Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- The INFAMOUS malware utilizes multifaceted initial access methods, including phishing and exploits, to gain footholds in target environments.
- Persistence mechanisms employed by the malware heavily rely on Registry Run Keys and manipulated services.
- Command and Control (C2) operations leverage HTTP and HTTPS for beaconing and data exfiltration, using randomized domains to evade detection.
Executive Summary
In our investigation into the recent INFAMOUS malware campaign, we identified a sophisticated adversary employing a range of techniques indicative of a well-resourced threat actor. The actor exhibited a clear focus on initial access through phishing and exploitation, which allowed them to deploy an array of implants that enabled persistence and lateral movement within compromised networks. Through meticulous analysis of the malware samples, we traced the attack chain from initial entry all the way through to the actor’s exfiltration efforts, revealing the systemic approach taken by the malware.
Initial Access
The infiltration vector employed by the INFAMOUS operator predominantly comprised social engineering tactics, notably using meticulously crafted phishing emails that contained malicious attachments. During the investigation, we uncovered documents masquerading as legitimate company communications, which exploited vulnerabilities in macro functionality in applications like Microsoft Word. The attachments kicked off the infection chain by executing a PowerShell command to download the main payload from an external server.
Execution & Persistence
Upon execution, the payload of INFAMOUS dropped several components into system directories. Specifically, we tracked the main executable to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\infamous.exe, ensuring it executed on user logins. Our analysis revealed that the implant manipulated Registry Run Keys, specifically under the path HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, to facilitate persistence. This allowed the malware to survive reboots and maintain a presence on affected endpoints.
Command and Control
Communication with the C2 infrastructure was predominantly established over HTTPS, using randomized domain names to obscure activities. We identified several domains linked to the malware, some of which were dynamically generated, making them difficult to blacklist. The malware was programmed to beacon back to the C2 server at staggered intervals, often employing a sleep mechanism designed to repopulate the server periodically, thus enabling passive monitoring without raising alarms. This continuous loop of heartbeat signals ensured that the attacker maintained access for extended periods.
Lateral Movement & Discovery
Once the actor secured an initial foothold, their next objective involved lateral movement across the network. The implant exhibited behaviors consistent with T1075 – Pass the Hash, which allowed it to leverage stolen credentials to pivot to adjacent hosts. We observed attempts to enumerate hosts using commands like net view and tasklist, indicative of the T1018 – Remote System Discovery technique. This exploratory phase was critical for the actor, enabling them to identify high-value targets for data exfiltration.
Impact & Objectives
The ultimate goal of the INFAMOUS campaign appeared to be data exfiltration, with the malware configured to collect sensitive information including credentials, financial data, and corporate secrets. During our analysis, numerous instances of the malware querying local files revealed a focused effort on gathering documents from locations such as C:\Users\[user]\Documents. Once sufficient data was captured, it was compressed and sent back to the C2 servers, utilizing HTTP POST requests for efficient exfiltration.
MITRE ATT&CK Mapping
- T1566 – Phishing: The actor primarily used phishing emails to gain initial access.
- T1071.001 – Application Layer Protocol: Web Protocols: Communication with C2 through HTTPS.
- T1021.001 – Remote Services: Windows Admin Shares: Utilized for lateral movement across the network.
Detection Opportunities
- Monitor for unusual file paths pointing to startup folders, e.g.,
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\. - Implement email filtering rules to detect and block known phishing vectors and suspicious attachments.
- Log and analyze network traffic for unusual patterns, particularly around communication with external C2 domains.
Analyst Notes
During our analysis, it became evident that regular training and awareness programs for end-users could significantly mitigate phishing risks. Additionally, proactive monitoring of network behaviors and C2 communications are vital for early detection of similar threats. The modular nature of this malware suggests a persistent threat that may evolve , underscoring the importance of robust endpoint security solutions to combat such advanced malware.
Source: Original Report