PhantomCore Campaign Compromises 181 Russian Hosts in Cyberespionage Operation

Sep 9, 2025 · Original article ↗

Summary

Researchers detail PhantomCore’s espionage campaign against Russian organizations, reporting 181 compromised hosts, a varied malware toolkit and segmented infrastructure. They also identify evidence suggesting a lower-skilled splinter group.

Key points

The campaign began on May 12, 2025, and compromised 181 hosts at Russian government and critical-sector organizations; researchers reported the group still controlled 49 hosts.
Initial access included malicious ZIP email attachments containing LNK files, as well as a phishing site that used a fake CAPTCHA to trick visitors into running a PowerShell command.
The attackers deployed PhantomRAT and PhantomRShell, then used PhantomTaskShell, MeshAgent, SSH tunnels and other tools for persistence, remote access and control.
PhantomStealer and a commercial password-recovery utility targeted credentials; RClone was used to collect and exfiltrate files to Mega cloud storage.
Researchers mapped segmented command-and-control, payload-staging, proxy and host-aggregation infrastructure, and described the campaign’s attack chain and indicators of compromise.
A separate backdoor, PhantomGoShell, showed development and operational differences from PhantomCore’s main tools; researchers assess it was used by a lower-skilled offshoot, with no evidence of real-world attacks using it.

Article Details

Attack Vectors: Email delivery of ZIP archives, sometimes password-protected, containing LNK files that display a PDF lure while extracting and launching PhantomRAT.
Delivery of backdoors as polyglot files, including through compromised email accounts belonging to legitimate Russian companies.
A phishing site copied the Moscow City Compulsory Medical Insurance Fund website and used a fake CAPTCHA to induce visitors to paste and execute a PowerShell command that downloaded MeshAgent.
Initial backdoors downloaded additional payloads from a compromised website and attacker-operated staging servers.
Scheduled tasks, a background service, remote administration software, and reverse SSH tunnels maintained access to compromised hosts.
PhantomStealer and a commercial password recovery utility collected authentication data; RClone was used to exfiltrate data to an attacker-operated cloud storage account.
Defensive Notes: Use licensed antivirus solutions with regularly refreshed signature databases.
Scan attachments from untrusted or suspicious senders, particularly messages with unusual domains, no prior correspondence, or urgent claims invoking government agencies or regulators.
Scan password-protected archives and embedded files before opening them.
Show file extensions and check actual file types; avoid files with misleading icons or multiple trailing extensions.
Provide regular employee training and exercises on safe email handling and resistance to social engineering.
The researchers used distinctive control-panel routes, favicon characteristics, and shared infrastructure relationships to identify additional servers and feed detections into Positive Technologies products.
The source recommends combining established detection expertise with current threat intelligence.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`agrotech[.]homes`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`austolns[.]pw`	Detected PhantomCore MeshCentral C2 domain.
DOMAIN	`blockchaineech[.]world`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`cybersedcurity[.]world`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`interoperaebility[.]world`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`mgfoms[.]org`	PhantomCore phishing site using a fake CAPTCHA to induce execution of a MeshAgent download command.
DOMAIN	`miucroprocessors[.]world`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`polylab[.]top`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`reconfiguratifon[.]world`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`softline-solutions[.]cloud`	Detected PhantomCore MeshCentral C2 domain themed to resemble legitimate IT infrastructure.
DOMAIN	`techinnovators[.]world`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
DOMAIN	`telecommuunication[.]world`	PhantomCore IT-mimicry domain linked through the registration email used for its infrastructure.
EMAIL	`emilygrace1981@proton[.]me`	Registration email linked to PhantomCore MeshCentral domains and additional IT-mimicry domains.
EMAIL	`iseh34228@proton[.]me`	Email address used to register the PhantomCore phishing domain.
EMAIL	`mariaaa228@proton[.]me`	Registration email for the cloud storage account used by PhantomCore for RClone data exfiltration.
EMAIL	`netu@tuta[.]com`	Email for the PhantomCore account used to purchase the password recovery utility.
HOSTNAME	`nextcloud[.]1cbit[.]dev`	Detected PhantomCore MeshCentral C2 hostname mimicking legitimate IT infrastructure.
HOSTNAME	`nextcloud[.]soft-trust[.]com`	Detected PhantomCore MeshCentral C2 hostname mimicking legitimate IT infrastructure.
HOSTNAME	`nextcloud[.]trust-sec[.]it[.]com`	Detected PhantomCore MeshCentral C2 hostname mimicking legitimate IT infrastructure.
IPV4	`185[.]130[.]249[.]224`	PhantomCore aggregator server collecting information about infected hosts.
IPV4	`185[.]130[.]251[.]219`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`185[.]130[.]251[.]227`	PhantomCore proxy server used as a reverse SSH tunnel endpoint.
IPV4	`185[.]225[.]17[.]104`	Detected PhantomRShell C2 server.
IPV4	`188[.]127[.]254[.]234`	PhantomCore payload staging server distributing credential-theft utilities, MeshAgent, and a collection script.
IPV4	`188[.]127[.]254[.]44`	Detected PhantomRShell C2 server.
IPV4	`193[.]124[.]117[.]89`	C2 server used by all detected PhantomGoShell samples; researchers reported no evidence of its use in real attacks.
IPV4	`193[.]187[.]174[.]251`	PhantomCore proxy server used by RSocx to establish connections from compromised hosts.
IPV4	`193[.]187[.]174[.]3`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`194[.]116[.]215[.]166`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`194[.]116[.]215[.]36`	Detected server in PhantomCore's MeshCentral C2 infrastructure.
IPV4	`194[.]87[.]253[.]233`	Detected server in PhantomCore's MeshCentral C2 infrastructure.
IPV4	`195[.]133[.]32[.]213`	PhantomCore proxy and SSH tunnel server also used to distribute RClone and its configuration.
IPV4	`195[.]58[.]54[.]39`	Detected PhantomRAT C2 server used to collect host information and issue payload-download commands.
IPV4	`213[.]232[.]204[.]110`	Detected server in PhantomCore's MeshCentral C2 infrastructure.
IPV4	`217[.]19[.]4[.]206`	Detected server in PhantomCore's MeshCentral C2 infrastructure.
IPV4	`45[.]158[.]169[.]131`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`45[.]8[.]228[.]253`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`46[.]8[.]71[.]104`	Detected server in PhantomCore's MeshCentral C2 infrastructure.
IPV4	`88[.]66[.]89[.]231`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`91[.]219[.]151[.]103`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`91[.]219[.]151[.]59`	Detected PhantomCore proxy server associated with PhantomProxyLite, RSocx, and SSH tunneling.
IPV4	`91[.]239[.]148[.]21`	Detected PhantomRShell C2 server.
IPV4	`91[.]239[.]148[.]211`	Detected server in PhantomCore's MeshCentral C2 infrastructure.
SHA256	`01f12bb3f4359fae1138a194237914f4fcdbf9e472804e428a765ad820f399be`	Detected PhantomRShell backdoor sample.
SHA256	`204544fc8a8cac64bb07825a7bd58c54cb3e605707e2d72206ac23a1657bfe1e`	Detected PhantomRShell backdoor sample.
SHA256	`2611121e4100b60e8644211bdc831144ba8b772d4d40e616864e7a723a9d7bf8`	Detected PhantomProxyLite sample used to maintain reverse SSH access.
SHA256	`278f051832c4b2c95ba899d685478bd3430f74d21aea367377cc17788c3a5638`	Detected PhantomRAT backdoor sample.
SHA256	`31cc62a06720e0c20f03e0cb912bb92b20e5f339ae9c7280b235f63ac35eda9a`	Detected PhantomRAT backdoor sample.
SHA256	`413c9e2963b8cca256d3960285854614e2f2e78dba023713b3dd67af369d5d08`	Detected PhantomRShell backdoor sample.
SHA256	`4c78d6bba282aaff0eab749cfa8a28e432f7cbf9c61dec8de8f4800fd27e0314`	Detected PhantomRShell backdoor sample.
SHA256	`9287fd8adc333469eabe655ccf13b78e1abb6e42c0cc6817ae66372fb126a683`	Detected PhantomRAT backdoor sample.
SHA256	`9f9acdd833f3fd7b8bf987a8cc17e9456546fdcbcfe80c3b0dfc57c6f62d3e4b`	Detected PhantomTaskShell PowerShell backdoor sample.
SHA256	`a2be4d9fdba560a4706ff8c4b32f092ef476f203c96e1b4afaf391cfe82aa533`	Detected PhantomProxyLite sample used to maintain reverse SSH access.
SHA256	`b683235791e3106971269259026e05fdc2a4008f703ff2a4d32642877e57429a`	Detected PhantomRShell backdoor sample.
SHA256	`b701272e20db5e485fe8b4f480ed05bcdba88c386d44dc4a17fe9a7b6b9c026b`	Detected PhantomProxyLite sample used to maintain reverse SSH access.
SHA256	`be14fc604c840c3afff9542106c73ed247417de5a56b1e9b2843e7947f0722d9`	Detected PhantomRShell backdoor sample.
SHA256	`c34fb316e7b60cff25be9c86e5736b802b9e99b1ac29daa03b08c3435b6ada8c`	Detected PhantomRAT backdoor sample.
SHA256	`c3d05d7d6e1c50c6bd493fd5613c3204e6beadf8b6e4915cdf2f899fabf86a4e`	Detected PhantomStealer infostealer sample.
SHA256	`c67cf425d688bba6dbe00e6d86a501f6978664ff99c1811c7104f4a3f4b7e884`	Detected PhantomRAT backdoor sample.
SHA256	`ed9b24a77a74cd34c96b30f8de794fe85eb1d9f188f516bd7d6020cc81a86728`	Detected PhantomRShell backdoor sample.
URL	`hxxp[:]//185[.]130[.]249[.]224/upload`	Attacker-operated upload endpoint receiving reports about compromised systems.
URL	`hxxp[:]//188[.]127[.]254[.]234:443/remote[.]zip`	PhantomCore staging URL used to download MeshAgent.
URL	`hxxp[:]//188[.]127[.]254[.]234/browser[.]zip`	Payload URL used to download PhantomStealer.
URL	`hxxp[:]//188[.]127[.]254[.]234/dnsclient[.]zip`	PhantomCore staging URL used to download MeshAgent.
URL	`hxxp[:]//188[.]127[.]254[.]234/inetpub[.]zip`	PhantomCore staging URL used to download MeshAgent.
URL	`hxxp[:]//188[.]127[.]254[.]234/load[.]zip`	PhantomCore staging URL for a PowerShell collection script that researchers could not obtain.
URL	`hxxp[:]//188[.]127[.]254[.]234/one[.]zip`	PhantomCore staging URL used to download the password recovery utility.
URL	`hxxp[:]//188[.]127[.]254[.]234/remote[.]zip`	PhantomCore staging URL used to download MeshAgent through certutil.exe.
URL	`hxxp[:]//195[.]133[.]32[.]213:8000/srvhost[.]exe`	Attacker-hosted URL distributing the RClone executable used for data exfiltration.
URL	`hxxp[:]//195[.]133[.]32[.]213:8000/wusa[.]conf`	Attacker-hosted URL distributing the RClone configuration used for data exfiltration.
URL	`hxxps[:]//mgfoms[.]org/in[.]php?action=2`	Phishing-site payload URL used by the fake CAPTCHA command to download MeshAgent.