Executive Summary
The threat actor known as Larva-24009 (also tracked as HeptaX) continues its cyberespionage operations into 2026, targeting global enterprises through sophisticated phishing campaigns. The group utilizes malicious LNK files disguised as corporate documents—ranging from hospital surveys to project proposals—to initiate a multi-stage infection chain that prioritizes persistence and remote control.
Technically, the actor employs obfuscated PowerShell scripts to download additional payloads, including QuasarRAT and UltraVNC for direct system manipulation. Notably, newer versions of their 'Notifier' malware now leverage the Telegram API for infection reporting. The group also utilizes RDP backdoors by creating unauthorized accounts and deploys various NirSoft utilities to harvest credentials and browser data.
The business impact of these attacks is high, as the actor successfully exfiltrates sensitive enterprise data, including user credentials, browser bookmarks, and activity logs. The use of legitimate remote administration tools like UltraVNC allows the actor to bypass traditional detection, emphasizing the need for robust endpoint monitoring and behavioral analysis of administrative tools.