Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- Recent phishing campaigns utilize sophisticated social engineering to deliver **Remote Access Trojans (RATs)**.
- Malware deployment was traced to the use of legitimate-looking documents and **malicious macros**.
- Command and Control (C2) communications were observed over **HTTPS**, enabling stealthy data exfiltration.
Executive Summary
Our investigation into the recent phishing campaign revealed a well-orchestrated attempt by threat actors to gain persistent access to target networks by delivering **Remote Access Trojans** through convincingly crafted emails. The actor’s modus operandi showcases a blend of traditional phishing techniques paired with modern evasion tactics. Our analysis examined several samples to understand the attack chain and lateral movement strategies employed, ultimately gaining insight into their objectives.
Initial Access
Initial access was achieved through email phishing campaigns aimed at employees in targeted organizations. We observed that emails specifically impersonated known vendors, utilizing a social engineering approach that capitalized on current events to foster a sense of urgency. The attachments were often benign-looking documents, such as invoices, which used **embedded macros** to download the malicious payload. Upon enabling, these macros called out to a remote server to fetch the RAT, exploiting **PowerShell** commands to execute the downloaded file. The command executed was similar in structure to **Invoke-WebRequest**, a technique seen frequently in such attacks.
Execution & Persistence
Once executed, the sample we examined established itself in the system by dropping several components in the following directory: C:\Users\Public\Documents\. The core payload utilized was a variant of **AgentTesla**, suggesting the actor’s choice to deploy a well-known and effective RAT. Persistence was achieved through the creation of a scheduled task that executed the payload at system startup, leveraging the following command: schtasks /create /tn
Source: Original Report