Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD)
Phishing campaign targeting Japanese/Korean orgs delivering (TL-2026-2647), also tracked as PureRAT/PureLogs unboxing phishing campaign, is a high-severity malware campaign, first published 2026-09-25. It is attributed to PureLogs operator with low confidence, maps to 21 MITRE ATT&CK techniques (T1001, T1005, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-2647
- Threat ID
- TL-2026-2647
- Also known as
- PureRAT/PureLogs unboxing phishing campaign, Product-damage refund phishing campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-25
- Last reviewed
- 2026-09-25
- Attribution
- PureLogs operator
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- manufacturing, logistics, retail, ecommerce, consumer-goods
- Target regions
- japan, south korea, East Asia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Phishing campaign targeting Japanese/Korean orgs delivering
Malware and tooling: Korean, PureLogs, PureRAT, Python, Donut - S0695
Between July and August 2026, a phishing campaign targeted Japanese and Korean organizations with emails disguised as damaged-product complaints/refund requests, directing recipients to fake document-sharing/video-viewing pages that delivered ZIP archives. Final payloads were the PureRAT and PureLogs remote-access trojans, delivered through multiple highly varied loader implementations: signed Excel.exe DLL side-loading, customized Donut loaders, bundled Python interpreters, process hollowing, and a BYOVD attack using a Lenovo-signed BootRepair.sys driver to terminate security products.
How Phishing campaign targeting Japanese/Korean orgs delivering works
From 14 July to 31 July 2026, threat actors sent Japanese- and Korean-language phishing emails masquerading as damaged-product complaints, shipping-damage reports, and exchange/refund requests (nine observed subjects). Email bodies contained links to fake document-sharing and video-viewing sites, such as hxxps://sharedocumentdrivehub[.]com/Full_Unboxing_Process_Inspection_Record_333_2026.docx/views/... and hxxps://documentcloudlink[.]com/Complete_Unboxing_And_Damage_Inspection.mp4/views/... Landing pages localized for Vietnamese, English, Chinese, Japanese, and Korean and used User-Agent detection to hide the download button on mobile devices, suggesting the campaign also targeted other East and Southeast Asian countries. The download request went to a create.php endpoint that redirected to a ZIP hosted on the Pixeldrain file-sharing service.
The campaign's defining characteristic is loader diversity with payload consistency: the payloads (PureRAT and PureLogs) stayed the same while the loaders varied substantially across samples, defeating hash-based detection. The PureRAT chain used a legitimate Microsoft-signed Excel.exe masquerading as Full_Unboxing_Process_Inspection_Record_2026_1412621.pdf.exe (double-extension) that side-loaded an AppVIsvSubsystems64.dll. That DLL created a decoy proforma_invoice.pdf, persisted by copying itself to %LOCALAPPDATA%\u53g9ujpaxy1\ with a Startup-folder .lnk, and executed fragmented shellcode reconstructed from 175 RCDATA resources via a customized Donut loader. A separate .NET loader decrypted a TripleDES-CBC-encrypted PayloadSource.zip in memory and executed it with Assembly.Load. PureRAT beacons to tirakian[.]com on ports 56001-56003 using a self-signed certificate CN=PureRAT Agent and campaign ID 'bem', and steals browser credentials, cryptocurrency wallets, and messenger data.
PureLogs was delivered via four distinct infection-chain types: (1) a Python-interpreter chain that decrypted an RC4 PDF, extracted an encrypted RAR, ran a .NET PureLogs downloader over AES-256-CBC-encrypted HTTP; (2-1) a Donut loader with multiple persistence (scheduled task, startup folder, HKCU Run key); (2-2) an AMSI/ETW-bypass chain using a Python interpreter and Donut loader launched via rundll32 APIExportForDetours; and (3) a process-hollowing chain combined with a BYOVD attack: a Lenovo-signed vulnerable BootRepair.sys was dropped as C:\Users\Public\moimoi.sys, installed as a kernel service via sc create, and driven through IOCTL 0x222014 to call ZwTerminateProcess and forcibly kill security-product processes with SYSTEM privileges. PureLogs exfiltrates browser cookies/profiles, Discord data, and file-search results to C2 over HTTP endpoints (/ping, /plugin, /userinfo, /browser, /discord, /filesearch/req, /finish).
Attribution is unconfirmed. The landing-page source contained Vietnamese-language comments and one C2 domain uses a .vn TLD (bdp[.]edu[.]vn), suggesting possible Vietnamese-speaking operator involvement, but no named threat actor is identified. The Pure malware family (PureRAT, PureLogs, PureHVNC, PureCrypter) is a commercially sold RAT/stealer suite developed by an author known as PureCoder and offered on underground forums; its use by customers across many campaigns means a specific operator attribution is not established. BeaconBeagle queries for the observed C2 domains returned no known C2-config matches at analysis time.
MITRE ATT&CK techniques used in TL-2026-2647
Command and Control
T1001 Data Obfuscation; T1071.001 Application Layer Protocol: Web Protocols
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218.010 System Binary Proxy Execution: Regsvr32; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1574.001 DLL
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
stealth
T1055.012 Process Injection: Process Hollowing
Execution
T1059.003 Windows Command Shell; T1106 Native API; T1204.002 User Execution: Malicious File
Discovery
T1082 System Information Discovery
Credential Access
T1555 Credentials from Password Stores
Initial Access
T1566.002 Phishing: Spearphishing Link
defense-impairment
Remediation for Phishing campaign targeting Japanese/Korean orgs delivering
Immediate actions
- Block the phishing delivery domains and C2 domains at the perimeter (see IOC list).
- Block the nine observed sending source IPs at the mail gateway.
- Hunt for and isolate hosts contacting tirakian[.]com on TCP 56001-56003 or the PureLogs C2 domains.
- Search for the listed SHA-256 hashes across EDR and file stores and quarantine matches.
Workarounds
- Disable AutoRun/startup-execution of unsigned files and enforce Application Control (AppLocker/WDAC).
- Block known-bad domains and restrict outbound C2 traffic to approved proxies.
Longer-term hardening
- Deploy EDR with behavioral detection for DLL side-loading, Donut loaders, process hollowing, and unsigned kernel driver loads.
- Enable driver-signature / vulnerable-driver blocking to prevent BYOVD (BootRepair.sys) abuse.
- Add email gateway rules for Swift Mailer boundary fingerprints and From/Reply-To mismatch patterns.
- Educate staff in Japan/Korea on damaged-product/refund-themed lures and mobile-hiding download pages.
Timeline of Phishing campaign targeting Japanese/Korean orgs delivering
- ZIP archives delivered via Pixeldrain hosted the PureRAT and PureLogs RATs through multiple loader variants (signed Excel.exe DLL side-loading, Donut loaders, Python interpreters, process hollowing, and BYOVD with Lenovo-signed BootRepair.sys).
- Fake document-sharing/video-viewing landing pages and delivery domains observed sending; PureRAT C2 tirakian[.]com and PureLogs C2 infrastructure active.
- Earliest observed phishing email in this wave (Swift Mailer Content-Type boundary timestamp 1784000271 corresponds to 2026-07-14 03:37:51 UTC).
- Last observed phishing email in this wave (2026-07-31); attackers repeatedly changed loader implementations over this short period while keeping the same payloads.
- ITOCHU Cyber & Intelligence publishes the Japanese-language analysis of the PureRAT/PureLogs campaign.
- English-language analysis of the campaign published by ITOCHU Cyber & Intelligence; threat added to the intelligence backlog.
Sources cited for Phishing campaign targeting Japanese/Korean orgs delivering
- ITOCHU Cyber & Intelligence - PureRAT and PureLogs campaign targeting Japanese organizations (EN)
- ITOCHU Cyber & Intelligence - PureRAT / PureLogs campaign (JP)
- Check Point Research - Under the Pure Curtain: From RAT to Builder to Coder
- MITRE ATT&CK - Exploitation for Privilege Escalation (T1068)
- TheWover/donut - Shellcode generator
- volexity/donut-decryptor - Decryptor tooling
- Swift Mailer documentation
More in malware
- Deceptive Android Apps Exploit Google Play Early Access to Reach Mobile Users
- Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via FrameworkBase.dll Tampering
- Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers
- TokenGrabber: Python-based MaaS Infostealer Builder
Detection coverage for TL-2026-2647
As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2647 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2647
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.