Security researchers at F6 identified a new threat actor, dubbed Mimbrob, targeting Russian aerospace and IT companies. The group, active since April 2026, utilizes sophisticated phishing campaigns to deploy malware via DLL sideloading techniques. Attackers often masquerade as legitimate organizations, using domains that mimic Yandex infrastructure to deceive targets.
The group employs two primary malicious tools: FBULoader and a Go-based Remote Access Trojan (RAT). FBULoader, disguised as browser updates, was used in attacks against aerospace firms throughout April and May 2026. In September 2026, the group resumed activity, shifting focus to IT companies with phishing emails themed around legal proceedings.
The malware delivery chain involves archives containing legitimate executables, such as Yandex Browser or Notepad++, alongside malicious DLLs. These DLLs establish persistence via Windows Task Scheduler. The Go-based RAT, compiled on systems using Go 1.20, enables command execution, file uploads, and downloads, with traffic encrypted via AES-GCM.
While the final payload remains unidentified, analysts believe the primary objective is espionage. The attackers registered several infrastructure domains on April 16, 2026, to support their operations. F6 continues to monitor the group's activities, which have evolved from targeting drone-tracking software to broader corporate espionage.
