RRCfg malware abuses Alibaba, Baidu-hosted DLL sideloading in fresh delivery chains
cyb3rops · x · 2026-11-05
ThreatrayLabs hunted for implants related to the RRCfg delivery chain documented by Nextron Research and uncovered additional samples dating back to September 2026.
- Sep 21 chain: Alibaba's legitimate arphaCrashReport.exe, renamed, sideloads a malicious arphaDump64.dll; its bootstrap downloads a Donut loader from Baidu Cloud BOS and connects to an RRCfg C2 at 27.124.41.111:8083.
- Sep 23 chain: ClosePre.exe sideloads a malicious kcommon64.dll that fetches a next stage from gdnkdl.eu.cc.
Attackers keep abusing well-known Chinese software for DLL sideloading, with infrastructure spread across Baidu Cloud BOS and multiple C2 hosts.
More from Safety
- Dev builds signed audit log for AI agents after prompt-injection test blocks $99,999 refund attack — Suicidal_Squirell166 · 2026-11-05
- Researcher urges AI labs to test whether models prefer shutting down safety research over other GPU jobs — amplifiedamp · 2026-11-05
- India's CERT-In mandates 6-hour reporting for AI security incidents — kingslyj · 2026-11-05
- Oak's Bobby Ford on AI agent accountability and evidence-based security investment — TechNadu · 2026-11-05
- Banks in 6 countries race to block AI fraud: FINMA mandates liveness checks — AryHHAry · 2026-11-05
- Confirmed: Google is not indexing publicly shared AI Mode chat URLs — gaganghotra_ · 2026-11-05