A financially motivated threat actor has been conducting a malicious campaign since July 2024, primarily targeting users in Poland and Germany. The campaign uses phishing emails impersonating financial institutions and companies to deliver various payloads, including a new backdoor called TorNet. The actor employs sophisticated techniques such as disconnecting victims from the network before payload delivery and using the TOR network for stealthy communications. The TorNet backdoor can receive and run arbitrary .NET assemblies, expanding the attack surface. The campaign also utilizes PureCrypter malware, which performs anti-analysis checks and establishes persistence through Windows scheduled tasks. The attackers demonstrate advanced evasion techniques and the ability to adapt their tactics for maximum effectiveness.