March 2026 Report Finds Trojans Led Email Attachment Threats
Summary
The March 2026 report says trojans made up 21% of attachment-based threats and phishing 15%, highlighting HTML/PDF credential lures, archive and document delivery of RemcosRAT and AgentTesla, and C2 use of Telegram and mail infrastructure.
Key points
- Trojans accounted for 21% of attachment-based threats, followed by phishing at 15%, downloaders at 9%, and droppers at 7%; phishing's share fell from 42% the prior month while its volume declined only slightly.
- Phishing used HTML pages and PDF hyperlinks to capture credentials or redirect users to fake sites, including pages impersonating Woori Bank.
- The report describes social engineering through double extensions and legitimate-looking filenames, with lures impersonating courier and financial organizations.
- A reported RemcosRAT case used a PDF disguised as an industrial equipment supplier; its C2 was identified as controller[.]airdns[.]org:45177.
- AgentTesla was distributed through a compressed-file lure, and the report also notes external mail infrastructure used for C2, including ccp11nl[.]hyperhost[.]ua:587.
- The report lists 30 MD5 hashes of collected malware samples to support detection and response.
Article Details
- Publisher
- AhnLab
- Report Period
- March 2026
- Scope
- Phishing emails, attachment-based threats, and malware distribution observed in March 2026.
- Sample Size
- Not disclosed; the report provides a top-30 list of collected malware MD5 hashes.
- Key Statistics
- Trojans represented 21% of attachment-based threats, phishing 15%, downloaders 9%, and droppers 7%.
- Phishing's share fell from 42% in the previous month to 15%, while its volume decreased only slightly.
- HTML represented 14% and JavaScript 11% of script-type threats.
- ZIP represented 14%, RAR 8%, and 7Z 5% of compressed-file threats; PDF represented 13%, XLS 5%, and DOCX 2% of document-file threats.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ccp11nl[.]hyperhost[.]ua | Reported C2 domain; the article gives port 587. |
| DOMAIN | controller[.]airdns[.]org | Reported C2 domain for RemcosRAT distributed through a PDF disguised as an industrial equipment supplier; the article gives port 45177. |
| MD5 | 06dc18771404694814d6a430bb65d1a3 | MD5 hash listed among collected malware samples in the report's top-30 hash list. |
| MD5 | 0a15c9a545fbf78d77f8c130a3b0f840 | MD5 hash listed among collected malware samples in the report's top-30 hash list. |
| MD5 | 0a18f61e8d8e9873cdda4b3b6785d7ad | MD5 hash listed among collected malware samples in the report's top-30 hash list. |
| MD5 | 0d15bf48b73de307eff29f07a6e6d55b | MD5 hash listed among collected malware samples in the report's top-30 hash list. |
| MD5 | 0e9bd0c9991b21b13eddb518dee0eecf | MD5 hash listed among collected malware samples in the report's top-30 hash list. |
MITRE ATT&CK
T1036 · MasqueradingMalicious files used deceptive legitimate-looking names and double extensions.T1071 · Application Layer ProtocolReported C2 channels included Telegram API calls and external mail servers.T1105 · Ingress Tool TransferThe report describes AgentTesla delivery through decompression and execution of a compressed archive.T1204 · User ExecutionDouble extensions and legitimate-looking file names were used to entice users to open and execute malicious files.T1566 · PhishingThe report describes phishing through HTML pages and PDF links to harvest credentials or redirect victims to fake sites.T1566.001 · Spearphishing AttachmentAttachments delivered trojans, downloaders, and droppers; trojans accounted for 21% of attachment-based threats.T1566.002 · Spearphishing LinkEmbedded links in HTML and PDF files led victims to fake pages for credential capture.