follow-up report on Larva-24009's continued and evolved campaign, disclosing the C2 domains/IP, file hashes, and the Notifier v2.1 / Telegram-API detail.
- A batch script creates the hidden local backdoor account "_BootUEFI_"; persistence for the PowerShell/Notifier components is registered via Task Scheduler entries disguised as "Intel(R) Ethernet3 Connection 1219-LM" and GoogleUpdateTaskMachineCoreUA{F84AE75F-E9CE-4FC0-9BC8-998371F0931} tasks.
- NirSoft utilities (ChromePassView, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) and a custom keylogger writing to %ALLUSERSPROFILE%\Microsoft\OneDrive\log.Log/logv.Log are used to harvest browser credentials, activity history, and keystrokes.
- QuasarRAT and an UltraVNC Server (listening on ports 5800/5900) are deployed to give the operators redundant interactive remote-control channels over the compromised host.
- PowerShell backdoor and the updated Notifier v2.1 malware are installed; Notifier begins reporting infection status via the Telegram Bot API while the PowerShell backdoor disables Windows Defender and enables screenshot capture.
- Victims execute phishing-delivered LNK files disguised as business documents (e.g. "NovaCX_Agency_Updated_2026047_091100_version_1_8.Docx.Lnk"), triggering obfuscated PowerShell that drops decoy files in %TEMP% and retrieves staged scripts from 217.77.6.50.
Sources cited for Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys
- Larva-24009 Threat Group Attack Campaign (Notifier v2.1, QuasarRAT, UltraVNC)
- Larva-24009 Threat Actor's Spear Phishing Attack Case Report
- HeptaX: Unauthorized RDP Connections In Cyberespionage
- HeptaX Cyberattack Leads To Unauthorized RDP Access Risks
- 2024-10-25 HeptaX - Unauthorized RDP Connections - Malicious LNK > PowerShell > BAT Samples
- QuasarRAT, Software S0262
- New Malware Campaign Using 7z & UltraVNC Tool To Deploy Malware
- WebBrowserPassView - Recover Lost Passwords Stored in Your Web Browser
Detection coverage for TL-2026-1833
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1833 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1833
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.