The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

    Friday, July 17, 2026 In: Threat Research Print

    Date: 07/17/2026

    Severity: High

    Summary

    Since late March 2026, researchers have observed large-scale phishing campaigns that use fileless techniques and Lua-based loaders with low detection rates to deliver malware such as Agent Tesla, Remcos, XWorm,  and Best Private LOGGER. The attackers impersonate well-known companies and pose as potential business partners to trick victims into opening malicious files. To avoid detection, the campaigns use multiple heavily obfuscated stages, including large amounts of junk code and an AutoIt/Lua loader disguised as a TrueType Font (.ttf) file. 

    Indicators of Compromise (IOC) List

    Domains/URLs

    newremupdate.duckdns.org:2404

    mail.teamengineersgroup.com

    mail.allportcargoservice.com

    mail.trimnt.com

    mail.taikei-rmc-co.biz

    https://cdn.discordapp.com/attachments/1499192125093449759/1511147377979818074/F10097782_Request-9200090_0990.PDF.JS

    IP Address 

    104.239.66.86

    46.183.223.21

    107.174.34.137

    Hash 

    9674da676ee226ee456d35c774715d9b58655423806f281de19dc9ef899e9532

    16f9692debe0d4e35d76b48312979e5a90a85ce066e7375269ce78f43da52769

    417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b

    619d2628dcf0c8e15a6febb0e562609556ca57f9f8216800ee77a39e336b8bf4

    1c4419d687bf45bdc5474b6347e41e89459fc0f5115f0d012c46c57280b242bf

    81edd5e740bea0fefb5c1bbd14a671bd1daff37bf3641e34f3a1f7e93559184a

    1d9dd914cf623dcae4b88834744a005e5e3eae827ded1aafd23ed1d7be57b90a

    6700e6d2a0c285d3ebf1a55aecec63b1e42d7d581f691331c667a8920dac7029

    96e22da4d5c0ea4b0efde0ad3eaa8fdedc60228f84fb3c56899afbb9338da2a1

    05390dd0d2c84f77475c0c6aa082638e23977da591302e911cbcb071c42a9451

    c7159e589e29f9c866cc9983839ae9c9a1457df542a2dcd5103baf38636e08fd

    bbeb74e6af12536ecb6761a65ed893fbddd1b86a17cd4a61b616e5fc6106ec9a

    b12b743d4ecc0fe7320b6c1533e2a60bb89f94ca39a5be37143e7af27daacf04

    8c28bc87eb4f2613117d41a716e78f62d55c19edaeea573c2c96e787da055167

    be4fcf88a287f783a3d199e889f9f088f77338eafe0dce70a38ade01192fb223

    1539468a21a439dd4f8d72a6c34ce503f0585281fc2e88535c3c33727bfdc717

    4c001e107a42d65c1b1e6092e4aa6932dbd1544d097d1a432ba27e3b4bddfcc1

    16516e3298278719123068bf0ed808ea4e00f73c970a8a83377066b4e3c3c950

    fbf9a87d351ef702d87e0cd9e0148baa44c6d619f50fbf91d79a1c5e37719a77

    5b271a1b1ffe2716ae420f8e9d40dbc8e9e682f6e4125d4f174a335bf070ac29

    5409b3fa21dcc2f854697ec731f9574603dd0b6bdfd892e968a2b412ed85f52c

    7df42fc54f053d1bb65f43d4386a75be02770f7923b66e713fb04631582e864e

    e2a95dd038a153dfb463c94554912f992cd04cf0f420552a95f4aea3d6f31e18

    775ae9a8c7363e2368cbb559f9c2d26a6c479d4e7998fe71d45830885ccde429

    986d1d5270822af7d7744762ecd8fc4e9b2886c85b3660e9fdf0b5906d6c4117

    ec494785f243f5f1b516b31d8455fadafe5495e11d47a5ce2bd50b1b3791fec6

    41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be

    3ace400380bd1fc51e83d008dbbe9ceb70b2572da95264be09d85979a6276a37

    cc041def6013da331f025e12f21f43677cea08073018d6be037f15a343a9cc24

    ca9639f7db6c3d1b37a004493f44aaa4e1282ea9333bc8ca5eac5d263d899e6a

    c92740b6b90582a4bf73fef979ca047b9e6ae432e892a97f71e70b45c09e478e

    2fe30eccd36f4346cb117af0cf626c2bca84b50c658b0c9af09110b9f86a53f4

    2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection 

    Detection Query 1 :

    domainname like "https://cdn.discordapp.com/attachments/1499192125093449759/1511147377979818074/F10097782_Request-9200090_0990.PDF.JS" or url like "https://cdn.discordapp.com/attachments/1499192125093449759/1511147377979818074/F10097782_Request-9200090_0990.PDF.JS" or siteurl like "https://cdn.discordapp.com/attachments/1499192125093449759/1511147377979818074/F10097782_Request-9200090_0990.PDF.JS" or domainname like "mail.trimnt.com" or url like "mail.trimnt.com" or siteurl like "mail.trimnt.com" or domainname like "mail.teamengineersgroup.com" or url like "mail.teamengineersgroup.com" or siteurl like "mail.teamengineersgroup.com" or domainname like "mail.taikei-rmc-co.biz" or url like "mail.taikei-rmc-co.biz" or siteurl like "mail.taikei-rmc-co.biz" or domainname like "mail.allportcargoservice.com" or url like "mail.allportcargoservice.com" or siteurl like "mail.allportcargoservice.com" or domainname like "newremupdate.duckdns.org:2404" or url like "newremupdate.duckdns.org:2404" or siteurl like "newremupdate.duckdns.org:2404" 

    Detection Query 2 :

    dstipaddress IN ("46.183.223.21","104.239.66.86","107.174.34.137") or srcipaddress IN ("46.183.223.21","104.239.66.86","107.174.34.137")

    Detection Query 3 :

    sha256hash IN ("c7159e589e29f9c866cc9983839ae9c9a1457df542a2dcd5103baf38636e08fd","41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be","619d2628dcf0c8e15a6febb0e562609556ca57f9f8216800ee77a39e336b8bf4","2fe30eccd36f4346cb117af0cf626c2bca84b50c658b0c9af09110b9f86a53f4","417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b","ec494785f243f5f1b516b31d8455fadafe5495e11d47a5ce2bd50b1b3791fec6","1c4419d687bf45bdc5474b6347e41e89459fc0f5115f0d012c46c57280b242bf","2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279","1539468a21a439dd4f8d72a6c34ce503f0585281fc2e88535c3c33727bfdc717","4c001e107a42d65c1b1e6092e4aa6932dbd1544d097d1a432ba27e3b4bddfcc1","81edd5e740bea0fefb5c1bbd14a671bd1daff37bf3641e34f3a1f7e93559184a","6700e6d2a0c285d3ebf1a55aecec63b1e42d7d581f691331c667a8920dac7029","05390dd0d2c84f77475c0c6aa082638e23977da591302e911cbcb071c42a9451","8c28bc87eb4f2613117d41a716e78f62d55c19edaeea573c2c96e787da055167","bbeb74e6af12536ecb6761a65ed893fbddd1b86a17cd4a61b616e5fc6106ec9a","9674da676ee226ee456d35c774715d9b58655423806f281de19dc9ef899e9532","96e22da4d5c0ea4b0efde0ad3eaa8fdedc60228f84fb3c56899afbb9338da2a1","be4fcf88a287f783a3d199e889f9f088f77338eafe0dce70a38ade01192fb223","1d9dd914cf623dcae4b88834744a005e5e3eae827ded1aafd23ed1d7be57b90a","16f9692debe0d4e35d76b48312979e5a90a85ce066e7375269ce78f43da52769","b12b743d4ecc0fe7320b6c1533e2a60bb89f94ca39a5be37143e7af27daacf04","16516e3298278719123068bf0ed808ea4e00f73c970a8a83377066b4e3c3c950","fbf9a87d351ef702d87e0cd9e0148baa44c6d619f50fbf91d79a1c5e37719a77","5b271a1b1ffe2716ae420f8e9d40dbc8e9e682f6e4125d4f174a335bf070ac29","5409b3fa21dcc2f854697ec731f9574603dd0b6bdfd892e968a2b412ed85f52c","7df42fc54f053d1bb65f43d4386a75be02770f7923b66e713fb04631582e864e","e2a95dd038a153dfb463c94554912f992cd04cf0f420552a95f4aea3d6f31e18","775ae9a8c7363e2368cbb559f9c2d26a6c479d4e7998fe71d45830885ccde429","986d1d5270822af7d7744762ecd8fc4e9b2886c85b3660e9fdf0b5906d6c4117","3ace400380bd1fc51e83d008dbbe9ceb70b2572da95264be09d85979a6276a37","cc041def6013da331f025e12f21f43677cea08073018d6be037f15a343a9cc24","ca9639f7db6c3d1b37a004493f44aaa4e1282ea9333bc8ca5eac5d263d899e6a","c92740b6b90582a4bf73fef979ca047b9e6ae432e892a97f71e70b45c09e478e")

    Reference:    

    https://www.fortinet.com/blog/threat-research/the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader                     


    Tags

    MalwarePhishingLoaderAgent TeslaREMCOSXWormObfuscation

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.