Ps2exeMalware
RansomwareFrom MISP Galaxy
Last reported 9 days ago, by The Hacker News2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“…aders built with PS2EXE, a tool that packages PowerShell scripts as Windows executables, to fetch reverse-shell payloads and create scheduled tasks for persistence.”
- T1036Masquerading
“Lure document masquerading as a Russian diplomatic congratulatory letter to the Armenian Ministry of Foreign Affairs.”
- T1684Social Engineering
“The phishing emails are sent from compromised government accounts and make use of official-looking documents to lend the social engineering attack a veneer of credibility.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks“…ctivity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.”
-
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations“In activity observed from June 2025 through August 2026, Talos identified four infection-chain types that use macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088.”
Thanks — we review every report.