C.A.S actors gain initial access through the exploitation of public-facing applications, establish persistence, escalate privileges, and utilize various tools and techniques to achieve their objectives, including data exfiltration, encryption, and destruction.
Tag: T1543
Engage Report: Stealthy Stalker – Remcos RAT
The malware creates a new registry entry in the Run key of the Windows Registry under HKCU (HKEY_CURRENT_USER). This registry entry ensures that a PowerShell script (yrnwr.ps1) located in the System Update folder inside the misleading LocalLow directory is executed at every user login.
Phishing by Design – Two-Step Attacks Using Microsoft Visio Files
- Initial Access: Attackers compromise a legitimate email account and send phishing emails containing a malicious URL, either directly in the email body or within an attached .eml file. The email often impersonates a trusted entity and may include branding to appear legitimate. The URL leads to a compromised SharePoint page hosting a weaponized Visio (.vsdx) file.
- Execution: The Visio file contains a malicious URL hidden behind a clickable element, such as a “View Document” button. Victims are instructed to hold down the Ctrl key while clicking the element to access the URL, a technique designed to evade automated security scanners. This URL redirects the victim to a fake Microsoft login page designed to steal credentials.
- Persistence (Implied): Although not explicitly mentioned in the document, attackers likely leverage the stolen credentials for persistent access to the victim’s environment. This may involve establishing backdoors, creating new accounts, or modifying existing ones.
- Command and Control: After gaining access, attackers likely establish a command-and-control (C2) channel using application layer protocols like HTTP to communicate with the compromised system, issue commands, and manage the attack.
- Exfiltration: Attackers exfiltrate sensitive data from the victim’s environment over the established C2 channel.