Nina Kovacs — Exploit Research Analyst
Key Takeaways
- Identified a multi-stage phishing campaign utilizing a custom Remote Access Trojan (RAT).
- The implant facilitated persistent access while exfiltrating sensitive data over a series of carefully crafted HTTP/S beacons.
- Defensive measures should focus on monitoring execution patterns and beaconing behavior.
Executive Summary
During our investigation of a recent malware attack, we dissected a sophisticated phishing campaign that employed a tailored Remote Access Trojan. This multi-stage approach allowed the actor to gain foothold within the target environment, maintain persistence, and extract valuable data over time. Leveraging social engineering tactics, the threat actor successfully tricked several users into executing a malicious payload that has since compromised the integrity of the affected systems.
Initial Access
The infection vector was rooted in a classic phishing scheme, wherein the actor dispatched an email masquerading as a trusted communication from a logistics partner. The email contained a malicious link that led to a fake authentication page mimicking a well-known service. Upon user interaction, the actor harvested credentials and redirected them to a JavaScript file hosted on a compromised server. This JavaScript payload, which was observed to exhibit characteristics of both Stage 1 and Stage 2 downloads, facilitated the download of the actual RAT implementation, which was packaged as a benign-looking PDF.
Execution & Persistence
The sample we examined executed with a high degree of stealth, leveraging the Windows Task Scheduler for persistence. Specifically, our analysis revealed that it created a scheduled task located at C:\Windows\System32\Tasks\MyScheduledTask. The task was configured to execute the RAT payload at startup, thereby ensuring that it remained active through system reboots. In addition, we found the implant employed a series of obfuscated PowerShell commands to establish its execution environment, exploiting Windows Management Instrumentation (WMI) to evade detection.
Command and Control
The beaconing patterns exhibited by the RAT indicated a clear command and control (C2) infrastructure that was both robust and dynamic. The malware sent encrypted HTTP/S requests to a domain that changed on a regular basis, making use of a Domain Generation Algorithm (DGA) to resolve the current C2 server. This technique, identified as T1071.001 – Application Layer Protocol: Web Protocols, is a known approach to ensuring that even if one domain was taken down, the RAT could quickly pivot to another secure endpoint. During our analysis, we detected configurations that utilized user-agent strings similar to legitimate web traffic, further obfuscating its true nature.
Lateral Movement & Discovery
Upon gaining a foothold, the actor began lateral movement within the environment using Windows SMB protocol for credential dumping. Leveraging tools such as Mimikatz, the implant extracted hashed credentials which were utilized for accessing additional network shares. During our investigation, we observed attempts to access configurations within the C:\Users\Public\Documents\ directory, indicating an exploratory phase aiming to identify sensitive data across shared drives. These movements were persistent with attempts to leverage Windows Remote Management (WinRM) protocols for further lateral access.
Impact & Objectives
The primary objective of the actor appeared to be data exfiltration, targeting personally identifiable information (PII) and corporate credentials. Our logs captured multiple exfiltration attempts where the implant packaged data in compressed archives before sending it to the C2 over HTTPS. Furthermore, we noted that they employed further malicious toolkits — including various stages of data staging — to localize sensitive archives of information prior to exfiltration. The overarching aim seemed to align with financial motives, likely targeting mergers and acquisitions information that could be sold to the highest bidder.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial vector used social engineering to deceive users into executing malicious payloads.
- T1059.001 – Command and Scripting Interpreter: PowerShell: The implant executed PowerShell scripts for initial execution and lateral movement.
- T1071.001 – Application Layer Protocol: Web Protocols: The RAT communicated with its C2 using HTTP/S traffic to evade network defenses.
- T1021.002 – Remote Services: SMB/Windows Admin Shares: Utilized SMB for lateral movement and credential dumping.
Detection Opportunities
- Implement user behavior analytics to identify abnormal patterns indicative of phishing attempts.
- Monitor and analyze scheduled tasks for any unauthorized creation or modifications.
- Enhance detection capabilities for beaconing patterns and suspicious outbound HTTP/S requests.
Analyst Notes
This investigation highlights the necessity of an adaptive response to evolving attack vectors. The actor’s use of familiar tools and methods in combination with social engineering beautifully illustrates the multifaceted approach needed in modern offense strategies. Ongoing threat intelligence sharing and user training is pivotal in mitigating the impact of such sophisticated phishing schemes. Continued vigilance is required, and organizations should reassess their network segmentation and endpoint defenses, particularly against threats employing advanced evasion techniques.
Source: Original Report