Lazarus Group Deploys Kaolin RAT via Spear-Phishing Campaign

| 2026-06-11 18:00 LOW MEDIUM MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING STATE-SPONSORED & ESPIONAGE

JSON

Executive Summary

Highlight CTI
AI-generated

A social engineering attack targeting a messaging app attempted to trick users into clicking on malicious links, with the incident occurring on June 11, 2026. The attackers exploited two high-severity zero-days disclosed by researcher, allowing them to gain full SYSTEM rights needed to install malware through local privilege escalation. This vulnerability was chained to another separate vulnerability, giving users or processes low-level privileges the ability to defeat OS protections and gain access to systems. As a result of this attack, Microsoft released fixes for two high-severity zero-days in question.

Technical Mitigations AI-generated

• Deploy behavioral-based EDR, NDR, and XDR to catch post-exploitation activity that signatures miss. • Harden devices using CIS benchmarks • Implement strict network segmentation to limit an attacker's blast radius

Technical Observables Login Required

Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

urls (1)


                                                    hxxp://••••••••••••••••••••

sha256 (4)


                                                    96fa6a••••••••••••••••••••••••••••••••••••••••••••••••••••••••••


                                                    9f1f11••••••••••••••••••••••••••••••••••••••••••••••••••••••••••


                                                    9896a6••••••••••••••••••••••••••••••••••••••••••••••••••••••••••


                                                    a31f22••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

domains (6)


                                                    ta•••••.com


                                                    wi•••••.miner


                                                    wi•••••.procpatcher


                                                    wi•••••.coinminer

files (4)


                                                    sa•••••.exe


                                                    d4•••••.exe


                                                    d4•••••.exe


                                                    VI•••••.exe

md5 (4)


                                                    7bdbd1••••••••••••••••••••••••••


                                                    aac316••••••••••••••••••••••••••


                                                    2915b3••••••••••••••••••••••••••


                                                    38de5b••••••••••••••••••••••••••

Intelligence Metadata

Actors / Malware / CVEs / Campaigns

Qilin

Target & Sectors

NORTH_AMERICA CIS

Incident Timeline

‎2026/06/11

A high-severity zero-day vulnerability in Linux was disclosed by researcher, allowing a single faulty character to introduce a use-after-free vulnerability.

Click on any entity below to view its context and source!

infrastructure Linux

( SecurityWeek ) High-severity vulnerability in Linux caused by a single faulty character The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts me…

Talos Intelligence

Tactical Metrics

Metrics

infrastructure

‎Linux

Affected Product