A suspected espionage group is distributing fake meeting letters and event invitations to organizations in South Asia. Hackers Use Malicious VHDX Files and WebDAV Links In a particular instance, the file was labeled “Letter from the Ambassador – 11th Belt and Road Summit.” Upon opening, it displays a single visible shortcut (LNK) file.
Two hidden files are present: a decoy spreadsheet named “Attachment-2.xls” and an installer called “Visa_Details.msi.” When the victim clicks the shortcut, it initiates a command that starts the installer in the background while simultaneously opening the spreadsheet. This script creates a scheduled task, contacts the attacker's server, and then installs a second MSI file called "Imp_Details.msi." Attackers prefer WebDAV because the remote folder appears like a normal local folder.
Teams can also benefit from the Russian RedFlick phishing campaigns, where researchers recommended viewing archive extraction, VHDX mounting, LNK execution, and WebDAV activity in one view.
Key indicators of compromise (IoCs): - Hostname: netmansrvdns.com WmRAT C2 - Hostname: rappellingaart.com Hosts shortcut, script, and MSI files - URL: hxxps://techtalkhelp.com/talk.log Script download - URL: hxxp://www.rivingtonclarks.com/beautiQuewonders/banaNa.php PapRAT C2 - URL: hxxps://goodnfortunes.com/ucl.php Data upload and C2 - URL: hxxps://felixfuturenext.com/Epistemological/Campaign URL - URL: hxxp://gomescareerplans.com/docs Campaign URL SHA256 (LNK) a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c Malicious shortcut SHA256 (LNK) e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b Malicious shortcut SHA256 (LNK) ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88 Malicious shortcut SHA256 (PapRAT) 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33 PapRAT sample SHA256 (WmRAT) 411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b WmRAT sample
