Researchers from the F6 cyber-intelligence department have uncovered a new cybercrime cluster they track as Malinsure. The group uses phishing emails themed around voluntary medical insurance (DMS) to deliver a previously unknown backdoor named SafeMostSSH.
The campaign began surfacing in July 2026 when F6 analysts found samples uploaded from Russia to public sandboxes. The samples could not be attributed to any known malware family, prompting the creation of a new cluster designation derived from the insurance-themed lures.
Initial access relies on emails sent from addresses such as mutewinter78@gmail.com. The messages carry PDF attachments titled “ДМС обновления.pdf” or similar that instruct recipients to open a link leading to an RAR archive hosted on domains mimicking legitimate company file-sharing services.
Inside the archives are a renamed legitimate Microsoft executable (winword.exe or powerpnt.exe), a decoy document, and one or two DLLs. Execution triggers DLL Side-Loading of the malicious library, which then uses the LOLbin msiexec.exe with the command “msiexec.exe /Passive /Quiet -z” to invoke DllUnregisterServer and achieve persistence.
SafeMostSSH is a multi-stage backdoor that restores itself from a hidden backup, obtains new C2 addresses by parsing public posts on vc.ru, and establishes a reverse SSH tunnel to attacker infrastructure. The group has also experimented with HTML and SHTML files that embed base64- or hex-encoded payloads to drop the same archive components.
Observed lures reference Russian insurance firms, financial institutions, and fuel-energy companies. Infrastructure elements such as gosuslugi.email and minfin.support suggest a broad targeting scope within Russia.
