برچسب: Dive

A Deep Dive into the UNC6040 Cyber Attack

Executive Summary

In early June 2025, Google’s corporate Salesforce instance (used to store contact data for small‑ and medium‑sized business clients) was compromised through a sophisticated vishing‑extortion campaign orchestrated by the threat‑group tracked as UNC6040 & UNC6240 (online cybercrime collective known as “The Com” linked to “ShinyHunters).”

The attackers combined three core vectors:

Voice‑phishing (vishing) – Impersonating IT staff in a convincing phone call, persuading a Google employee to approve a malicious application connected to Salesforce, a rapid‑reply extortion scheme demanding Bitcoin payments within 72 hrs.
OAuth app abuse – the deployment of custom Python scripts that emulate Salesforce’s DataLoader, allowing automated bulk exports.
Anonymity layers – Mullvad VPN‑initiated calls followed by TOR‑based data exfiltration, which anonymized the actors’ true location.

Though Google confirmed that no user passwords were stolen, the breached dataset, included business names, email addresses, phone numbers and related notes. The implications reach far beyond the affected small and medium business customers: while associating compliance, brand integrity, partner security, and regulatory scrutiny of SaaS risk management practices.

Meanwhile, the Salesloft Drift attack orchestrated by UNC6395 has emerged as one of the most significant cyber incidents in late 2025, which compromised the Salesloft Drift (AI chat-bot/assistant) used for its Salesforce integration. The theft of OAuth token appears to have resulted in running SOQL queries on Salesforce databases that held objects such as cases, accounts, users and opportunities. The attack affected hundreds of Salesforce customers, impacting not just Salesforce users but also other third-party integrations. Salesloft said “Initial findings have shown that the actor’s primary objective was to steal credentials, specifically focusing on sensitive information like AWS access keys, passwords and Snowflake-related access tokens”. Google explicitly warned of the breach’s extensive scope beyond its own systems.

Primary Tactics & Attack Vectors:

Initial Access: Unauthorized OAuth apps installed via trial accounts (using legitimate email domains) and later via compromised accounts from unrelated orgs.
Vishing, Social Engineering: Voice phishing calls to employees
Exfiltration: Custom Python scripts that replicate DataLoader operations.
Infrastructure: Initial calls routed via Mullvad VPN IPs; data transfer via TOR exit nodes.
Extortion: Requesting immediate Bitcoin payment.

Threat Attribution

UNC5537, UNC6040 & UNC6240 likely linked with “Scattered LAPSUS$ Hunters” (“Chos hub”) exhibits similar attack patterns.

A Telegram channel called “Scattered LAPSUS$ Hunters”, blending the names of ShinyHunters, Scattered Spider and Lapsus$ groups emerged, which researchers describe as a chaotic hub for leaks and threats. The group focuses in exploiting the human element to gain access to company networks. The channel ran public polls where members voted on which victim’s data to fully dump, advertised zero-day exploits and a supposed new ransomware toolkit, touting the collective’s action.

GOOGLE - SALESFORCE BREACH

UNC6395 shared the theme of abusing OAuth mechanisms for Salesforce access via compromised 3^rd party integration – evolving their tactics against cloud ecosystems. Meanwhile, UNC6040 uses vishing and OAuth abuse to access Salesforce through social engineering. Overlapping TTPs indicate targeting trusted access applications and the name ShinyHunters appears across these incidents. Al the same time, Google tracks this cluster separately as UNC6395, ShinyHunters extortion group initially told BleepingComputer that they were behind the SalesLoft Drift attack.

Parallel Campaigns

Similar tactics applied in attacks targeting Adidas, Qantas, Allianz Life, LVMH brands (Louis Vuitton, Dior, Tiffany & Co.), Chanel, AT&T, Santander, Starbucks Singapore, Snowflake breach at Ticketmaster, Cisco, Pandora, Bouygues Telecom, Tokopedia, Homechef, Chatbooks, Portail Orange, Farmers Insurance, TransUnion, UK Legal Aid Agency, Gucci, Salesforce, Fairhaven Homes, Workday, Mazars.fr, Adidas, Air France-KLM, Phantom Wallet, Neiman Marcus, Coca-Cola, ZScaler.

Qantas Airways: Employee credentials & sensitive flight/customer records targeted. Attack blended SIM swapping + SaaS compromise.
Air France-KLM: Airline loyalty accounts and CRM cloud environment probed.
Retailers (generalized set) → Used social engineering and SIM-swap vishing to gain access to IT/helpdesk portals.
Okta: Service provider breach led to downstream impact on multiple clients (identity federation exploited).
MGM Resorts: Social engineering of IT desk led to ransomware deployment, slot machines & hotel services down for days.
Caesars Entertainment: Extortion campaign where ransom was allegedly paid; loyalty program records got leaked.
AT&T: Call metadata (500M+ records, including phone numbers, call/SMS logs) stolen and advertised for sale.
Ticketmaster (Live Nation): ~560M customer records including event ticketing details, addresses, payment info leaked.
Advance Auto Parts: Data set of supply chain and retail customer info stolen.
Santander Bank: Customer financial records compromised; reported 30M records affected.
LendingTree: Customer PII and loan data exposed.
Neiman Marcus: Customer loyalty and credit program data targeted.
Los Angeles Unified School District (LAUSD): Student/employee data exfiltrated from Snowflake environment.
Pandora, Adidas, LVMH (Louis Vuitton, Chanel, Dior): Retail brand data exposed (customer PII + sales info).
ZScaler: UNC6395 compromised Salesforce instance through Salesloft Drift and steals customer data

With the attack that involves compromise of the Salesloft Drift AI OAuth token, any data that could potentially be compromised from the databases (that held information on users, accounts, cases, etc,) can be utilized by the attacker in various ways. The stolen data could either be sold to third parties or used to access emails (as reported from a very small number of Google Workspace accounts) launch further credential-reuse attacks on other SaaS accounts.

Indicators of Compromise:

UNC6040, UNC6240	UNC6395
81.17.28.95 31.133.0.210 45.138.16.69 45.90.185.109 45.141.215.19 45.90.185.115 45.90.185.107 37.114.50.27 45.90.185.118 179.43.159.201 38.135.24.30 91.199.42.164 192.159.99.74	208.68.36.90 44.215.108.109 154.41.95.2 176.65.149.100 179.43.159.198 185.130.47.58 185.207.107.130 185.220.101.133 185.220.101.143 185.220.101.164 185.220.101.167 185.220.101.169 185.220.101.180 185.220.101.185 185.220.101.33 192.42.116.179 192.42.116.20 194.15.36.117 195.47.238.178 195.47.238.83
shinycorp@tuta[.]com shinygroup@tuta[.]com shinyhuntersgroups@tutamail[.]com ticket-dior[.]com ticket-nike[.]com ticket-audemarspiguet[.]com
Salesforce-Multi-Org-Fetcher/1.0 Salesforce-CLI/1.0 python-requests/2.32.4 Python/3.11 aiohttp/3.12.15

In both the campaigns Google observed TOR exit nodes being used to access compromised Salesforce accounts.

Majority of attacks orchestrated by UNC6040 and UNC6240 (ShinyHunters) could be traced to originate from TOR exit nodes hosted either in Netherlands or Poland. These were hosted primarily at Macarne or Private Layer INC.

Attackers were found to blend TOR traffic with legitimate OAuth sessions to obscure origin and make detection harder. Attacks orchestrated by UNC6395 could be traced to originate from TOR exit nodes hosted either in Germany or Netherlands. These were hosted primarily at Stiftung Erneuerbare Freiheit.
Many suspicious SOQL queries (data exfiltration) and deletion of scheduled jobs were initiated from TOR IP addresses, indicating adversaries were anonymizing data theft operations.

Similarly, Scattered Spider used TOR exit IPs as a cover for account takeovers and extortion activity.

Attackers combined vishing (helpdesk calls) with credential access, then routed subsequent access through Tor.
Tor traffic was especially noted when adversaries escalated privileges or accessed sensitive SaaS applications.
Europe-heavy nodes with a notable U.S. presence.

Common Threads Across Both Campaigns

TOR IPs as operational cover was consistently used to hide adversary infrastructure.
Identity-based intrusions by both groups abused identity trust rather than exploiting zero-days.
Overlap with Scattered Spider tradecraft where both campaigns show attackers mixing social engineering or stolen credentials with TOR.
TOR exit nodes have different ASNs, but both campaigns leverage NL exit nodes. ASN 58087 (Florian Kolb, DE) overlaps across both the campaigns.

Threat Landscape

Threat actors such as UNC6040 (ShinyHunters-affiliated), Scattered Spider (UNC3944), and UNC5537 have targeted organizations in the hospitality, retail, and education sectors in the Americas and Europe.

Scattered Spider (UNC3944) is known for sophistication and stealth:

Reliably uses commercial VPN services to mask origin: Mullvad VPN, ExpressVPN, NordVPN, Ultrasurf, Easy VPN, ZenMate.
Employs Tools and TTPs including disabling Antivirus/EDR, lateral movement via ADRecon, credential dumping with Mimikatz/LaZagne, and persistence via RMM and cloud VMs.

“The Com”, short for The Community, is less a formal hacking group and more a sociopathic cybercriminal subculture:

Comprised of 1,000+ members and mostly aged 11–25, they operate across Canada, the U.S., and the U.K.
Engages in SIM swapping, cryptocurrency theft, swatting, sextortion, spear-phishing, and even extreme coercion or violence.
Intel471 reports that members are recruited via social media/gaming and coerced into crimes ranging from grooming to violent acts; the network has also issued a manual (“The Bible”) detailing techniques such as ATM skimming, IP grabbing, doxxing, extortion, and grooming.

Source: DHS’s Joint Regional Intelligence Center and the Central California Intelligence Center

UNC5537 orchestrated a large-scale breach targeting Snowflake customer environments:

In April–June 2024, accessed over 160 organizations including AT&T, Ticketmaster/Live Nation, Santander, Advance Auto Parts, LendingTree, Neiman Marcus, and LA Unified School District – via stolen credentials, often from infostealers, and constraints due to lack of MFA.
Data stolen included sensitive PII, event tickets, DEA numbers, and call/text metadata (500M+ records in aggregate).
Targets were later advertised and extorted through forums.

DataBreaches.net received screenshots of a Telegram message from ShinyHunters claiming to outpace law enforcement, mocking capabilities of agencies like the NSA and stating: “Even the NSA can’t stop or identify us anymore. The FBI… is irrelevant and incompetent…”. In conversation, “Shiny” asserted that Scattered Spider sources voice calls and share access and hinted at a future “Snowflake 3.0” campaign, promising even greater operations ahead.

Cross-Actor Victim Overlaps

Cloud SaaS as a hub: Salesforce (UNC6040), Okta (Scattered Spider), and Snowflake (UNC5537) breaches show pivot via cloud identity/data platforms.
Retail & hospitality: Multiple actors target customer/loyalty records
- Scattered Spider targeted casinos.
- UNC6040 targeted retailers.
- UNC5537 targeted luxury brands.
Education: UNC6040 and UNC5537 both hit educational institutions, stealing student/faculty data.
Financial institutions: Santander (UNC5537) vs smaller fintech/payment targets by The Com/Scattered Spider (SIM swaps).

Detection & Monitoring Guidance

Additional indicators and associated detection rules for detecting the threat group is made available through STI and SMAP.

What we recommend

Monitoring Logs
Continuously scan for LOGIN events from unfamiliar IP ranges (especially Mullvad or TOR exit nodes). Flag any API activity exhibiting a high volume of requests every hour.
OAuth App Watch‑list
Maintain a dynamic registry of approved apps. Trigger alerts on new or anomalous app registrations. Enforce a mandatory admin sign‑off workflow. The below detection rule is an example to detect suspicious signin events with OAuth:2.0:
`SigninLogs | where ResultType == “0” | where AuthenticationDetails has “OAuth:2.0” | where AppDisplayName startswith “Salesforce” | summarize count() by UserPrincipalName, AppDisplayName, IPAddress | where count_ > 5`
Vishing Detection
Implement caller‑ID verification, deploy voice‑analytics modules that detect key phrases (eg: “please pay”, “this is Google”) and cross‑reference against known threat‑intelligence feeds. Integrate with your call‑center platform to surface suspicious calls in real time.
Network Traffic Analysis
Inspect outbound traffic for TOR exit nodes and VPN tunnels that deviate from corporate baselines. Use DPI to spot unusually large, encrypted payloads.
Threat‑Intelligence Feeds
Subscribe to the latest ATT&CK and IOC updates for UNC6040/ShinyHunters. Monitor public Telegram channels for freshly disclosed IOCs.
Zero‑Trust IAM to reduce credential‑compromise impact
MFA, least‑privilege, RBAC for all Salesforce users.
OAuth App Governance to stop rogue app installations
Manual approval + periodic review
IP‑Based Restrictions to limit exfiltration paths
Allow only corporate VPN IPs; block TOR exits
Endpoint Security to stop malicious code execution
EDR to detect custom Python scripts
Call‑Center Hardening to mitigate human‑facing social engineering
Caller‑ID verification, recorded scripts, staff training
Data Loss Prevention to detects anomalous data movements
DLP on outbound exports (volume limits + alerts)
Strategic Initiative: SaaS Posture Management – continuous inventory & policy enforcement for third‑party integrations. Early rogue‑app detection is our key takeaway.
Revoke and rotate tokens/credentials: Immediately revoke OAuth tokens tied to Salesloft Drift and reset all exposed API keys.
Audit activity logs: Review SOQL queries and job deletions between Aug 8–18, 2025 for suspicious access.
Limit OAuth permissions: Enforce least privilege, review app scopes regularly, and tighten approval workflows.
Govern tokens: Ensure short-lived tokens, track their use, and revoke unused ones.
Secure stored credentials: Move AWS keys, Snowflake tokens, and other secrets out of Salesforce objects into vaults.
Enhance monitoring: Use UEBA to detect unusual SaaS behavior and consolidate logs across Salesforce, identity providers, and third-party apps.
Restrict integrations: Apply IP/network restrictions and remove untrusted apps until validated.

Strategic Outlook

TTP Evolution – The ShinyHunters group hints at a potential pivot towards ransomware‑as‑a‑service (ShinySP1D3R).
Broader Targeting – High‑profile brands (Adidas, Qantas, Chanel, etc.) demonstrate that the same methodology can be scaled.
Regulatory Momentum – Expect stricter SaaS risk‑management mandates, amplifying the need for proactive controls.
Attribution Difficulty – Continued use of VPN/TOR & compromised third‑party accounts will heighten detection complexity; behavioral analytics will become indispensable.

Final Note from Our Research Team

The Google Salesforce breach is a textbook illustration of how modern threat actors blend technical supply‑chain exploitation with fast‑turnover social engineering. For organizations that rely on cloud‑native platforms, we see a critical need to:

Revisit SaaS integration policies – treat every third‑party app as a potential attack vector.
Strengthen human‑facing security – call‑center hardening and real‑time vishing detection should become a standard part of the security stack.
Adopt a data‑centric risk perspective – even smaller datasets can fuel large-scale phishing campaigns.
Our threat‑intelligence platform remains actively monitoring the ShinyHunters/Tor‑Mullvad threat chain and will update clients with emerging IOCs and risk indicators. We encourage you to integrate these insights into your defensive posture and to collaborate with our team for a tailored, intelligence‑driven response.

Conclusion

The Google internal Salesforce breach orchestrated by UNC6040 (“ShinyHunters”) underscores critical vulnerabilities in modern SaaS environments. The attack demonstrates that even data traditionally considered “low-sensitivity” can be weaponized for targeted phishing and extortion schemes, while also posing significant regulatory, reputational, operational, and financial risks. Organizations must adopt robust Identity & Access Management controls, enforce strict OAuth governance, and integrate comprehensive monitoring to mitigate evolving threats.

The UNC6395 campaign highlights how third-party OAuth integrations can undermine SaaS security. By abusing trusted tokens, attackers bypassed MFA and exfiltrated sensitive data from hundreds of organizations. This attack reinforces SaaS ecosystems and not just core apps as prime targets. Strong governance over OAuth apps, token lifecycles, and SaaS behaviors is critical to reducing risk. Proactive monitoring, least privilege, and credential hygiene are essential to defending against token-based intrusions like this.

Authors

Deepak Thomas Philip

Kartikkumar Jivani

Sathwik Ram Prakki

Subhajeet Singha

Rhishav Kanjilal

Shayak Tarafdar

Source link

سپتامبر 2, 2025

Spreading via .VBE, Hiding in Registry – A Deep Dive

During our recent investigation at Seqrite Labs, we identified a sophisticated variant of Masslogger credential stealer malware spreading through .VBE (VBScript Encoded) files. Initially, the variant appeared to be a typical script-based threat, but upon deeper analysis it turned out to be a multi-stage fileless malware that heavily relies on Windows Registry to store and execute its malicious payload.

In this blog post, we analyzed the internal flow of VBScript code, the obfuscation mechanism used, and how it manipulates system to remain fileless. Also, we have explained about the Stagers and the capabilities of the final Masslogger payload.

Initial Infection Vector:

The infection begins with .VBE file, likely distributed via spam email or drive-by downloads. .VBE file is a VBScript encoded with Microsoft’s built-in encoding scheme to detect casual inspection. Once decoded, the script reveals multiple layers of obfuscation, modular routines and true functionality.

Analysis of Decoded .VBS – [VBScript] File:

Initially, .VBS file prepares and writes multiple registry values under a specific key used by the malware. It sets up the execution environment for storing a fileless payload.

Registry Key and Value names are hard-coded and straightforward. However, few of the critical value data are kept encoded and are decoded during file execution.

-Registry Setup for Commands and Stager Configuration:

Subroutine AKAAU() is used to prepare keys and values before they are written to the registry. Value names and Value Data are stored as a separate array – “QORXG” and “ZBZLV” respectively. Both arrays are written to registry by using “RegWrite”.

Fig-1 : .VBS file prepares and writes multiple Windows Registries

Once system is infected, we can find these malicious registry entries in Registry Editor:

Fig-2: Malicious Registry entries, values and their probable Meaning

Here is the summary of Registry Entries written to the system at registry path “HKCU\Software\”:

Value Name	Value Data	Summary
cn	Stop-Process -Name conhost -Force	Forcefully kill conhost.exe process.
i	“AddInProcess32.exe”	Target process for code injection.
in	“0”	Control flag, checking if PowerShell command already run or not.
instant	LPICU	Obfuscated PowerShell commands. Deobfuscate and loads Stager-1 in memory.
Path	esBbIgyFlZcXjUl	Name of the registry key path. It is appended to “HKCU\Software\”.
r	WAJLA	.Net assembly, stored in reversed string format. Stager-2.
s	RKFYI(DGSLP)	Hex Decoded String. .Net assembly stored in reversed, Base64 format. Stager-1.
v	HIKGO()	Obfuscated Commands for PowerShell. Deobfuscate and loads Stager-1 in memory. Specifically used as user input simulation.

Table-1: Summary of added registry entries

Before writing these registries, malware calls a subroutine “ZGYHW()” that checks if the file “C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe” is present at location.

Depending upon the presence, malware deploys different versions of Stagers. Specifically, Stager-2 in this scenario:

Fig-3: Check for MSBuild.exe file presence

– Registry Setup for Final Payload Deployment:

After above registries are configured and written, there is a call to another subroutine “XSSAY()”. This function is responsible for reading another larger string data (which is an actual Masslogger payload, kept encoded). This data is then split into 25,000-character chunks and writes them in another registry values in segmented form.

Fig-4: Malware splitting another large string data to chunks and writing it to registries

Each chunk is written to the registry at these paths:

HKEY_CURRENT_USER\SOFTWARE\esBbIgyFlZcXjUl\donn\segment1
HKEY_CURRENT_USER\SOFTWARE\esBbIgyFlZcXjUl\donn\segment2
HKEY_CURRENT_USER\SOFTWARE\esBbIgyFlZcXjUl\donn\segment*

Fig-5: New registries added as a chunks of string data

-Task scheduler:

Malware establishes persistence via a Windows scheduled task, ensuring that malware keeps running in the system. Trigger for the task starts on the date of infection (20xx-xx–xxT00:00:00) and repeats every 1 minute (PT1M). Task is scheduled to run ignoring the battery-related restrictions.

Task uses the same name as a created registry key i.e. esBbIgyFlZcXjUl and is triggered to run a .VBS file. This .VBS acts as a persistent execution loop that checks for a created registries indicating whether a payload should be executed.

-Task Scheduler Script – Capable of Simulating User Input:

As we can see in the image below:

It runs for around 10000 times, sleeping for 10 seconds between each cycle.
It reads registry value “i” to get the name of process and confirm if it is running or not.
Then it checks for registry value “in” set to 1,
- if yes, it silently executes malicious command stored in registry “instant”.
When value in “in” is not set to 1.
- It launches PowerShell in visible window mode and uses “.SendKeys” methods to input values of “v” and “cn” registries followed by “{ENTER}”.
- This technique is like simulating user inputs to PowerShell.

Fig-7: esBbIgyFlZcXjUl.VBS file with user input simulation

As we saw in summary table,

“cn” registry is used to forcefully stop the running instance of conhost.exe process.

“instant” and “v” registries are used as a PowerShell to de-obfuscate, prepare and load Stager .Net assembly in memory, without touching the disk.

Check for System Protection Status:

Malware checks the protection status of the target system and possibly remain undetected during execution. It does so by querying some important registries. Below are a few of the registries where AV / Security products usually register their presence:

“HKLM\SOFTWARE\Microsoft\Security Center\Provider\Av”,
“HKLM\SOFTWARE\Microsoft\Security Center\Monitoring”,
“HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers”,
“HKLM\SOFTWARE\Microsoft\Windows Defender\Security Center\Providers”

These registries are defined in the script in encoded format. Malware tries to enumerate through the subkeys of above keys and attempts to read “DisplayName” value. DisplayName holds the name of the installed AV / Security tool. If multiple security products are found to be installed on target system, malware halts its execution.

Fig-8: Check the presence of installed security tools

-Trigger for Stager:

The subroutine SQSKP() in .VBE file is a critical part of malware execution chain. It dynamically constructs and runs a PowerShell command that performs in-memory execution of a .NET stager retrieved from the Windows Registry.

Here, the decoded text is a de-obfuscated PowerShell commands, after replacing |path| with RVOYN.

As we can see in Fig-10 –

This PowerShell command is formed and assigned to variable “LPICU”.
The contents of variable are then written to registry value “\instant”, which is created inside registry key “Computer\HKEY_CURRENT_USER\SOFTWARE\esBbIgyFlZcXjUl”.
Function runs the constructed PowerShell command silently, where “0” – hides PowerShell window.
The PowerShell then reads registry key “HKCU\Software\esBbIgyFlZcXjUl\s” – This registry key contains the Stager-1, kept in revered Base64- encoded format.

Fig-11: Forming stager-1 by reversing and Base64 decoding

We have seen malware authors implementing this encoding combo in many of the recent credential stealers, including VIPKeylogger, Remcos, AsyncRAT etc.

The PowerShell command reverse the string, joining them, decodes base64 strings and load it as a .Net assembly using “[AppDomain]::CurrentDomain.Load ()” function in memory. This approach allows malware to:

Avoid writing actual malware files to disk (Evasive capability).
Dynamically construct and load payload at runtime.

Invokes entry method “[v.v]::v(‘esBbIgyFlZcXjUl’)”, that refers to the registry path.

We took the dump of deobfuscated stager-1 payload for further analysis. Our observations are as follows:

Analysis of Stager-1:

Stager-1 is a small executable kept encoded at registry “HKCU\Software\esBbIgyFlZcXjUl\s”. It is compiled in .Net and size is around ~14KB.

Analyzing its code, we found that the file is trying to read contents from another registry key with name “r” – [HKCU\Software\esBbIgyFlZcXjUl\r].

Those contents are reversed and another .Net compiled binary is formed – the stager-2.

This binary is then loaded in memory using “Assembly.Load()”. Stager-1 tries to locate method r() inside the class r inside the Stager-2 assembly. It is the entry point for the execution of stager-2.

Fig-12: Stager-1 trying to load Stager-2 and locate Method “r” in it

Analysis of Stager-2:

After Stager-1 completes its setup, malware proceeds to its Stager-2 loader. This stage of infection is focused on extracting actual Masslogger payload from registry and injecting it into target process.

Stager-2 initially constructs potential file paths to launch process and performing code injection.

It checks if a file (whose name is retrieved from the registry value “i”) exists in any of these paths.

In our case, we found the target file/process path is:

“%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe”

Fig-13: Constructing file/process path for code injection.

Further, malware extracts actual Masslogger payload which was previously written (by subroutine “XSSAY()”) in multiple registry subkeys under below registries, that we saw earlier “.

HKEY_CURRENT_USER\SOFTWARE\esBbIgyFlZcXjUl\donn\segment1
HKEY_CURRENT_USER\SOFTWARE\esBbIgyFlZcXjUl\donn\segment2
HKEY_CURRENT_USER\SOFTWARE\esBbIgyFlZcXjUl\donn\segment*

The BBX() function of class ‘r’ is responsible for collecting all value entries, concatenate them, reverses the combined string, and then decodes it from hexadecimal into raw bytes. This technique allows malware authors to hide a full PE binary across multiple registry keys. The decoded payload is then used for process hollowing. Process hollowing is performed using function .XGP()

It’s a clever way to keep everything stored in the registry and only use memory for execution.

Fig-14:Function performing payload deobfuscation and process hollowing

-France Specific Payload Delivery:

Geo-targeted payload delivery is now common in advanced malware to alter behavior based on the victim’s location. Stager-2 of this infection checks if current system’s input language is set to French “Fr” and whether locale contains “France”.

If conditions are met, it tries to download specially crafted additional payload from hardcoded URL – hxxps://144.91.92.251/MoDi.txt. At the time of analysis, the URL was not accessible.

-Terminating Traces and Exiting:

At the end of its execution, the malware forcibly terminates running instances of conhost.exe and PowerShell.exe processes.

By killing these processes, malware likely aims to hide its activity traces. Finally, it exits application using ProjectData.EndApp(), completing stager-2 lifecycle.

Analysis of Masslogger Final Payload:

After successful deobfuscation of final payload from registry, Masslogger is injected to into target process – “AddInProcess32.exe”. We can see the marker of this malware in memory dump of the injected process as below:

We took a memory dump of this payload representing the final stage in malware chain. It is responsible for executing the main credential – info stealing functionalities.

-Data Harvesting:

Just like many infostealer malware’s, this malware is also targeting multiple Web browsers and few email clients for stealing sensitive information, like saved Username, Passwords, autofill data, etc. Below are list of Web Browsers and few email clients Masslogger is trying to target.

Fig-18: Targeted browsers and email client for credential Harvesting

Let’s see one of the modules in detail where malware is trying to harvest saved login credentials from the Chrome browser.

Fig-19: Chrome browser specific module for credential harvesting

It locates the user’s login data by accessing its “Login Data” SQLite database. It extracts website URLs along with corresponding usernames and passwords and collects them for further use. If valid credentials are found, they are stored in a structured format like the website, username, and password.

Apart from targeting browsers and email clients for info stealing, Masslogger also possesses capabilities of:

Keylogger activity.
Take and clear snapshot files.
Retrieve clipboard data.
Try monitoring user activity by calling GetForegroundWindow, GetWindowText etc.
Read system details, like IP address and Country.
Uploading multiple files to server.

-Data Exfilteration:

The SpeedOffPWExport() method in final payload enables data exfiltration by sending collected credentials and system information to remote locations via multiple channels, like FTP, SMTP or Telegram.

If FTP is enabled, the method uploads the stolen data as a .txt file to a remote FTP server using hard-coded credentials.

For SMTP, it constructs an email containing the data in either the message body or as an attached text file and sends it using the specified mail server.

If Telegram exfiltration is enabled, it sends the data as a document using the Telegram Bot API, including a caption with the victim’s username and IP.

Conclusion:

The Masslogger fileless variant shows the evolving trend of info-stealing malware. Delivered via a .VBE script, it abuses Windows Registry to store actual executable payload and loads that payload directly in memory without touching the disk. It possesses capability to harvest stored credentials from multiple browsers and email clients and using multiple channels [FTP, SMTP, Telegram Bot] for data exfiltration.

This variant shows the shift of credential stealer malware towards fileless and operation in multiple stages (Stager-1, Stager-2). This challenges traditional AV and signature-based detection methods. To overcome this, security defenders must employ advanced detection mechanisms like behavioral detection, monitor registry anomalies etc.

Indicators of Compromise (IoC’s):

File MD5:

.VBE: 29DBD06402D208E5EBAE1FB7BA78AD7A

.VBS: F30F07EBD35B4C53B7DB1F936F72BE93

Stager-1: 2F1E771264FC0A782B8AB63EF3E74623

Stager-2: 37F0EB34C8086282752AF5E70F57D34C

MassLogger Payload: 1E11B72218448EF5F3FCA3C5312D70DB

URL:

hxxps://144.91.92.251/MoDi.txt

Seqrite Detection:

Script.trojan.49618.GC

Trojan.MSIL

Trojan.YakbeexMSIL.ZZ4

MITRE ATT&CK

Tactic	Technique ID	Technique Name	Sub-technique ID	Sub-Technique Name
Initial Access	T1566	Phishing	T1566.001	Spear phishing Attachment
Execution	T1059	Command and Scripting Interpreter	T1059.005	Visual Basic
Execution	T1059	Command and Scripting Interpreter	T1059.001	PowerShell
Persistence	T1053	Scheduled Task/Job	T1053.005	Scheduled Task
Defense Evasion	T1140	De-obfuscate/Decode Files or Information	–	–
Defense Evasion	T1112	Modify Registry	–	–
Defense Evasion	T1055	Process Injection	T1055.012	Process Hollowing
Defense Evasion	T1562	Impair Defenses	T1562.001	Disable or Modify Tools
Defense Evasion	T1059	Command and Scripting Interpreter	T1059.001	PowerShell
Discovery	T1518	Software Discovery	T1518.001	Security Software Discovery
Discovery	T1082	System Information Discovery	–	–
Discovery	T1012	Query Registry	–	–
Credential Access	T1555	Credentials from Password Stores	T1555.003	Credentials from Web Browsers
Credential Access	T1056	Input Capture	T1056.001	Keylogging
Collection	T1113	Screen Capture	–	–
Collection	T1115	Clipboard Data	–	–
Collection	T1056	Input Capture	T1056.001	Keylogging
Collection	T1083	File and Directory Discovery	–	–
Command and Control	T1071	Application Layer Protocol	T1071.001	Web Protocols
Command and Control	T1071	Application Layer Protocol	T1071.002	File Transfer Protocols
Command and Control	T1071	Application Layer Protocol	T1071.003	Mail Protocols
Command and Control	T1105	Ingress Tool Transfer	–	–
Exfiltration	T1041	Exfiltration Over C2 Channel	–	–
Exfiltration	T1567	Exfiltration Over Web Service	T1567.002	Exfiltration to Cloud Storage
Exfiltration	T1567	Exfiltration Over Web Service	T1567.001	Exfiltration to Code Repository

Source link

ژوئن 26, 2025