New Malware Framework Enables Screen Control and UAC Bypass

A security vendor (Cato CTRL) detected and blocked a targeted intrusion against a global manufacturing organization that used a custom implant called TencShell—derived from the open-source Rshell framework—delivered via a staged, in-memory Donut shellcode payload disguised as a .woff font; the implant supports screen control, browser artifact access, UAC bypass, SOCKS5 pivoting, and persistence, and the report includes numerous indicators of compromise and suspected (but inconclusive) China-linked attribution.