IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia

Kaspersky GReAT documents the reappearance and active use of the MysterySnail RAT (and a single‑module variant dubbed MysteryMonoSnail) in targeted intrusions against Mongolian and Russian government organizations. The report details an infection chain using a malicious MMC script that downloads a ZIP containing a legitimate Cisco executable and malicious DLLs (DLL sideloading), an intermediary backdoor that abuses the open-source piping-server for C2, modular payloads loaded reflectively (RC4/XOR encrypted attach.dat), supported commands and runtime modules, and observed C2 domains; it emphasizes that older, previously reported malware families can persist and reemerge and provides IoC access via Kaspersky threat intelligence.