Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs
Malspam campaign weaponizes business-complaint lures to (TL-2026-2652), also tracked as PureCoder business-complaint lure campaign, is a high-severity malware campaign, first published 2026-09-25. It has no confirmed attribution, affects Microsoft Microsoft Excel (signed binary abused for DLL side-loading), maps to 19 MITRE ATT&CK techniques (T1027.001, T1036.008, T1053.005), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-2652
- Threat ID
- TL-2026-2652
- Also known as
- PureCoder business-complaint lure campaign, PureRAT/PureLogs JP-KR malspam
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-25
- Last reviewed
- 2026-09-25
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, logistics, manufacturing
- Target regions
- japan, south korea, East Asia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Malspam campaign weaponizes business-complaint lures to
Malware and tooling: PureRAT
Active malspam campaign (July-August 2026, ITOCHU Cyber & Intelligence research) targets Japanese and Korean organizations with fake damaged-product, shipping, refund, and exchange complaint emails that redirect victims to fake document-sharing and video-viewing sites and deliver ZIP archives containing PureRAT (remote access trojan) or PureLogs (information stealer). Loaders vary per sample - DLL side-loading via a legitimate Microsoft-signed Excel.exe, double-extension EXEs, bundled Python interpreters, a customized Donut loader, in-memory execution, and one variant that abuses the signed but vulnerable Lenovo driver BootRepair.sys (BYOVD) to terminate security-product processes at kernel level.
How Malspam campaign weaponizes business-complaint lures to works
Between July 14 and July 31, 2026, ITOCHU Cyber & Intelligence Inc. (ITOCHUCI) observed a coordinated malspam campaign delivering the Pure family of malware (PureRAT remote-access trojan and PureLogs information stealer) to organizations, primarily in Japan and South Korea. Nine lure emails were observed, all framed as routine business complaints - delivered product damaged, exchange or refund requested, product unusable due to damage, damage during shipping - from Japanese and Korean display names (e.g., 山本 美桜, 안보경, 鈴木 陽菜) with senders appearing to be support@ addresses. The From domains (azuravenue.com, babiesolutions.com, bagsdar.com, banksgreenanimals.com, baoholaodongbaoanh.com, baoquocgiavn.com, baqtalanaqh.com, bartonaussies.com, bayareakajabe.com) are unrelated to the Reply-To addresses, which point to arbitrary Outlook/Hotmail accounts. A shared email platform links all messages: identical Feedback-ID SenderId (wy495j7p7q6bc), Content-Type boundaries matching the PHP Swift Mailer format (_=_swift_<UNIXTIME>_<HEX>_=_), and sending IPs concentrated in the 103.82.20.0/103.179.188.0-189.0/103.153.74.0-75.0 ranges. Korean-language emails share a distinct Feedback-ID bucket (ee722xtg6x1dc) within the same platform.
Delivery is two-stage. Emails link to landing pages impersonating document-sharing and video-viewing services (sharedocumentsystem.com, shareddocumentdrivehub.com, globaldocumentsharingcenter.com, documentcloudlink.com, customerreviewproduct.com, customersrespondedpositively.com, cloudflare.carriernetworks.top, plus two abused .co.nz hosts drive.careernetwork.co.nz and drbox.august-brokers.co.nz) that claim the file is too large to preview and prompt a ZIP download; the download button POSTs to create.php, which returns a JSON redirect to a ZIP hosted on Pixeldrain at the time of investigation. The pages switch UI language among Vietnamese, English, Chinese, Japanese, and Korean and hide the download button for mobile user agents, and the page source contains Vietnamese-language comments - a possible attribution signal toward a Vietnamese-speaking developer.
PureRAT delivery uses DLL side-loading through a legitimate Microsoft-signed binary: the ZIP contains Full_Unboxing_Process_Inspection_Record_2026_1412621.pdf.exe, a double-extension EXE that is actually a legitimate signed Excel.exe, paired with AppVIsvSubsystems64.dll, a hidden DLL masquerading as a Windows App-V component and padded to ~75 MB with junk overlay data to evade size-limited security tooling and sandboxes. The loader displays a decoy proforma_invoice.pdf, copies itself to %LOCALAPPDATA%\u53g9ujpaxy1\, establishes Startup-folder persistence (u53g9ujpaxy1.lnk), reconstructs shellcode from 175 RCDATA resources located via a CHRD marker, and executes a customized Donut loader modified so decryption targets sit at non-standard offsets (defeating donut-decryptor tooling). A .NET stage loads protobuf-net.dll and PayloadSource.zip from resources, decrypts it with TripleDES-CBC and GZip, and runs it via Assembly.Load. The extracted PureRAT configuration points to C2 tirakian.com on ports 56001/56002/56003 with an embedded certificate (CN=PureRAT Agent) and campaign ID 'bem'. PureRAT's initial beacon reports the security products installed, webcam presence, username/domain, OS version/architecture, idle time, active-window title, executable path, and a screenshot, and it steers data from browsers (Chrome, Brave, Edge, Vivaldi, Epic Privacy Browser, Comodo Dragon, CocCoc), cryptocurrency wallets (Atomic, Bitcoin-Qt, Dash-Qt, Electrum, Ethereum keystore, Exodus, Jaxx, Litecoin-Qt, Zcash), and messaging apps (Telegram Desktop, Foxmail).
PureLogs infection chains use four distinct loader variants to spread identical payloads across different hash-detection surfaces. Type 1 bundles a Python interpreter: the side-loaded DLL decrypts an RC4-encrypted PDF decoy, extracts an encrypted RAR to C:\Users\Public\WindowsUpdate, and runs Python, which XOR-decrypts instruction.pdf and launches a .NET PureLogs downloader. Type 2-1 uses a Donut loader fed by a rolling-XOR-encrypted funtsub.dat, with triple persistence - a WindowsFontCacheRestore scheduled task running a VBS via wscript.exe, Startup LNK/BAT shortcuts to the same VBS, and an HKCU Run key invoking regsvr32.exe /s on the DLL. Type 2-2 combines AMSI/ETW disabling with a rundll32.exe APIExportForDetours cross-process transfer, reads propsys_1f520a24.cache, XORs it with 0x85, extracts a bundled Python interpreter with tar.exe, and runs a scheduled task every minute that XORs trump.bin with 0xAA and executes it in memory. Type 3 performs process hollowing and Bring-Your-Own-Vulnerable-Driver (BYOVD): the uxtheme.dll loader executes XOR-encoded shellcode via process hollowing, drops the Lenovo-signed but vulnerable driver BootRepair.sys to C:\Users\Public\moimoi.sys, creates and starts a kernel service via 'sc create moimoi ... type= kernel', then sends security-product process PIDs to the driver over IOCTL 0x222014, which calls ZwTerminateProcess at SYSTEM privilege to kill EDR/AV processes. PureLogs then phones home to C2 domains (logs.uvexio.com, tea.vexexo.com, trump2.1368.lol, bdp.edu.vn, pure26.myftp.org) over HTTP endpoints (/ping, /plugin, /userinfo, /browser, /discord, /filesearch/req, /finish), tunneling data as 16-byte IV prepended to AES-256-CBC-encrypted GZip payloads.
The Pure family is a malware-as-a-service ecosystem sold by the operator 'PureCoder' (marketplace + Telegram support, ~$99/month to $499 lifetime, first offered 2022), and prior PureLogs/PureRAT campaigns have been tracked publicly (Check Point's 'Under the Pure Curtain', Securonix 'SERPENTINE#CLOUD', June 2025) with Vietnam-linked C2 infrastructure - consistent with the Vietnamese-language signals in this campaign. Notably, the same Microsoft-signed Excel.exe and the same PureLogs payloads were delivered through structurally different loaders, defeating hash-only detection; defenders should combine email-header analysis (sender/Reply-To mismatch, shared Feedback-ID, Swift Mailer fingerprints), endpoint behavior monitoring (DLL side-loading, AMSI/ETW disablement, kernel-driver service creation, IOCTL-driven process termination, VBS/Python execution), and infrastructure blocking of the published IOCs.
MITRE ATT&CK techniques used in TL-2026-2652
Defense Evasion
T1027.001 Binary Padding; T1036.008 Masquerade File Type; T1055.012 Process Hollowing; T1497.001 System Checks
Persistence
T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification
Execution
T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
Discovery
T1082 System Information Discovery; T1518.001 Security Software Discovery
Collection
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
stealth
defense-impairment
Affected products and versions in Malspam campaign weaponizes business-complaint lures to
- Microsoft — Microsoft Excel (signed binary abused for DLL side-loading)
Fixed in: Not a product vulnerability - signed binary abuse - Lenovo — BootRepair.sys utility driver (BYOVD target)
Vulnerable versions: Signed versions of the BootRepair utility driver
Fixed in: Remove/blocklist; no user-facing patch
Remediation for Malspam campaign weaponizes business-complaint lures to
Patches
- No vendor CVE applies to this campaign; primary remediation is driver blocklisting and signature/behavior coverage of PureRAT and PureLogs
- Remove or blocklist the obsolete Lenovo-signed BootRepair utility driver used in the BYOVD stage per device-hygiene guidance for signed vulnerable drivers
Immediate actions
- Block the published lure domains, C2 domains, and 103.82.20.0-103.82.20.60 / 103.179.188.0-103.179.189.169 / 103.153.74.0-103.153.75.0 sending ranges at perimeter, DNS, and email gateways
- Quarantine emails whose Reply-To differs from the visible sender domain, share Feedback-ID SenderId wy495j7p7q6bc, or carry Swift Mailer _=_swift_ boundary fingerprints
- Hunt for AppVIsvSubsystems64.dll / AppVIsvSubsystems32.dll side-loading events, startup shortcuts written under the Startup folder, and %LOCALAPPDATA% cache-like directories
- Alert on creation of kernel driver services (sc create ... type= kernel), new services named moimoi, and IOCTL-driven process termination events
- Block execution of double-extension (.pdf.exe) attachments/archives and files downloaded via Mark-of-the-Web from document-sharing lookalike domains
Workarounds
- Verify unexpected damaged-product, refund, or exchange requests via a separate trusted channel (phone, official portal)
- Disable or prompt on execution of files with double extensions and of archives prompting 'too large to preview' downloads from unknown sharing sites
- Restrict execution of wscript.exe, regsvr32.exe, and Python interpreters via software restriction / WDAC for standard users
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing, DONUT-style in-memory shellcode, AMSI/ETW disablement, and unusual wscript.exe/regsvr32.exe/rundll32.exe usage
- Apply and maintain a Microsoft Vulnerable Driver Blocklist / WDAC policy covering BootRepair.sys (SHA-256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946)
- Enforce application control restricting bundled Python interpreters, wscript, and regsvr32 for non-administrative users
- Educate customer-facing staff (e-commerce, retail, logistics) to verify refund/exchange/shipping complaints through trusted channels rather than email links
Timeline of Malspam campaign weaponizes business-complaint lures to
- First Japanese malspam observed (damaged-product complaint from display name 山本 美桜, sender support@azuravenue.com); Swift Mailer boundary timestamp 2026-07-14 03:37:51 UTC
- Second Japanese email (exchange/refund request) sent 03:05:34 UTC from support@babiesolutions.com via the shared sending platform (Feedback-ID SenderId wy495j7p7q6bc)
- First Korean-language email observed (product unusable due to damage, display name 안보경); Korean lanes share a distinct Feedback-ID bucket (ee722xtg6x1dc)
- Korean shipping-damage complaint email; lure pages serve multilingual (Vietnamese/English/Chinese/Japanese/Korean) UI with Vietnamese-language source comments
- Three emails in a single day (Japanese and Korean) as operators rotate loader implementations (Python, Donut, in-memory, BYOVD variants) against hash-based detection
- Refund-consideration email (Japanese, display name 佐藤 結衣, sender support@bartonaussies.com)
- Final observed wave of the July campaign (damaged-product check, display name 吉田 遥, sender support@bayareakajabe.com); ITOCHUCI observed the campaign through July-August 2026
- ITOCHU Cyber & Intelligence closes its July-August observation window with the campaign still active; same PureLogs payload delivered via four different loader families
- ITOCHU Cyber & Intelligence Inc. publishes full Japanese-language technical analysis with lure emails, loader internals, extraction results, and IOCs (blog.itochuci.co.jp)
- English-language ITOCHUCI report (blog-en.itochuci.co.jp) and Cyber Security News coverage ('Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines') publish
Sources cited for Malspam campaign weaponizes business-complaint lures to
- PureRAT・PureLogsを用いて日本の組織を標的とする攻撃キャンペーンの分析 (Japanese analysis)
- ITOCHU Cyber & Intelligence: PureRAT/PureLogs campaign analysis (English)
- Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines
- Cyble: Pure_Coder Offers Multiple Malware For Sale In Darkweb Forums
- Flashpoint: PureLogs - Low-Cost Infostealer, High-Impact Threat
- Huntress: PureRAT Threat Actor Evolution
- BleepingComputer: From infostealer to full RAT - dissecting the PureRAT attack chain
- Derp Research: PureLogs / PureRAT analysis (PXA-linked infrastructure)
- MITRE ATT&CK: T1068 Exploitation for Privilege Escalation (BYOVD mapping)
More in malware
- Deceptive Android Apps Exploit Google Play Early Access to Reach Mobile Users
- Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD)
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via FrameworkBase.dll Tampering
- Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers
- TokenGrabber: Python-based MaaS Infostealer Builder
Detection coverage for TL-2026-2652
As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2652 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2652
8 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.