Cyber espionage operations are meticulously planned to ensure success well before any malware is deployed. They frequently employ sophisticated techniques such as social engineering and spear phishing, leveraging trusted identities or timely events to gain unauthorized access undetected. The final stage delivered a DLL implant that established persistence via a scheduled task disguised as OneDrive telemetry, profiled the host, and sent AES-128-CBC encrypted payloads over HTTPS to a second C2 server.
This layered approach wasn't an oversight; each phase was meticulously crafted to blend seamlessly with legitimate system behavior, thereby delaying the final payload's delivery and minimizing detection chances.
In the case of DoNot, researchers identified numerous technical similarities with previous campaigns carried out by the group, including identical AES key material, the same URI path structure and POST parameters, matching beacon formats, familiar infrastructure naming conventions, and significant code reuse. This is good news for defenders because detection logic built around recurring cryptographic material, URI structures, and beacon formats remains effective long after individual domains or servers have been replaced. Organizations should also implement the following measures to bolster defenses: Threats Targeting Real Personnel and Current Events Treat document lures inspired by real personnel and current events as a primary attack vector.
Persistent command-and-control (C2) paths, beacon behaviors, and hardcoded cryptographic keys often endure even after infrastructure modifications.
