Priya Nair — Digital Forensics Analyst
Key Takeaways
- Recent campaigns utilize phishing emails with embedded macros, allowing initial access.
- We identified multiple communication patterns with Cobalt Strike beacons, adapting strategies to evade detection.
- Lateral movement was executed via legitimate administrative tools, exploiting known vulnerabilities to escalate privileges.
Executive Summary
In our recent investigations into a sophisticated phishing campaign linked to advanced persistent threat (APT) actors, we observed a range of tactics that exemplify the evolving nature of cyber threats. The threat actor leveraged socially engineered emails containing malicious Excel attachments designed to deliver the Cobalt Strike framework, facilitating initial access and enabling further exploitation of the target environment. Our analysis uncovered a comprehensive attack chain that illustrates both opportunistic tactics and the use of well-established methodologies, posing significant risks to organizations in various sectors.
Initial Access
The attack began with a carefully crafted phishing email, which was sent to key personnel within the organization. The email contained a malicious attachment disguised as an Excel document, prompting users to enable macros to view the content. Upon enabling macros, an embedded Visual Basic for Applications (VBA) script executed, which downloaded the initial payload from a remote server. This payload was identified as a variant of the Cobalt Strike beacon, initiating contact with the command server managed by the threat actor.
Execution & Persistence
Once the Cobalt Strike beacon established contact with the external command and control (C2) server, it began executing a series of commands to ensure persistence on the compromised system. Our analysis revealed that the actor employed the Registry Run Key for persistence, specifically writing the following value to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\:
Source: Original Report