More about the MontysThree toolset, its targets and capabilities
Russian-speaking
This previously unknown toolset was uncovered in summer 2020, but its activity dates back to at least 2018. It’s being deployed by what appears to be a new threat actor in highly targeted espionage campaigns against industrial holdings in Russia. The four-module malware is spread inside self-extracting archives with titles meant to spearphish the targets. The main malicious payload is disguised using custom-made steganography and targets victims’ corporate documents, namely Adobe Acrobat and Word files.