Daily Summary
Formbook sample volume surged to 100 new samples on 2026-10-18, a 211% increase over the 7-day average of 32 and the largest single-day count in the current reporting window. No new C2 servers were registered, so the surge reflects increased distribution activity through existing infrastructure rather than a fresh backend build-out.
New Samples Detected
The file-type breakdown shows a clear shift toward executable payloads: 61 .exe samples (61% of the total) alongside a long tail of archive and script formats (.rar 9, .js 8, .zip 7, .bin 4, .wsf 4, .jse 2, .bat 2, .ps1 1, .gz 1). The presence of .wsf, .jse, and .ps1 files indicates the actors are hedging against environments that block plain .exe launches, using Windows Script Host and PowerShell as loader stages. The mixed archive formats (.rar, .zip, .gz) suggest the same payload is being packaged differently across delivery channels, likely to dodge attachment-type filtering.
Distribution Methods
The script-to-executable ratio is a useful signal. Roughly a fifth of samples are script or script-adjacent formats, consistent with malspam that delivers an archive containing a script downloader, which then pulls the Formbook executable. The .exe-heavy bulk likely represents the second stage already captured or extracted from those loaders. Combined volume across both stages on a single day points to an active email campaign rather than opportunistic drive-by distribution.
7-Day Trend
Today’s 100 samples more than triple the 7-day average of 32 and stand well outside normal variance for this tracker. Without new C2 registrations, the most probable explanation is a coordinated distribution push through established loader infrastructure, possibly a large malspam wave. Analysts should expect a follow-on spike in C2 check-ins within 24 to 72 hours as delivered samples begin beaconing.
IOC Highlights
All 100 new samples carry associated IOCs, but with zero new C2 servers, those indicators are predominantly file hashes and loader artifacts rather than network infrastructure. Prioritize hash-based blocking in EDR and mail gateway rules for the archive and script formats, since network indicators will largely match existing Formbook C2 sets already in most blocklists.
Security Analysis
The pattern here, high sample volume with flat C2 infrastructure, mirrors prior Formbook malspam waves where the operators reuse a stable command-and-control pool and rotate only payload packaging and delivery. That is efficient for them but exploitable for defenders: because the C2 set is unchanged, existing network detections remain effective, and the surge is best countered at the delivery layer. The actionable recommendation is to temporarily tighten mail gateway policy against inbound .rar, .zip, and .gz attachments containing script files (.js, .jse, .wsf, .ps1, .bat), and to alert on wscript.exe or powershell.exe spawning from archive extraction paths. Blocking the hash set helps, but catching the script-loader stage before the .exe executes will blunt the wave regardless of how the payload is packaged tomorrow.