Cybercriminals Install Fileless Remcos RAT Malware Using an Excel Exploit
Hoplon InfoSec
13 Nov, 2024
In today’s rapidly evolving cybersecurity landscape, new phishing campaigns are surfacing with increasingly sophisticated methods to infiltrate systems. Cybersecurity researchers recently uncovered a concerning campaign introducing a fileless variant of the Remcos Remote Access Trojan (Remcos RAT Malware), a tool initially marketed for legitimate remote access but now manipulated for malicious purposes.
This new campaign relies on phishing emails that disguise themselves as legitimate business communications, using purchase order-themed lures to gain the trust of unsuspecting recipients. These emails contain an attached Microsoft Excel file that, when opened, triggers a chain of malicious activity. Rather than deploying traditional malware files, this fileless variant embeds malicious code directly into the system’s memory.
Fileless malware is hazardous because it leaves minimal traces on a hard drive, making it much harder to detect with conventional antivirus solutions. This stealthy approach gives attackers a significant advantage, allowing them to evade detection while executing malicious commands in real-time. Such methods present a unique challenge for cybersecurity professionals and organizations alike.
The Remcos RAT Malware itself is a potent tool, offering advanced remote-control capabilities that cybercriminals can easily exploit. Initially developed for legitimate purposes, such as IT administration and remote support, Remcos RAT Malware has powerful features that allow users to monitor, control, and manage remote computers seamlessly. However, these same features can be misused to surveil users, steal sensitive data, and execute unauthorized actions.
According to Fortinet FortiGuard Labs researcher Xiaopeng Zhang, Remcos RAT Malware has been weaponized by threat actors who utilize its capabilities to gather sensitive information and even fully control compromised systems. This misuse highlights the persistent risk of commercial malware being co-opted for nefarious activities, an issue that has become increasingly common in the digital age.
Once a victim unknowingly opens the malicious Excel attachment, a series of concealed commands are executed to bypass security defenses and load the Remcos RAT Malware directly into memory. This fileless execution process ensures that the malware remains hidden, as there are no traditional files stored on disk that antivirus software could detect and quarantine.
This attack highlights the critical role of phishing as an entry point for cybercriminals. By using well-crafted social engineering tactics, attackers can easily deceive users, leading them to open dangerous attachments. Organizations must be vigilant in educating employees about these kinds of deceptive emails and their risks.
As these fileless malware tactics become more common, cybersecurity defenses must adapt to identify and neutralize threats evading traditional detection methods. Techniques such as behavior-based monitoring, endpoint detection, and response (EDR) solutions are essential to address these advanced threats. Understanding how these attacks unfold can help organizations develop better defense strategies.
The discovery of this new campaign underscores the importance of proactive security measures and continuous vigilance against emerging threats. For both organizations and individuals, staying informed about the latest tactics used by cybercriminals is essential in the fight to protect sensitive information and maintain system integrity.
Advanced Evasion Tactics and Full-System Control Capabilities of Remcos RAT Malware
The latest Remcos RAT Malware employed in recent phishing campaigns is armed with highly advanced evasion tactics designed to outsmart traditional security measures. This fileless version is elusive as it avoids leaving any traceable file on the hard drive. Instead, it executes directly within the computer’s memory, bypassing standard detection methods that rely on file-based scanning.
At the heart of this evasion strategy is an HTA (HTML Application) file, which the malware developers have cleverly wrapped in multiple layers of obfuscation. These layers consist of JavaScript, Visual Basic Script, and PowerShell code, each serving to confuse and evade security protocols. By embedding the HTA file with various scripting languages, the attackers make it difficult for security tools to dissect the file and understand its true nature.
The primary role of the HTA file is to retrieve and execute a specific executable file from the attacker’s server. This executable file is crucial in setting up the following stages of the attack, initiating another obfuscated PowerShell script that launches further layers of malicious activity. This approach of using layers within layers ensures that each step of the process is masked and complicated to detect.
Once launched, the binary uses advanced anti-analysis and anti-debugging techniques to challenge the malware analysis process. This makes it difficult for cybersecurity experts and automated systems to inspect its code. Using these methods, the malware resists detection efforts, delaying or even preventing identification by security analysts and antivirus software.
Process hollowing is one of the most sophisticated techniques utilized by this Remcos RAT variant. In process hollowing, the malware replaces a legitimate process in memory with its code, allowing it to operate under the guise of a safe, trusted process. This tactic enables the malware to avoid detection by blending in with genuine processes running on the system.
After the hollowing process, the malware initiates Remcos RAT Malware directly into memory. By skipping the typical method of saving the Remcos executable to disk, this fileless approach makes it challenging for antivirus solutions to locate and block the RAT. Instead, the RAT is injected and runs within the memory space of the legitimate process, effectively remaining hidden while still executing all of its functions.
Once the Remcos RAT Malware is active, it establishes a connection to the attacker’s remote command-and-control (C2) server. Through this connection, the RAT can receive instructions remotely, allowing the attacker to manipulate and control the infected machine as if they were sitting right in front of it.
One of the RATRAT Malware’s essential functions is to collect information about the infected host. It gathers various system metadata, including details about the operating system, hardware specifications, running processes, and network configuration. This information gives the attacker valuable insight into the compromised machine’s capabilities and helps them tailor their approach to further exploitation.
Beyond simple information gathering, Remcos RAT enables a wide range of remote actions. The attacker can search for and exfiltrate files, manage system services, and even change the Windows Registry. Such access grants them control over essential system functions, enabling them to manipulate the machine to their advantage without alerting the user.
In addition, Remcos RAT Malware is equipped to conduct extensive surveillance on the victim. It can capture screenshots, record from the device’s camera and microphone, and monitor clipboard content. This allows attackers to spy on victims and collect sensitive information that may be used for blackmail, further attacks, or data theft.
The RAT’s capabilities extend to locking down the user’s input. It can disable the keyboard and mouse, preventing the victim from regaining control of their device. This total system control and advanced evasion tactics make the fileless Remcos RAT Malware is a dangerous threat, underscoring the importance of multi-layered security defenses and up-to-date threat awareness in today’s digital environment.
Innovative Phishing Tactics Leveraging Trusted Platforms and API Exploits
Cybercriminals increasingly use trusted platforms to launch sophisticated phishing attacks, making it harder for users and security systems to detect their schemes. In a recent example, threat actors have exploited DocuSign, a well-known e-signature platform, to send authentic-looking fake invoices. Using DocuSign’s API, attackers can create invoices that closely mimic legitimate requests, quickly deceiving unsuspecting users.
To execute these attacks, cybercriminals create genuine, paid DocuSign accounts. This approach grants them access to DocuSign’s template and API features, allowing them to develop realistic-looking invoices with well-known brand names, such as Norton Antivirus. The result is a compelling e-sign request that gives the impression of a legitimate document, catching users and automated security tools off guard.
Unlike traditional phishing attacks, which rely on poorly crafted emails or suspicious links, this tactic uses DocuSign’s legitimate infrastructure to add an air of authenticity. Since the invoices are sent from genuine DocuSign accounts, many users are more likely to trust them, reducing the chances of skepticism. Attackers are thus able to use a familiar, trusted platform to manipulate victims into engaging with the fraudulent documents.
Once a user e-signs the document, the attack progresses. The signed document can either be used directly to request payment outside of DocuSign or routed back through DocuSign to reach the finance department of the targeted organization. This added layer of realism can prompt organizations to take the requested payment action, believing it to be an authentic business transaction rather than a phishing attempt.
Additionally, these phishing campaigns have adopted a new “ZIP file concatenation” method to deliver remote access trojans (RATs) to their targets. This unconventional approach involves merging multiple ZIP files, bypassing security filters that typically scan and block a single suspicious ZIP file. The technique is another layer of obfuscation that helps the phishing payload slip past traditional security defenses.
The ZIP file concatenation strategy highlights cybercriminals’ increasing ingenuity in adapting to modern security measures. By leveraging such techniques, attackers can evade detection, embedding malware or trojans in safe files. This approach complements the DocuSign attack vector, demonstrating how attackers refine their methods to enhance their reach and effectiveness.
Together, these tactics represent a new era of phishing that leverages the trusted platforms users rely on and the technical sophistication required to evade modern defenses. As phishing campaigns evolve, understanding these innovative techniques is essential for users and organizations to protect themselves against increasingly convincing and complex scams.
Exploiting ZIP Parsing Discrepancies for Stealthy Malware Delivery
Cybercriminals have devised a clever method to evade detection by exploiting differences in how various programs unpack ZIP files, a technique known as ZIP file concatenation. This approach involves appending multiple ZIP archives into a single file, effectively hiding malicious payloads within the layers of the combined file. The technique takes advantage of how archive managers—like 7-Zip, WinRAR, and Windows File Explorer—process concatenated ZIP files, as each tool interprets these files differently.
In practice, this discrepancy means that some ZIP readers may unpack only a portion of the concatenated file, potentially overlooking hidden malware. For instance, a ZIP file that appears harmless when opened in one program may reveal a concealed payload when accessed through another. This variation allows attackers to strategically deliver malware to users more likely to use a specific tool, bypassing traditional security scans and keeping the malicious content undetected.
According to a recent report by Perception Point, cybercriminals have designed these attacks to exploit the vulnerabilities in popular archive tools, relying on the fact that each tool’s unpacking algorithm might miss certain content within a concatenated file. By targeting known behaviors of ZIP readers, attackers can ensure their payloads evade detection in some environments, allowing them to quietly infiltrate systems without raising red flags. This technique reflects a nuanced understanding of software behaviors and user habits, enhancing the chances of a successful infection.
A notable example of this strategy comes from a threat actor, Venture Wolf, who has leveraged ZIP concatenation in phishing campaigns aimed at Russian manufacturing, construction, IT, and telecommunications. By embedding MetaStealer, a variant of the notorious RedLine Stealer malware, within ZIP archives, Venture Wolf has delivered malware designed to harvest sensitive information from compromised systems. This approach underlines the precision with which attackers can deploy malware to infiltrate specific industries, tailoring their strategies based on the tools commonly used within those sectors.
ZIP file concatenation demonstrates the increasingly sophisticated methods attackers use to evade detection and deliver malicious software stealthily. Threat actors can tailor their attacks to specific tools and industries by exploiting ZIP parsing discrepancies, achieving precision and effectiveness. This technique highlights the need for organizations to adopt comprehensive, layered security approaches capable of identifying and neutralizing threats that evade traditional detection methods.
For more:
https://thehackernews.com/2024/11/cybercriminals-use-excel-exploit-to.html
Share this :