Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – The campaign delivered a malicious ZIP attachment disguised as recruitment documents (‘the attacker leveraged an ongoing Indian government recruitment notice … as a lure’).
• [T1204.002] User Execution – Victims had to open the disguised LNK/archive for the infection chain to begin (‘the initial infection begins with the LNK file’).
• [T1059.001] Command and Scripting Interpreter – PowerShell was used to run the downloader and launch the next stage (‘it invokes powershell.exe to execute JT-agenda.ps1’).
• [T1106] Native API – The .NET dropper used system functions and Windows mechanisms to create files, tasks, and launch payloads (‘the malware dynamically creates a task configured to launch agent.exe’).
• [T1547.001] Boot or Logon Autostart Execution – Persistence was achieved through the Windows Startup folder (‘creates a shortcut … and places it in %APPDATA%MicrosoftWindowsStart MenuProgramsStartup’).
• [T1053.005] Scheduled Task – The malware created a scheduled task for repeated execution (‘Windows Scheduled Task named WindowsDefenderSyncService’).
• [T1548.004] Abuse Elevation Control Mechanism – The campaign abused legitimate software and installer behavior to gain persistent access (‘the threat actors abuse this legitimate remote management software’).
• [T1036.005] Masquerading – Files and names were made to look legitimate, including Windows-like names and icons (‘replaced the default LNK icon with the Microsoft Edge browser icon’).
• [T1140] Deobfuscate/Decode Data – The PowerShell script used an encoded command that was decoded for analysis (‘long Base64-encoded command supplied through the -EncodedCommand parameter’).
• [T1027.011] Obfuscated Files or Information – Hidden files and disguised components were used to conceal the infection chain (‘configured with the Hidden file attribute’).
• [T1564.001] Hide Artifacts – Malware components were hidden and deleted after use (‘the other two files … were configured with the Hidden file attribute’).
• [T1070.004] Indicator Removal – The cleanup routine deleted malware files and configuration artifacts (‘forcefully deletes the malware executable, removes its configuration file’).
• [T1497.001] Virtualization/Sandbox Evasion – The malware performed multiple VM and sandbox checks before continuing (‘performs a total of 14 different virtualization detection techniques’).
• [T1082] System Information Discovery – It queried system manufacturer, BIOS, drivers, processes, and registry artifacts (‘checks the system manufacturer and BIOS information using WMI’).
• [T1614.001] System Location Discovery – The malware stored the victim’s public IP address in Google Sheets (‘Stores the victim’s public IP address’).
• [T1041] Exfiltration Over C2 Channel – The malware sent command results and victim data through its Google Sheets C2 channel (‘writes the execution results back to the same row’).