A recent multi-stage attack has been detected, delivering various malware families such as Agent Tesla variants, Remcos RAT, and XLoader. According to Palo Alto Networks Unit 42 researcher Saqib Khanzada, attackers are increasingly using complex delivery mechanisms to evade detection and ensure successful payload delivery. The attack begins with a deceptive email posing as an order request, containing a malicious 7-zip archive attachment with a JavaScript encoded (.JSE) file.
Upon launching the JavaScript payload, a PowerShell script is downloaded from an external server, initiating the infection sequence. This script contains a Base64-encoded payload that is decrypted, written to the Windows temporary directory, and executed. Subsequently, a next-stage dropper is introduced, which can be compiled using .NET or AutoIt, leading to the deployment of malware like Agent Tesla variants or XLoader.
The attacker employs multiple execution paths to increase resilience and evade detection, focusing on a multi-layered attack chain rather than sophisticated obfuscation. This approach complicates analysis and detection efforts, making it challenging to identify and mitigate the threat. By utilizing simple stages stacked together, attackers can create resilient attack chains that are harder to detect.
In a separate campaign, Kaspersky detailed a new version of a malware called MysterySnail RAT, targeting government organizations in Mongolia and Russia. The threat actor behind this activity, IronHusky, has been active since at least 2017 and was previously linked to zero-day exploitation to deliver MysterySnail. The infections originate from a malicious Microsoft Management Console (MMC) script distributed through a lure document, sideloading a malicious DLL to communicate with attacker-controlled infrastructure.
The latest version of MysterySnail RAT observed by Kaspersky is capable of accepting nearly 40 commands, enabling various malicious activities such as file management, process execution, service management, and network resource connection. Following preventive actions by affected companies to block intrusions, a lighter version of the malware called MysteryMonoSnail was dropped by attackers with reduced capabilities. This ongoing threat landscape underscores the importance of robust cybersecurity measures to protect against evolving and sophisticated attacks.
Source link