Executive Summary

In early February 2026, cybersecurity researchers uncovered a sophisticated malware campaign named DEAD#VAX, which utilized phishing emails to distribute Virtual Hard Disk (VHD) files hosted on the InterPlanetary File System (IPFS). These VHD files, disguised as PDF documents, contained obfuscated scripts that, upon execution, deployed AsyncRAT—a remote access trojan—into trusted Windows processes entirely in memory, leaving minimal forensic traces on disk. This method allowed attackers to gain extensive control over compromised systems, facilitating surveillance and data exfiltration. The campaign's use of decentralized file hosting and fileless execution techniques highlights a significant evolution in malware delivery and evasion strategies. (thehackernews.com)

The DEAD#VAX campaign underscores a growing trend among cybercriminals to exploit legitimate system features and decentralized technologies to bypass traditional security measures. The reliance on IPFS for hosting malicious payloads and the employment of fileless malware execution present new challenges for detection and mitigation, emphasizing the need for advanced threat intelligence and adaptive defense mechanisms in the face of evolving cyber threats. (thehackernews.com)

Why This Matters Now

The DEAD#VAX campaign exemplifies the increasing sophistication of cyber threats, where attackers leverage decentralized technologies and fileless execution to evade detection. This trend necessitates immediate attention to enhance security protocols and develop adaptive defense strategies to counteract such advanced attack vectors.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

DEAD#VAX is a sophisticated malware campaign discovered in February 2026 that uses phishing emails to distribute IPFS-hosted VHD files, deploying AsyncRAT into trusted Windows processes entirely in memory to evade detection.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to the DEAD#VAX campaign as it could likely limit the attacker's ability to move laterally, escalate privileges, and exfiltrate data by enforcing strict segmentation and identity-aware policies.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: While Aviatrix Zero Trust CNSF may not prevent the initial execution of malicious scripts from phishing emails, it could likely limit the subsequent unauthorized network communications initiated by the compromised host.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Aviatrix Zero Trust Segmentation could likely limit the attacker's ability to escalate privileges by enforcing strict identity-aware access controls, thereby reducing the scope of accessible resources.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Aviatrix East-West Traffic Security could likely limit the attacker's ability to move laterally within the network by enforcing strict segmentation and monitoring east-west traffic patterns.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Aviatrix Multicloud Visibility & Control could likely limit the establishment of command and control channels by monitoring and controlling outbound communications from workloads.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Aviatrix Egress Security & Policy Enforcement could likely limit data exfiltration attempts by controlling and monitoring outbound data flows from workloads.

Impact (Mitigations)

Aviatrix Zero Trust CNSF could likely reduce the overall impact of such attacks by limiting the attacker's ability to access and exfiltrate sensitive data, thereby reducing the potential for data theft and system disruption.

Impact at a Glance

Affected Business Functions

  • Email Communications
  • Document Management
  • Endpoint Security
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: $50,000

Data Exposure

Potential exposure of sensitive corporate documents and communications.

Recommended Actions

  • • Implement Zero Trust Segmentation to restrict lateral movement and limit the spread of malware within the network.
  • • Deploy Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
  • • Utilize Multicloud Visibility & Control to gain comprehensive insights into network traffic and detect anomalous behaviors across cloud environments.
  • • Apply Inline IPS (Suricata) to detect and prevent known exploit patterns and malicious payloads, enhancing threat detection capabilities.
  • • Enforce East-West Traffic Security to monitor and control internal network communications, reducing the risk of lateral movement by attackers.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Get a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image