A new phishing attack campaign targeting individuals in Pakistan using a customized backdoor has been uncovered by cybersecurity experts.
Named PHANTOM#SPIKE by Securonix, the unidentified threat actors have exploited military-themed phishing documents to trigger the infection process.
According to a report shared with The Hacker News by researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov, “ZIP files with a password-protected payload archive contained within” were utilized by the attackers to spread malware.
The attack stands out for its simplicity in tactics and the use of basic payloads to establish remote access to targeted systems.
The phishing emails contain a ZIP file that claims to contain minutes of a meeting related to the International Military-Technical Forum Army 2024, an official event hosted by the Ministry of Defense of the Russian Federation. The event is scheduled to take place in Moscow in mid-August 2024.
Inside the ZIP file is a Microsoft Compiled HTML Help (CHM) file along with a hidden executable (“RuntimeIndexer.exe”). The CHM file, upon opening, shows the meeting minutes and a few images but secretly launches the bundled binary when the user interacts with the document.
The executable operates as a backdoor to establish connections with a remote server through TCP to receive commands that are then executed on the compromised machine.
Aside from collecting system information, it executes commands through cmd.exe, retrieves the operation’s output, and sends it back to the server. This includes running commands like systeminfo, tasklist, curl for extracting the public IP address from ip-api[.]com, and schtasks for establishing persistence.
The researchers noted, “This backdoor operates as a remote access trojan (RAT) with command line capabilities, enabling the attacker to maintain persistent, discreet, and secured access to the compromised system.”
“The remote execution of commands and transmission of results to the C2 server empowers the attacker to manipulate the infected system, pilfer sensitive data, or deploy additional malicious payloads,” they mentioned.
About Author
