ComicForm and SectorJ149 Hackers Deploy Formbook Malware in Eurasian Cyberattacks

Organizations in Belarus, Kazakhstan, and Russia have emerged because the goal of a phishing marketing campaign undertaken by a beforehand undocumented hacking group known as ComicForm since a minimum of April 2025.

The exercise primarily focused industrial, monetary, tourism, biotechnology, analysis, and commerce sectors, cybersecurity firm F6 mentioned in an evaluation printed final week.

The assault chain includes sending emails bearing topic strains like “Ready for the signed doc,” “INvoice for Fee,” or “Reconciliation Act for Signature,” urging recipients to open an RR archive, inside which there exists a Home windows executable that masquerades as a PDF doc (e.g., “Акт_сверки pdf 010.exe”). The messages, written in Russian or English, are despatched from e mail addresses registered within the .ru, .by, and .kz top-level domains.

The executable is an obfuscated .NET loader designed to launch a malicious DLL (“MechMatrix Professional.dll”), which subsequently runs a third-stage payload, one other DLL named “Montero.dll” that serves as a dropper for the Formbook malware, however not earlier than making a scheduled job and configuring Microsoft Defender exclusions to evade detection.

Apparently, the binary has additionally been discovered to include Tumblr hyperlinks pointing to utterly innocent GIFs of comedian superheroes like Batman, giving the menace actor its identify. “These photographs weren’t utilized in any assault, however had been merely a part of the malware code,” F6 researcher Vladislav Kugan mentioned.

Evaluation of ComicForm’s infrastructure has revealed indicators that phishing emails have additionally been directed in opposition to an unspecified firm working in Kazakhstan in June 2025 and a Belarusian financial institution in April 2025.

F6 additionally mentioned it detected and blocked phishing emails despatched to Russian manufacturing corporations from the e-mail handle of a Kazakhstan-based industrial firm as lately as July 25, 2025. These digital missives immediate potential targets to click on on an embedded hyperlink to verify their account and keep away from a possible block.

Customers who click on on the hyperlink are redirected to a bogus touchdown web page mimicking the login web page of a home doc administration service to facilitate credential theft by transmitting the entered info to an attacker-controlled area within the type of an HTTP POST request.

“Moreover, JavaScript code was discovered within the web page physique that extracts the e-mail handle from URL parameters, populates the enter area with id=”e mail” , extracts the area from the e-mail handle, and units a screenshot of that area’s web site (by way of the screenshotapi[.]internet API) because the background of the phishing web page,” Kugan defined.

The assault aimed on the Belarusian financial institution concerned sending a phishing e mail with an invoice-themed lure to trick customers into coming into their e mail addresses and telephone numbers in a type, that are then captured and despatched to an exterior area.

“The group assaults Russian, Belarusian, and Kazakh corporations from numerous sectors, and the usage of English-language emails means that the attackers are additionally focusing on organizations in different international locations,” F6 mentioned. “The attackers make use of each phishing emails distributing FormBook malware and phishing assets disguised as internet providers to reap entry credentials.”

Professional-Russian Group Targets South Korea with Formbook

The disclosure comes because the NSHC ThreatRecon Workforce disclosed particulars of a pro-Russian cybercrime group that has focused manufacturing, power, and semiconductor sectors in South Korea. The exercise has been attributed to a cluster known as SectorJ149 (aka UAC-0050).

The assaults, noticed in November 2024, commenced with spear-phishing emails focusing on executives and workers utilizing lures associated to manufacturing facility purchases or citation requests, resulting in the execution of commodity malware households like Lumma Stealer, Formbook, and Remcos RAT by way of a Visible Primary Script distributed as a Microsoft cupboard (CAB) archive.

The Visible Primary Script is engineered to run a PowerShell command that reaches out to a Bitbucket or GitHub repository to fetch a JPG picture file, which conceals a loader executable answerable for launching the ultimate stealer and RAT payloads.

“The PE Malware executed immediately within the reminiscence space is a loader-type Malware that downloads further malicious knowledge disguised as a textual content file (.txt) by a URL included within the supplied parameter values, decrypts it, after which generates and executes the PE Malware,” the Singaporean cybersecurity firm mentioned.

“Previously, the SectorJ149 group primarily operated for monetary achieve, however the current hacking actions focusing on Korean corporations are believed to have a robust hacktivist nature, utilizing hacking methods to convey political, social, or ideological messages.”