A threat actor is utilizing spearphishing emails with malicious attachments to gain initial access, establish persistence via scheduled tasks, and exfiltrate data over HTTP.
Tag: Rundll32.exe
DONOT APT Attack
- The attacker sends a spearphishing email containing a malicious Office document that exploits the vulnerability CVE-2017-11882.
- Upon opening the document, the exploit triggers, allowing the attacker to execute a command that launches the next stage of the attack.
- A scheduled task named “Schedule” is created to execute a malicious DLL file via
rundll32.exeevery 5 minutes, ensuring persistence. - The scheduled task establishes communication with the attacker’s command-and-control (C2) server using the HTTP protocol.
- The attacker sends commands and exfiltrates data over the established C2 channel.
Volt Typhoon against energy etc.
Attackers may be using Mshta.exe or Rundll32.exe to execute malicious code.