# Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD)

> Between July and August 2026, a phishing campaign targeted Japanese and Korean organizations with emails disguised as damaged-product complaints/refund requests, directing recipients to fake document-sharing/video-viewing pages that delivered ZIP archives. Final payloads were the PureRAT and PureLogs remote-access trojans, delivered through multiple highly varied loader implementations: signed Excel.exe DLL side-loading, customized Donut loaders, bundled Python interpreters, process hollowing, and a BYOVD attack using a Lenovo-signed BootRepair.sys driver to terminate security products.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2647
- **ID:** TL-2026-2647
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

From 14 July to 31 July 2026, threat actors sent Japanese- and Korean-language phishing emails masquerading as damaged-product complaints, shipping-damage reports, and exchange/refund requests (nine observed subjects). Email bodies contained links to fake document-sharing and video-viewing sites, such as hxxps://sharedocumentdrivehub[.]com/Full_Unboxing_Process_Inspection_Record_333_2026.docx/views/... and hxxps://documentcloudlink[.]com/Complete_Unboxing_And_Damage_Inspection.mp4/views/... Landing pages localized for Vietnamese, English, Chinese, Japanese, and Korean and used User-Agent detection to hide the download button on mobile devices, suggesting the campaign also targeted other East and Southeast Asian countries. The download request went to a create.php endpoint that redirected to a ZIP hosted on the Pixeldrain file-sharing service.

The campaign's defining characteristic is loader diversity with payload consistency: the payloads (PureRAT and PureLogs) stayed the same while the loaders varied substantially across samples, defeating hash-based detection. The PureRAT chain used a legitimate Microsoft-signed Excel.exe masquerading as Full_Unboxing_Process_Inspection_Record_2026_1412621.pdf.exe (double-extension) that side-loaded an AppVIsvSubsystems64.dll. That DLL created a decoy proforma_invoice.pdf, persisted by copying itself to %LOCALAPPDATA%\u53g9ujpaxy1\ with a Startup-folder .lnk, and executed fragmented shellcode reconstructed from 175 RCDATA resources via a customized Donut loader. A separate .NET loader decrypted a TripleDES-CBC-encrypted PayloadSource.zip in memory and executed it with Assembly.Load. PureRAT beacons to tirakian[.]com on ports 56001-56003 using a self-signed certificate CN=PureRAT Agent and campaign ID 'bem', and steals browser credentials, cryptocurrency wallets, and messenger data.

PureLogs was delivered via four distinct infection-chain types: (1) a Python-interpreter chain that decrypted an RC4 PDF, extracted an encrypted RAR, ran a .NET PureLogs downloader over AES-256-CBC-encrypted HTTP; (2-1) a Donut loader with multiple persistence (scheduled task, startup folder, HKCU Run key); (2-2) an AMSI/ETW-bypass chain using a Python interpreter and Donut loader launched via rundll32 APIExportForDetours; and (3) a process-hollowing chain combined with a BYOVD attack: a Lenovo-signed vulnerable BootRepair.sys was dropped as C:\Users\Public\moimoi.sys, installed as a kernel service via sc create, and driven through IOCTL 0x222014 to call ZwTerminateProcess and forcibly kill security-product processes with SYSTEM privileges. PureLogs exfiltrates browser cookies/profiles, Discord data, and file-search results to C2 over HTTP endpoints (/ping, /plugin, /userinfo, /browser, /discord, /filesearch/req, /finish).

Attribution is unconfirmed. The landing-page source contained Vietnamese-language comments and one C2 domain uses a .vn TLD (bdp[.]edu[.]vn), suggesting possible Vietnamese-speaking operator involvement, but no named threat actor is identified. The Pure malware family (PureRAT, PureLogs, PureHVNC, PureCrypter) is a commercially sold RAT/stealer suite developed by an author known as PureCoder and offered on underground forums; its use by customers across many campaigns means a specific operator attribution is not established. BeaconBeagle queries for the observed C2 domains returned no known C2-config matches at analysis time.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1059.003 Windows Command Shell
- T1106 Native API
- T1055.012 Process Injection: Process Hollowing
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1543.003 Create or Modify System Process: Windows Service
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1218.010 System Binary Proxy Execution: Regsvr32
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1001 Data Obfuscation

## Sources

- [ITOCHU Cyber & Intelligence - PureRAT and PureLogs campaign targeting Japanese organizations (EN)](https://blog-en.itochuci.co.jp/entry/2026/09/25/090000)
- [ITOCHU Cyber & Intelligence - PureRAT / PureLogs campaign (JP)](https://blog.itochuci.co.jp/entry/2026/09/04/130000)
- [Check Point Research - Under the Pure Curtain: From RAT to Builder to Coder](https://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/)
- [MITRE ATT&CK - Exploitation for Privilege Escalation (T1068)](https://attack.mitre.org/techniques/T1068/)
- [TheWover/donut - Shellcode generator](https://github.com/thewover/donut)
- [volexity/donut-decryptor - Decryptor tooling](https://github.com/volexity/donut-decryptor)
- [Swift Mailer documentation](https://swiftmailer.symfony.com/docs/introduction.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2647