# Larva-24009 (aka HeptaX) Spear-Phishing Campaign Deploys QuasarRAT, UltraVNC and Updated Notifier Backdoor

> ASEC reports continued activity by Larva-24009 (aka HeptaX per Cyble), a threat group active since at least 2023 that uses LNK-based spear phishing to deploy a PowerShell backdoor, the updated Notifier v2.1 malware (now reporting infection status via the Telegram Bot API), QuasarRAT, and an UltraVNC Server for remote control, alongside NirSoft credential-recovery tools and a custom keylogger. The actor also creates a hidden backdoor account named "_BootUEFI_" and persists via disguised Task Scheduler entries.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1833
- **ID:** TL-2026-1833
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Larva-24009
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Larva-24009, tracked independently by Cyble as "HeptaX" since a October 2024 report on unauthorized RDP-access tradecraft, has been active since at least 2023 running spear-phishing campaigns against a broad, non-specialized set of enterprise victims (healthcare, blockchain, finance, music/content creation) primarily in and around Korea but with global reach. On 2026-08-03 ASEC published a follow-up report documenting the group's continued and evolved operations.

The infection chain begins with a phishing email carrying a decoy LNK file disguised as a business document (hospital surveys, blockchain proposals, project proposals, resumes) — for example `NovaCX_Agency_Updated_2026047_091100_version_1_8.Docx.Lnk`. Execution of the LNK triggers an obfuscated PowerShell command that drops decoy files into `%TEMP%` while downloading further staged PowerShell scripts from the actor's C2 (`217.77.6.50`, endpoints under `/Res/`). These scripts install a custom PowerShell backdoor capable of screenshot capture and disabling Windows Defender, and deploy the updated Notifier malware (v2.1), which now reports infection status to the operators over the Telegram Bot API rather than only to the actor's own PHP-based C2 panel — a defense-evasion improvement that blends exfiltration traffic with legitimate, hard-to-block Telegram infrastructure.

For hands-on-keyboard access the actor installs QuasarRAT (an open-source, actively-maintained .NET RAT the group has used as its primary commodity RAT since at least 2024, having previously relied on njRAT) and an UltraVNC Server listening on the standard VNC ports 5800/5900, giving redundant remote-control channels. A batch script creates a hidden local backdoor account named "_BootUEFI_" (styled to blend in with UEFI/firmware-related system processes) for persistent, unauthorized access; the group's related HeptaX tradecraft (per Cyble, October 2024) additionally lowers Terminal Services authentication requirements to simplify unauthorized RDP logons and has been observed using the very similar account name "__BootUEFI__" with a static password, indicating a durable, reused TTP across campaign waves rather than a one-off artifact. Persistence for the PowerShell/Notifier components is established via Task Scheduler entries disguised as legitimate system tasks ("Intel(R) Ethernet3 Connection 1219-LM", "GoogleUpdateTaskMachineCoreUA2{...}", "GoogleUpdateTaskMachineCoreUA6{...}").

Credential and browsing-history harvesting is performed with a suite of legitimate NirSoft utilities (ChromePassView, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) — a dual-use-tool pattern also documented in other financially- and espionage-motivated intrusions — plus a custom keylogger that writes captured keystrokes to `%ALLUSERSPROFILE%\Microsoft\OneDrive\log.Log` / `logv.Log`, a path chosen to masquerade as legitimate OneDrive telemetry. No CVE or software vulnerability is involved; the entire chain relies on social engineering (LNK execution) and living-off-the-land/dual-use tooling rather than exploitation.

Infrastructure pivoting against ASEC's prior October 2024 Larva-24009 report and Cyble's HeptaX report shows the group reusing infrastructure patterns (disposable `.shop`/`.site`/`.online` C2 domains, PHP-based C2 panels under `/Res/` or `/up/`) across at least two documented campaign waves (October 2024 and August 2026), with decoy-file embedded timestamps (e.g. `NovaCX_Interview_QA+Updated_20260420_162448_version_4_4.Docx.Lnk`) suggesting an intermediate wave in April 2026. A BeaconBeagle correlation check against the current C2 IP (`217.77.6.50`) and domains (`mainsec.site`, `aonexa.shop`) returned no existing indexed C2 configuration matches, consistent with newly-provisioned, campaign-specific infrastructure rather than long-lived shared C2.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1136.001 Local Account
- T1098 Account Manipulation
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1564.001 Hidden Files and Directories
- T1564.003 Hidden Window
- T1112 Modify Registry
- T1036 Masquerading
- T1553.002 Code Signing
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1010 Application Window Discovery
- T1614 System Location Discovery
- T1021.001 Remote Desktop Protocol
- T1056.001 Keylogging
- T1113 Screen Capture
- T1005 Data from Local System
- T1125 Video Capture
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1573.001 Symmetric Cryptography
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1090 Proxy
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel

## Sources

- [Larva-24009 Threat Group Attack Campaign (Notifier v2.1, QuasarRAT, UltraVNC)](https://asec.ahnlab.com/en/94786/)
- [Larva-24009 Threat Actor's Spear Phishing Attack Case Report](https://asec.ahnlab.com/en/85212/)
- [HeptaX: Unauthorized RDP Connections In Cyberespionage](https://cyble.com/blog/heptax-unauthorized-rdp-connections-for-cyberespionage-operations/)
- [HeptaX Cyberattack Leads To Unauthorized RDP Access Risks](https://thecyberexpress.com/heptax-cyberattack/)
- [2024-10-25 HeptaX - Unauthorized RDP Connections - Malicious LNK > PowerShell > BAT Samples](https://contagiodump.blogspot.com/2024/10/2024-10-25-heptax-unauthorized-rdp.html)
- [QuasarRAT, Software S0262](https://attack.mitre.org/software/S0262/)
- [New Malware Campaign Using 7z & UltraVNC Tool To Deploy Malware](https://cybersecuritynews.com/new-malware-campaign-using-7z-ultravnc-tool/)
- [WebBrowserPassView - Recover Lost Passwords Stored in Your Web Browser](https://www.nirsoft.net/utils/web_browser_password.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1833