githubusercontent[.]com

A "coordinated developer-targeting campaign" is using malicious repositories disguised as legitimate Next.js projects and technical assessments to trick victims into executing them and establish persistent access to compromised machines. "The activity aligns with a broader cluster of threats that use job-themed lures to blend into routine developer workflows and increase the likelihood of code execution," the Microsoft Defender Security Research Team said in a report published this week. The tech giant said the campaign is characterized by the use of multiple entry points that lead to the same outcome, where attacker-controlled JavaScript is retrieved at runtime and executed to facilitate command-and-control (C2). The attacks rely on the threat actors setting up fake repositories on trusted developer platforms like Bitbucket, using names like "Cryptan-Platform-MVP1" to trick developers looking for jobs into running them as part of an assessment process. Further analysis of the identified repositories has uncovered three distinct execution paths that, while triggered in different ways, have the end goal of executing an attacker‑controlled JavaScript directly in memory - Visual Studio Code workspace execution, where Microsoft Visual Studio Code (VS Code) projects with workspace automation configuration are used to run malicious code retrieved from a Vercel domain as soon as the developer opens and trusts the project. This involves the use of the runOn: "folderOpen" to configure the task. Build‑time execution during application development, where manually running the development server via "npm run dev" is enough to activate the execution of malicious code embedded within modified JavaScript libraries masquerading as jquery.min.js, causing it to fetch a JavaScript loader hosted on Vercel. The retrieved payload is then executed in memory by Node.js. Server startup execution via environment exfiltration and dynamic remote code execution, where launching the application backend causes malicious loader logic concealed within a backend module or route file to be executed. The loader transmits the process environment to the external server and executes JavaScript received as a response in memory within the Node.js server process. Microsoft noted that all three methods lead to the same JavaScript payload that's responsible for profiling the host and periodically polling a registration endpoint to get a unique "instanceId" identifier. This identifier is subsequently supplied in follow-on polls to correlate activity. It's also capable of executing server-provided JavaScript in memory, ultimately paving the way for a second-stage controller that turns the initial foothold into a persistent access pathway for receiving tasks by contacting a different C2 server and executing them in memory to minimize leaving traces on disk. "The controller maintains stability and session continuity, posts error telemetry to a reporting endpoint, and includes retry logic for resilience," Microsoft said. "It also tracks spawned processes and can stop managed activity and exit cleanly when instructed. Beyond on-demand code execution, Stage 2 supports operator-driven discovery and exfiltration." While the Windows maker did not attribute the activity to a specific threat actor, the use of VS Code tasks and Vercel domains to stage malware is a tactic that has been adopted by North Korea-linked hackers associated with a long-running campaign known as Contagious Interview. The end goal of these efforts is to gain the ability to deliver malware to developer systems, which often contain sensitive data, such as source code, secrets, and credentials, that can provide opportunities to pivot deeper into the target network. In a report published Wednesday, Abstract Security said it has observed a shift in threat actor tactics, notably a spike in alternative staging servers used in the VS Code tasks commands instead of Vercel URLs. This includes the use of scripts hosted on GitHub gists ("gist.githubusercontent[.]com") to download and run next-stage payloads. An alternative approach employs URL shorteners like short[.]gy to conceal Vercel URLs. The cybersecurity company said it also identified a malicious npm package, named "eslint-validator," linked to the campaign that retrieves and runs an obfuscated payload from a Google Drive URL. The payload in question is a known JavaScript malware referred to as JADESNOW. Furthermore, a malicious VS Code task embedded within a GitHub repository has been found to initiate a Windows-only infection chain that runs a batch script to download Node.js runtime on the host (if it does not exist) and leverage the certutil program to parse a code block contained within the script. The decoded script is then executed with the previously obtained Node.js runtime to deploy a Python malware protected with PyArmor. The Python payload is assessed to be a Go-based variant of Akira Stealer, an off-the-shelf malware-as-a-service (MaaS) infostealer that harvests user data from browsers, cryptocurrency wallets, chat applications, and system files. The use of Akira Stealer, Abstract Security, said complicates attribution efforts as the stealer is not known to be used by Contagious Interview actors. "It is possible that this is a separate actor copying techniques and swapping in a different final stage," the company told The Hacker News. "As such, this chain's attribution remains uncertain [despite] the shared techniques and infection vector." Cybersecurity company Red Asgard, which has also been extensively tracking the campaign, said the threat actors have leveraged crafted VS code projects that use the runOn: "folderOpen" trigger to deploy malware that, in turn, queries the Polygon blockchain to retrieve JavaScript stored within an NFT contract for improved resilience. The final payload is an information stealer that harvests credentials and data from web browsers, cryptocurrency wallets, and password managers. "This developer‑targeting campaign shows how a recruiting‑themed 'interview project' can quickly become a reliable path to remote code execution by blending into routine developer workflows such as opening a repository, running a development server, or starting a backend," Microsoft concluded. To counter the threat, the company is recommending that organizations harden developer workflow trust boundaries, enforce strong authentication and conditional access, maintain strict credential hygiene, apply the principle of least privilege to developer accounts and build identities, and separate build infrastructure where feasible. The development comes as GitLab said it banned 131 unique accounts in 2025 that were engaged in distributing malicious code projects linked to the Contagious Interview campaign and the fraudulent IT worker scheme known as Wagemole. "Threat actors typically originated from consumer VPNs when interacting with GitLab.com to distribute malware; however, they also intermittently originated from dedicated VPS infrastructure and likely laptop farm IP addresses," GitLab's Oliver Smith said. "Threat actors created accounts using Gmail email addresses in almost 90% of cases." In more than 80% of the cases, per the software development platform, the threat actors are said to have leveraged at least six legitimate services to host malware payloads, including JSON Keeper, Mocki, npoint.io, Render, Railway.app, and Vercel. Among these, Vercel was the most commonly used, with the threat actors relying on the web development platform no less than 49 times in 2025. "In December, we observed a cluster of projects executing malware via VS Code tasks, either piping remote content to a native shell or executing a custom script to decode malware from binary data in a fake font file," Smith added, corroborating the aforementioned findings from Microsoft. Also discovered by GitLab was a private project "almost certainly" controlled by a North Korean national managing a North Korean IT worker cell that contained detailed financial and personnel records showing earnings of more than $1.64 million between Q1 2022 and Q3 2025. The project included more than 120 spreadsheets, presentations, and documents tracking quarterly income performance for individual team members. "Records demonstrate that these operations function as structured enterprises with defined targets and operating procedures and close hierarchical oversight," GitLab noted. "This cell's demonstrated ability to cultivate facilitators globally provides a high degree of operational resiliency and money laundering flexibility." In a report published earlier this month, Okta said the "vast majority" of interviews with IT workers do not progress to a second interview or job offer, but noted they are "learning from their mistakes" and that a large number of them seek temporary contract work as software developers hired out to third-party companies to take advantage of the fact that they are unlikely to enforce rigorous background checks. "Some actors however seem to be more competent at crafting personas and passing screening interviews," it added. "A kind of IT Worker natural selection is at play. The most successful actors are very prolific, and scheduled hundreds of interviews each."

Unit 42 stopped monitoring this threat and updating the brief on May 19, 2026. Please refer to the BeyondTrust website for the latest information. On Feb. 6, 2026, BeyondTrust released a security advisory regarding CVE-2026-1731. BeyondTrust is an identity and access management platform. This specific vulnerability involves a pre-authentication remote code execution (RCE) issue within BeyondTrust remote support software. It could allow attackers to execute operating system commands in the context of the site user, which may lead to system compromise, including unauthorized access, data exfiltration and service disruption. Unit 42 is actively investigating exploitation of this vulnerability and has observed attacker activity consistent with the following: Network reconnaissance and account creation Webshell deployment Command-and-control (C2) traffic Backdoor and remote management tool deployment Lateral movement Data theft The campaign tracked by Unit 42 has so far affected the following sectors in the U.S., France, Germany, Australia and Canada: Financial services Legal services High technology Higher education Wholesale and retail Healthcare Due to the severity of the risk and confirmed active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 13, 2026. This addition mandated immediate remediation for federal agencies and signaled urgent prioritization for the private sector. At the time of publication, Palo Alto Networks Cortex Xpanse has identified the presence of 16,400-plus exposed instances potentially vulnerable to CVE-2026-1731 based on our telemetry. Palo Alto Networks customers are better protected from CVE-2026-1731 through the following products: Palo Alto Networks also recommends that BeyondTrust self-hosted customers of Remote Support and Privileged Remote Access manually patch any instances that are not subscribed to automatic updates in the appliance interface in accordance with their February 2026 advisory. The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. CVE-2026-1731 is a critical RCE vulnerability affecting the thin-scc-wrapper component of unpatched versions of BeyondTrust remote support software. This component is exposed to the network and handles incoming WebSocket connections. The flaw allows unauthenticated remote attackers to execute arbitrary operating system commands with high privileges. The vulnerability has been assigned a CVSS score of 9.9, reflecting its low attack complexity and the immediate threat to system integrity and confidentiality. Characteristics of this vulnerability include: Type: OS Command Injection (CWE-78) Severity: Critical (CVSS v4 Score: 9.9) Vector: Network/Pre-authentication Affected Component: thin-scc-wrapper script (reachable via WebSocket interface) The vulnerability is triggered during the WebSocket handshake process. The backend script, thin-scc-wrapper, is designed to parse and evaluate the remoteVersion value provided by the connecting client. This value is ostensibly used for version compatibility checks. The script uses bash arithmetic contexts (such as (( ... )) or let) to compare the version numbers. In bash, these contexts are not strictly limited to integer values. These contexts can also treat operands as expressions. Consequently, if input is not rigorously sanitized, an arithmetic context will evaluate and execute embedded commands — such as command substitutions $(command) — before performing the intended comparison. While previous patches for this component reportedly introduced numeric coherence checks, our analysis indicates these measures were not fully comprehensive. They failed to prevent the bash interpreter from evaluating expressions within the input string, leaving the endpoint exposed to injection. Successful exploitation requires no prior authentication or user interaction. The attack sequence typically follows this trajectory: Connection: The attacker initiates a standard WebSocket connection to the target appliance, directing traffic to /nw [path] or endpoints associated with get_portal_info. Injection: During the handshake phase, the attacker submits an intentionally crafted, malformed remoteVersion value that contains the malicious payload. The payload leverages a specific format, observed in proof-of-concept (PoC) code as a[$(cmd)]0, to force the arithmetic evaluation. Payload execution: The thin-scc-wrapper script processes the remoteVersion value, inadvertently triggering the malicious payload, which is an injected shell command. The injected commands execute in the context of the “site user.” While this account is distinct from the root user, compromising it effectively grants the attacker control over the appliance's configuration, managed sessions and network traffic. Unit 42 is actively investigating multiple compromises related to the exploitation of CVE-2026-1731. We have observed successful exploitation of the vulnerability followed by attackers leveraging their access to: Create domain accounts Install remote management tools to perform reconnaissance of domain administrators and trusts Create local administrator accounts Deploy a backdoor Attempt to install additional remote management tools (i.e., SimpleHelp and AnyDesk) and/or tunneling tools (i.e., Cloudflare) Data theft We have observed attackers using a custom Python script for temporary account takeover, granting access to an administrative account (User ID 1) for 60 seconds before deleting the file to minimize artifact recovery. The Python script functions by querying the target's database to back up the existing password hash for the primary administrator (User ID 1). It leverages the application's own authentication binary (check_auth) to generate a valid hash for the password string password and injects the hash into the database. After sleeping for one minute, the script restores the original password hash and self-destructs, effectively hiding the intrusion from the legitimate administrator and minimizing forensic artifacts on disk. Figure 1 shows this Python script. Unit 42 identified attackers installing multiple web shells across directories, including a password-protected one-line PHP web shell. This compact PHP backdoor uses the eval() function to execute raw PHP code submitted via the POST['1'] parameter, contingent on the presence of the GET['aaaa'] parameter. This structure allows attackers to execute post-exploitation tasks such as file uploads or database dumps without writing additional files to disk. Figure 2 shows an example of this one-line PHP web shell. We recovered a compact, multi-vector PHP web shell (aws.php) designed to function as a stealthy execution gate for an automated C2 client. It aggregates all incoming HTTP data sources (POST, GET and Cookie) to locate a specific parameter named 'ASS', which serves as the payload carrier. The script Base64-decodes this parameter and executes it via eval(), allowing the attacker to run arbitrary PHP code without writing new files to disk. The distinct echoing of DQo= (CRLF characters) before and after execution acts as a data delimiter, a signature trait of C2 tools like China Chopper or AntSword. These delimiters enable the client software to programmatically extract command output from the noisy HTML response of the compromised page. This PHP web shell is shown below in Figure 3. Attackers also used a bash dropper that employs a “config STOMPing” technique to establish a persistent web shell. The script first writes a password-protected PHP backdoor (file_save.php) to the web root directory, which executes arbitrary system commands only when the query parameter key equals vjwr. It then momentarily injects a malicious Location directive into the active Apache configuration file, forcing requests for the backdoor to be handled by a specific Unix socket (/ns/tmp/php-fpm.sock). The script restarts the Apache service to load this malicious configuration into memory and immediately overwrites the configuration file on disk with a clean backup. This leaves the backdoor fully functional in the running process while ensuring the configuration file on disk appears unmodified to forensic investigators. Figure 4 below shows this bash dropper. Unit 42 observed numerous instances of SparkRAT backdoor activity across a wide swath of environments. SparkRAT was originally identified in 2023 as being used in a series of attacks nicknamed DragonSpark. This backdoor is a cross-platform, open-source remote access Trojan (RAT) written in the Go programming language. The tool has been used in various attacks since 2022. Attackers have also been leveraging VShell, a stealthy Linux backdoor [PDF] and RAT characterized by its evasion techniques, including fileless memory execution and the ability to masquerade as legitimate system services. Along with PowerShell scripts designed to download and install a Nezha monitoring agent, we also observed a multi-method "download and execute" cradle. This strategy is designed to guarantee payload delivery across diverse Linux environments (from servers to IoT devices) by chaining redundant commands (wget, curl, python, busybox). This strategy retrieves a malicious script (blue.drx) from a legitimate file transfer service and pipes the content directly into sh for immediate execution. Additionally, Unit 42 observed attackers attempting reverse shells to infrastructure consistent with the default Metasploit Meterpreter over port 4444. Attackers used out-of-band (OAST) techniques targeting the Burp Suite Collaborator service oastify[.]com to validate successful code execution and fingerprint compromised systems. Unlike traditional C2 channels that may be blocked by egress filtering, these attacks leverage the DNS protocol to bypass network firewalls. By encoding the victim's hostname into the subdomain of a DNS query (e.g., [encoded_hostname].[attacker_domain]), the attacker attempts to disguise the data leaving the network as legitimate-looking DNS traffic. The receiving OAST server logs the query, allowing the attacker to confirm the breach and identify the specific machine without establishing a TCP/HTTP connection. The script used in this attack captures the system hostname, converts it to a hexadecimal string and transmits it via nslookup queries to the attacker's OAST domain. Figure 5 below shows an example. These attacks have used the PowerShell command shown in Figure 6 to handle the BitConverter encoding and manage DNS label limits (chunking data into 63-character segments) to ensure successful transmission through strict DNS resolvers. Unit 42 observed attackers leveraging a remoteVersion parameter injection to execute a complex chain of commands designed to stage, compress and exfiltrate sensitive data. The attackers targeted configuration files, internal system databases and a full PostgreSQL dump, attempting to transmit data to an attacker-controlled C2 server. The relationship between CVE-2026-1731 and CVE-2024-12356 highlights a localized, recurring challenge with input validation within distinct execution pathways. CVE-2024-12356's insufficient validation was using third-party software (postgres), while CVE-2026-1731's insufficient validation problem occurred in the BeyondTrust Remote Support (RS) and older versions of the BeyondTrust Privileged Remote Access (PRA) codebase. In the case of CVE-2024-12356, attackers identified insufficient input validation within a WebSocket endpoint handling logic. By manipulating the remoteVersion parameter, they successfully bypassed existing validation checks to execute command lines via the thin-scc-wrapper. This evolution underscores that exposed input-handling pathways remain a primary, high-value target for adversaries seeking pre-authenticated initial access. The significance of this attack surface is underscored by historical precedent. The original vulnerability (CVE-2024-12356) was exploited by the threat actor Silk Typhoon (aka APT27, UNC5221, Emissary Panda) in high-profile campaigns, including a breach of the U.S. Treasury in 2024. This history suggests that CVE-2026-1731 could be a target for sophisticated threat actors seeking similar leverage. A February 2026 Beyond Trust advisory recommends that self-hosted customers of Remote Support and Privileged Remote Access manually patch any instances that are not subscribed to automatic updates in the appliance interface. Customers on a Remote Support version older than 21.3 or on Privileged Remote Access older than 22.1 will need to upgrade to a newer version to apply this patch. Self-hosted customers of Privileged Remote Access may also upgrade to 25.1.1 or a newer version to remediate this vulnerability. A patch has been applied to all Remote Support SaaS and Privileged Remote Access SaaS customers as of Feb. 2, 2026, that remediates this vulnerability. Self-hosted customers of Remote Support may also upgrade to 25.3.2 to remediate this vulnerability. The Unit 42 Managed Threat Hunting team continues to track any attempts to exploit this CVE across our customers, using Cortex XDR and the XQL queries below. Cortex XDR customers can also use these XQL queries to search for signs of exploitation. CVE-2026-1731 is a vulnerability that attackers are actively exploiting in systems running unpatched versions of BeyondTrust remote support software. Successfully exploiting this vulnerability can allow attackers to gain RCE privileges. CVE-2026-1731 is related to a similar vulnerability from 2024 that was also noted as exploited in the wild. The recurrence of this type of vulnerability underscores the necessity of defense-in-depth architecture for high-value remote access platforms. Rather than relying solely on patch management, organizations should prioritize architectural containment by strictly limiting administrative interfaces to internal, segmented management networks or zero trust network access gateways. This approach ensures that even if specific code paths remain vulnerable or new variants emerge, the management plane remains shielded from both opportunistic and targeted exploitation attempts. Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. Palo Alto Networks customers are better protected by our products, as listed below. We will update this threat brief as more relevant information becomes available. Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat. If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Cortex XDR and XSIAM help protect against post-exploitation activities using the multi-layer protection approach. Cortex Xpanse has the ability to identify exposed BeyondTrust Secure Remote Access systems on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that the BeyondTrust Secure Remote Access Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module. While there are no known indications of the exploitation of this vulnerability within cloud infrastructure, Cortex Cloud customers are better protected from, and can detect and remediate, vulnerable cloud infrastructure by using Cortex Cloud’s vulnerability monitoring. Additionally, the proper placement of Cortex Cloud XDR endpoint agent and serverless agents within a cloud environment helps detect and prevent the malicious operations, configuration alterations or exploitation at runtime providing sustained defenses of the cloud environment. 23.162.40[.]187 37.19.221[.]180 45.61.150[.]96 70.23.0[.]66 82.29.53[.]187 82.29.72[.]16 83.138.53[.]139 85.155.186[.]121 92.223.44[.]134 98.10.233[.]76 134.122.13[.]34 138.197.14[.]95 142.111.152[.]50 144.172.103[.]200/4444 155.2.215[.]64 178.128.212[.]209 179.43.146[.]42 45.61.150[.]96/4444 138.197.14[.]95/ws (SparkRAT) hxxp[:]//64.31.28[.]221/support aliyundunupdate[.]xyz:8084/slt (VShell) d65sb7ngveucv5k2nm508abdsjmbn7qmn.oast[.]pro q0r2e5q2dzbykcox9qmkptm12s8mwb.oastify[.]com hxxp[:]//134.122.13[.]34:8979/c (SparkRAT) hxxp[:]//82.29.53[.]187:8778/app_cli hxxps[:]//transfer.weepee[.]io/7nZw7/blue.drx hxxp[://]85.155.186[.]121/access (SimpleHelp) hxxps[:]//temp[.]sh/tQTSs/storm.exe hxxps[:]//64.95.10[.]115:23011/update.sh hxxps[:]//judiemkqjajsfzpidfjlowgl8nyrtd49x.oast[.]fun hxxps[:]//raw.githubusercontent[.]com/nezhahq/scripts/main/agent/install.ps1 hxxp[:]//39uchxifap4cvgzsuirom0szrrg.d65lre9sfqnlcv49317gcis6pyjsatzho.oast[.]pro hxxps[:]//85.155.186[.]121/access/Remote%20Access-linux64-offline.tar?language=en&app=76049110434275449312180081368257747094 hxxps[:]//github[.]com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_agent_0.8.2_linux_amd64.tar.gz 9f431d5549a03aee92cfd2bdbbe90f1c91e965c99e90a0c9ad5a001f4e80c350 (SparkRAT) 98a7b0900a9072bb40af579ec372da7b27af12b15868394df51fefe290ab176b (VShell) 66cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726 (maintenance.php) 679ee05d92a858b6fe70aeb6072eb804548f1732e18b6c181af122b833386afb (d6) 4762e944a0ce1f9aef243e11538f84f16b6f36560ed6e32dfd9a5f99e17e8e50 (Installer for SimpleHelp) 98442387d466f27357d727b3706037a4df12a78602b93df973b063462a677761 (aws.php) cc2bc3750cc5125a50466f66ae4f2bedf1cac0e43477a78ed2fd88f3e987a292 (Bash Script) cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce (file_save.php) 0ecc867ce916d01640d76ec03de24d1d23585eb582e9c48a0364c62a590548ac Updated Feb. 20, 2026, at 9:50 a.m. PT to adjust the number of exposed instances identified by Cortex Xpanse.

Introduction In the latter half of 2024, the Russian IT industry, alongside a number of entities in other countries, experienced a notable cyberattack. The attackers employed a range of malicious techniques to trick security systems and remain undetected. To bypass detection, they delivered information about their payload via profiles on both Russian and international social media platforms, as well as other popular sites supporting user-generated content. The samples we analyzed communicated with GitHub, Microsoft Learn Challenge, Quora, and Russian-language social networks. The attackers thus aimed to conceal their activities and establish a complex execution chain for the long-known and widely used Cobalt Strike Beacon. Although the campaign was most active during November and December 2024, it continued until April 2025. After a two-month silence, our security solutions began detecting attacks again. The adversary employed new malicious samples, which were only slightly modified versions of those described in the article. Kaspersky solutions detect this threat and assign the following verdicts: HEUR:Trojan.Win64.Agent.gen HEUR:Trojan.Win64.Kryptik.gen HEUR:Trojan.WinLNK.Starter.gen MEM:Trojan.Multi.Cobalt.gen HEUR:Trojan.Win32.CobaltStrike.gen Initial attack vector The initial attack vector involved spear phishing emails with malicious attachments. The emails were disguised as legitimate communications from major state-owned companies, particularly within the oil and gas sector. The attackers feigned interest in the victims’ products and services to create a convincing illusion of legitimacy and increase the likelihood of the recipient opening the malicious attachment. All attachments we observed were RAR archives with the following structure: Требования.lnk Требования - Company Profile.pdf - List of requirements.pdf - Требования Company profile.pdf and List of requirements.pdf were decoy files designed to complement the information in the email. The directory Требования\Требования contained executables named Company.pdf and Requirements.pdf, designed to mimic secure PDF documents. The directory itself was hidden, invisible to the user by default. When Требования.lnk was opened, the files in Требования\Требования were copied to %public%\Downloads\ and renamed: Company.pdf became nau.exe, and Requirements.pdf became BugSplatRc64.dll. Immediately afterward, nau.exe was executed. Contents of Требования.lnk Malicious agent In this attack, the adversary leveraged a common technique: DLL Hijacking (T1574.001). To deploy their malicious payload, they exploited the legitimate Crash reporting Send Utility (original filename: BsSndRpt.exe). The tool is part of BugSplat, which helps developers get detailed, real-time crash reports for their applications. This was the utility that the attackers renamed from Company.pdf to nau.exe. For BsSndRpt.exe to function correctly, it requires BugSplatRc64.dll. The attackers saved their malicious file with that name, forcing the utility to load it instead of the legitimate file. To further evade detection, the malicious BugSplatRc64.dll library employs Dynamic API Resolution (T1027.007). This technique involves obscuring API functions within the code, resolving them dynamically only during execution. In this specific case, the functions were obfuscated via a custom hashing algorithm, which shares similarities with CRC (Cyclic Redundancy Check). A significant portion of the hashes within the malicious sample are XOR-encrypted. Additionally, after each call, the address is removed from memory, and API functions are reloaded if a subsequent call is needed. MessageBoxW function hook The primary purpose of BugSplatRc64.dll is to intercept API calls within the legitimate utility’s process address space to execute its malicious code (DLL Substitution, T1574.001). Instead of one of the API functions required by the process, a call is made to a function (which we’ll refer to as NewMessageBox) located within the malicious library’s address space. This technique makes it difficult to detect the malware in a sandbox environment, as the library won’t launch without a specific executable file. In most of the samples we’ve found, the MessageBoxW function call is modified, though we’ve also discovered samples that altered other API calls. After modifying the intercepted function, the library returns control to the legitimate nau.exe process. NewMessageBox function Once the hook is in place, whenever MessageBoxW (or another modified function) is called within the legitimate process, NewMessageBox executes. Its primary role is to run a shellcode, which is loaded in two stages. First, the executable retrieves HTML content from a webpage located at one of the addresses encrypted within the malicious library. In the sample we analyzed, these addresses were https://techcommunity.microsoft[.]com/t5/user/viewprofilepage/user-id/2631 and https://www.quora[.]com/profile/Marieformach. The information found at both locations is identical. The second address serves as a backup if the first one becomes inactive. NewMessageBox searches the HTML code retrieved from these addresses for a string whose beginning and end match patterns that are defined in the code and consist of mixed-case alphanumeric characters. This technique allows attackers to leverage various popular websites for storing these strings. We’ve found malicious information hidden inside profiles on GitHub, Microsoft Learn Challenge, Q&A websites, and even Russian social media platforms. While we didn’t find any evidence of the attackers using real people’s social media profiles, as all the accounts were created specifically for this attack, aligning with MITRE ATT&CK technique T1585.001, there’s nothing stopping the threat actor from abusing various mechanisms these platforms provide. For instance, malicious content strings could be posted in comments on legitimate users’ posts. The extracted payload is a base64-encoded string with XOR-encrypted data. Decrypted, this data reveals the URL https://raw.githubusercontent[.]com/Mariew14/kong/master/spec/fixtures/verify-prs, which then downloads another XOR-encrypted shellcode. We initially expected NewMessageBox to execute the shellcode immediately after decryption. Instead, nau.exe launches a child process with the same name and the qstt parameter, in which all of the above actions are repeated once again, ultimately resulting in the execution of the shellcode. Shellcode An analysis of the shellcode (793453624aba82c8e980ca168c60837d) reveals a reflective loader that injects Cobalt Strike Beacon into the process memory and then hands over control to it (T1620). The observed Cobalt sample communicates with the C2 server at moeodincovo[.]com/divide/mail/SUVVJRQO8QRC. Attribution and victims The method used to retrieve the shellcode download address is similar to the C2 acquisition pattern that our fellow security analysts observed in the EastWind campaign. In both cases, the URL is stored in a specially crafted profile on a legitimate online platform like Quora or GitHub. In both instances, it’s also encrypted using an XOR algorithm. Furthermore, the targets of the two campaigns partially overlap: both groups of attackers show interest in Russian IT companies. It’s worth mentioning that while most of the attacks targeted Russian companies, we also found evidence of the malicious activity in China, Japan, Malaysia, and Peru. The majority of the victims were large and medium-sized businesses. Takeaways Threat actors are using increasingly complex and clever methods to conceal long-known tools. The campaign described here used techniques like DLL hijacking, which is gaining popularity among attackers, as well as obfuscating API calls within the malicious library and using legitimate resources like Quora, GitHub, and Microsoft Learn Challenge to host C2 addresses. We recommend that organizations adhere to the following guidelines to stay safe: Track the status of their infrastructure and continuously monitor their perimeter. Use powerful security solutions to detect and block malware embedded within bulk email. Train their staff to increase cybersecurity awareness. Secure corporate devices with a comprehensive system that detects and blocks attacks in the early stages. You can detect the malware described here by searching for the unsigned file BugSplatRc64.dll in the file system. Another indirect sign of an attack could be the presence of Crash reporting Send Utility with any filename other than the original BsSndRpt.exe. IOCs: LNK 30D11958BFD72FB63751E8F8113A9B04 92481228C18C336233D242DA5F73E2D5 Legitimate BugSplat.exe 633F88B60C96F579AF1A71F2D59B4566