Threat reportMalwareTL-2026-4435
Overlord RAT and Lampion Campaigns Use PowerShell and Windows Error Reporting Impersonation to Hide Malware (Brazil, Portugal)
Overlord RAT and Lampion Campaigns Use PowerShell and (TL-2026-4435) is a high-severity malware campaign, first published 2026-10-26. It has no confirmed attribution, affects Microsoft Windows (endpoints, abused components: Windows Error, maps to 18 MITRE ATT&CK techniques (T1027.010, T1036.004, T1036.005), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4435
- Threat ID
- TL-2026-4435
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, legal, government administration, general-business
- Target regions
- brazil, portugal
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Overlord RAT and Lampion Campaigns Use PowerShell and
Malware and tooling: Overlord RAT, lampion
How Overlord RAT and Lampion Campaigns Use PowerShell and works
Three VBScript-led malware campaigns documented by WatchGuard Red Cell target Brazil and Portugal with Overlord RAT, the Lampion banking trojan, and a Pascal RAT loaded via a malicious newdev.dll. They combine phishing, obfuscated VBS, PowerShell, DLL side-loading and Windows Error Reporting impersonation (WerFault.exe, scheduled tasks, WER directories) to blend in with routine OS activity.
WatchGuard Red Cell researcher Euler Neto (published 2026-10-22) analysed three related campaigns that rely on obfuscated VBScript, cloud-hosted payloads and legitimate Windows or third-party binaries to conceal infection.
Case 1 - Overlord RAT (Brazil): Phishing emails impersonate Brazilian notary/protest offices, using lookalike domains with URLs of the form https://<domain>/visualizar-protesto.pdf/cnpj=<number>. A Chr()-obfuscated VBS (comments in Brazilian Portuguese) downloads either an EXE (Update.exe, copied as WerFault.exe) or an MSI (update.msi, agent.msi, agent777.msi) from Dropbox, a Google Cloud Storage bucket (protesto-att / win777win) or resolvecenprot.com. Payloads are placed in C:\ProgramData\Microsoft\Windows\WER, and MSI variants drop legitimate ngentask.exe or vlc.exe into %APPDATA%\Local\Temp\Adobe for DLL side-loading. Batch scripts (downloader.bat, 7seven7.bat) request elevation or use RunAs, add install directories to Microsoft Defender exclusions, and run heavily obfuscated PowerShell that builds in-memory .NET assemblies via System.Reflection.Emit (resolving CreateThread, VirtualAlloc, WaitForSingleObject dynamically) and executes a Base64-decoded payload of 20MB+ embedded after '::' comment lines. Persistence uses scheduled tasks named WindowsErrorReporting and WindowsErrorReportingHourly that run WerFault.exe, plus the Startup folder. The final 64-bit Go payload checks for VMware/VirtualBox installation paths, downloads werdata.db (Chaskey counter-mode encrypted Donut x64 shellcode), checks config/settings.json and config/server_index.json, and uses the key string OVERLORD-SECURE-LOG. C2 is 191.96.225.125:5173 (primary) and 45.158.8.213:5173 (secondary), both hosted in Brazil. Execution strings reference Brazilian financial institutions (C6Bank, Picpay, Banco Pan, Banco Inter, Banco Original, Caixa Economica Federal, Modalmais).
Case 2 - Lampion (Portugal): Phishing emails carry ZIP attachments named COMPROVATIVO-<month>_<random>_<day>-<month>-2026_<digits>.zip containing an HTML file that links to a VBS (Comprovativo_<month>_<day>-<month>-2026-<random>.vbs) hosted on AWS S3 or Google Drive. The VBS is inflated to about 5MB of junk code around roughly 5KB of logic and uses the pivot string 'user7' for string deobfuscation. Capabilities include victim fingerprinting, AV product discovery, scheduled-task persistence and a final DLL acting as a RAT with data exfiltration. Acronis TRU reported 94.6% of detections of a related Lampion operation were in Portugal.
Case 3 - newdev.dll (Portugal): A Portuguese-language page titled 'Download Seguro - Factura' uses a fake CAPTCHA to deliver an ISO containing Arquivo.vbs (about 50KB, byte-wise custom decoding, FileSystemObject/WScript.Shell), VMware's legitimate vnetlib.exe, a malicious newdev.dll and a .def file. vnetlib.exe side-loads newdev.dll, whose export FEpibGGkiLSEccb0hUxnWWcBswPWJP XOR-decrypts a hidden 64-bit Free Pascal DLL from the .data section exposing RunAgent. RunAgent creates a single-instance mutex, calls SetProcessDpiAwarenessContext for full-resolution screenshots, sets HKCU Run persistence pointing to vnetlib.exe, generates a bot ID with CryptGenRandom and beacons to 148.224.62.243:7777 (retry every 3 seconds). Commands cover remote mouse/keyboard (0x04), PowerShell/CMD execution (0x05), file writes (0x09/0x0A), screen streaming (0x0C), hidden interactive shell (0x0D/0x0F/0x12), process kill (0x14) and uninstall with evidence removal (0x15).
The recurring number 7 (user7, win777win, 777.sgn, agent777.msi, 7seven7.bat, port 7777) and Brazil-hosted infrastructure suggest possible shared operators, but WatchGuard does not name an actor and no CVE is involved. Severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-4435
Defense Evasion
T1027.010 Command Obfuscation; T1036.004 Masquerade Task or Service; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1574.001 DLL; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Collection
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
defense-impairment
Affected products and versions in Overlord RAT and Lampion Campaigns Use PowerShell and
- Microsoft — Windows (endpoints, abused components: Windows Error Reporting, Task Scheduler, Defender, PowerShell, .NET ngentask.exe)
Remediation for Overlord RAT and Lampion Campaigns Use PowerShell and
Immediate actions
- Block 191.96.225.125, 45.158.8.213 and 148.224.62.243 and the listed phishing domains at the perimeter and DNS
- Hunt for WerFault.exe, CLUpdater.exe or Update.exe outside System32/WinSxS, especially under C:\ProgramData\Microsoft\Windows\WER and %APPDATA%\Roaming\Microsoft\Windows\WER
- Hunt for scheduled tasks named WindowsErrorReporting or WindowsErrorReportingHourly (the genuine Windows Error Reporting tasks live under \Microsoft\Windows\Windows Error Reporting)
- Review Microsoft Defender exclusion changes (Add-MpPreference -ExclusionPath) and remove unauthorized exclusions
- Hunt for vnetlib.exe, ngentask.exe or vlc.exe running from user-writable paths next to unsigned DLLs such as newdev.dll
Workarounds
- Restrict outbound access to Dropbox and storage.googleapis.com from non-business endpoints where feasible
- Use application control (WDAC/AppLocker) to prevent execution from ProgramData and user temp paths
Longer-term hardening
- Block or open-in-Notepad for .vbs/.vbe/.js and mounting of ISO/VHDX files from email and web downloads for standard users
- Enable Defender tamper protection and alert on exclusion changes
- Enable PowerShell Script Block and AMSI logging and alert on System.Reflection.Emit and large Base64 blobs
- Train users on fake notary/protest notices, financial-document lures and fake CAPTCHA pages
Timeline of Overlord RAT and Lampion Campaigns Use PowerShell and
- Bitsight later reports the Lampion spam campaign was active since at least June 2024, using compromised email accounts to send lures.
- Per Bitsight, the Lampion operators shift from direct ZIP links to ZIP email attachments (September 2024).
- Per Bitsight, Lampion delivery adds ClickFix social engineering requiring victims to paste commands into the Windows Run dialog (December 2024).
- Bitsight publishes 'Brazil Love: new tactics of Lampion', documenting a ~700MB bloated Lampion DLL and a VBS that terminates web browsers.
- Acronis Threat Research Unit publishes research on an active Lampion phishing campaign targeting Portuguese users (94.6% of detections in Portugal).
- WatchGuard Red Cell (Euler Neto) publishes analysis of three VBScript-based campaigns: Overlord RAT (Brazil), Lampion (Portugal) and a newdev.dll side-loading RAT (Portugal).
- Hackread reports the Overlord RAT notary-impersonation campaign, listing phishing domains and C2 191.96.225.125 / 45.158.8.213 on port 5173.
- Threadlinqs research phase: BeaconBeagle lookups for 191.96.225.125, 45.158.8.213 and 148.224.62.243 returned HTTP 404 (no beacon records).
- GBHackers publishes coverage highlighting Windows Error Reporting impersonation (WerFault.exe, CLUpdater.exe, scheduled tasks) and the three C2 IPs.
Sources cited for Overlord RAT and Lampion Campaigns Use PowerShell and
- Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs
- WatchGuard Secplicity: How VBScript malware hides behind trusted tools to evade detection (Euler Neto, Red Cell)
- Overlord RAT Uses Fake Legal Notices to Infect Windows PCs (Hackread)
- Acronis Threat Research Unit: Lampion phishing campaign focused on Portugal
- New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader
- Tax-Themed Phishing Delivers Overlord RAT via VHDX Image (Gurucul)
- Bitsight: Brazil Love - New tactics of Lampion
- Overlord RAT Malware Analysis, Overview by ANY.RUN
Detection coverage for TL-2026-4435
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4435 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4435
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.