BatShadow

Executive Summary

BatShadow is a financially motivated Vietnamese threat actor that lures job seekers and digital marketing professionals through deceptive recruiter emails containing malicious PDFs or documents. The campaigns deploy a Go‑based malware called Vampire Bot, which installs credential stealers and enables remote surveillance. Recent activity links the group to IP 103.124.95.161 and domain usage such as samsung-work.com for distribution.

Goals & Targeting

BatShadow’s strategic objective is financial gain through the theft of credentials from targeted individuals, notably digital marketing professionals and job seekers, who are more likely to engage with recruiter‑style emails. Their broad sectoral claims allow them to focus on any organization with a large number of internet‑exposed users: government agencies, finance firms, education institutions, healthcare facilities, defense contractors, media outlets, retailers and various service providers. By compromising individuals in organizations that manage online advertising or public‑facing services, the group can hijack social media or e‑commerce accounts for fraudulent marketing, generating revenue from account takeover fees or double‑extortion. The selection of countries—KP, CN, RU, IN, UA, GB, DE, IR, PK, BY, PL, TW, CA, AU—suggests a preference for regions with high numbers of digital marketers and job seekers. The primary victim type is the individual worker (the recruiter or employee), not necessarily the organization as a whole; however, compromised credentials can provide attackers with back‑doors into corporate networks. Overall, BatShadow appears to be organized but primarily opportunistic, leveraging reusable infrastructure rather than highly sophisticated nation‑state capabilities.

Key Capabilities

• Credential theft via stealer malware
• Email phishing and spear‑phishing attachments
• Go‑compiled payload delivery
• Multi‑stage infection chain with remote surveillance
• Use of filename tricks and browser coercion to evade detection
• Credential dumping tools like Mimikatz and LaZagne
• Exfiltration over web services
• Limited use of encryption for data exfiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

BatShadow’s known campaigns have largely centered on job‑seeker phishing and involve the deployment of Vampire Bot via email attachments. The actors reuse infrastructure such as Vietnamese IP 103.124.95.161 across multiple malware families, reflecting a modular approach to tooling. Their operational tempo appears relatively steady, with annual or semi‑annual waves targeting digital marketing communities. While some reports list wide‑range sectors and countries, the publicly documented attacks have predominantly impacted individuals rather than entire organizations, suggesting that the group’s focus lies in leveraging compromised credentials for financial exploitation. Notable past operations include earlier use of Agent Tesla to hijack Facebook business accounts and a shift toward Go‑based malware in 2025. The actor has not yet demonstrated extensive ransomware deployment; however, double‑extortion tactics (T1657 and T1486) are listed as potential future capabilities.

IOC Patterns

• Spear‑phishing with malicious PDFs or disguised job descriptions
• Use of Go‐compiled executables such as Vampire Bot
• Malicious attachment names like update.exe pdf
• IP 103.124.95.161 for command and control
• Domain usage including samsung‑work.com and temporary domains (TEMP.Periscope, TEMP.Hex)

Recommended Actions

• Implement robust email filtering and sandboxing for attachments; Provide targeted phishing awareness training for recruiting and HR personnel; Block or flag inbound emails from known recruiter domains or IPs like 103.124.95.161; Enforce MFA on all external accounts, especially social media and marketing platforms; Deploy endpoint detection and response capable of detecting Go binaries and credential stealers; Patch publicly exposed web applications to remove potential exploitation vectors; Monitor for unusual outbound traffic to HTTP/HTTPS endpoints from client machines; Maintain up‑to‑date IOC feeds that include known domain, IP and file hash patterns;
• Perform regular security audits of third‑party recruiter services and vendor communications.

Suggested Tags