Check Point Research discovered the ZipLine campaign, a sophisticated social-engineering operation that uses corporate “Contact Us” forms to start legitimate-looking email conversations and deliver weaponized ZIP archives hosting a PowerShell loader that deploys an in-memory implant called MixShell. The implant uses DNS TXT tunneling with HTTP fallback for C2, supports reverse proxying and file/command operations, and the campaign abuses aged or cloned domains and Heroku-hosted payloads. #MixShell #ZipLine
Keypoints
- Attackers initiate contact via victims’ public “Contact Us” forms so the victim replies, reversing the usual phishing flow and increasing credibility.
- Long multi-week email conversations are used to build trust and bypass single-message detection before delivering a malicious ZIP hosted on Heroku subdomains.
- Weaponized ZIP archives contain a malicious .lnk that launches a PowerShell loader which extracts an embedded script from the ZIP and executes shellcode in memory.
- MixShell is a custom in-memory implant that uses DNS TXT tunneling (with HTTP fallback), supports file operations, reverse proxy shells, command execution, and pipe-based interactive sessions.
- Persistence is achieved via TypeLib hijacking with a malicious .sct scriptlet and other methods (scheduled task in the PowerShell variant), enabling automatic re-execution on system restart.
- Infrastructure includes fabricated but aged domains and a central server (e.g., 172.210.58[.]69) linked to multiple campaign domains; overlap with previously reported infrastructure suggests possible ties to financially motivated clusters.
- Targets are mainly US-based manufacturing and supply-chain-critical organizations of various sizes, indicating a focus on operationally valuable victims rather than a single industry.
MITRE Techniques
- [T1193] Spearphishing via Service – Attackers submitted messages through company “Contact Us” forms causing victims to initiate email conversations that led to infection. Quote: ‘the victim who initiated the email exchange…the victim then initiates the email correspondence.’
- [T1566.001] Phishing: Spearphishing Attachment – Malicious ZIP archives containing lure documents and a malicious LNK were sent/hosted and used to deliver the loader. Quote: ‘The payload is delivered as a ZIP archive that includes a PowerShell script embedded within the archive’s binary data.’
- [T1204.002] User Execution: Malicious Link – The .lnk file executed a PowerShell command to extract and run embedded payloads. Quote: ‘The LNK file executes a PowerShell command that performs several coordinated actions.’
- [T1055.001] Process Injection: Dynamic-link Library Injection / Reflective Loading – The PowerShell script uses System.Reflection.Emit and VirtualAlloc to allocate memory, copy decrypted shellcode and invoke it in memory without writing additional files. Quote: ‘the script allocates executable memory with VirtualAlloc, copies the decrypted shellcode and invokes it directly.’
- [T1543.003] Create or Modify System Process: Windows Service – Persistence via TypeLib hijacking to point a COM CLSID to a local malicious .sct file that executes on COM object access (e.g., explorer.exe) causing automatic execution on restart. Quote: ‘TypeLib hijacking…point to a local file named Udate_Srv.sct…executes automatically whenever the hijacked COM object is accessed.’
- [T1071.004] Application Layer Protocol: DNS – MixShell uses DNS TXT queries for C2 communication, encoding and XOR-encrypting data within subdomains. Quote: ‘MixShell prefers to communicate with its C2 using DNS TXT record queries…The generated subdomain is ul44mg.’
- [T1071.001] Application Layer Protocol: Web Protocols – If DNS requests fail, MixShell falls back to HTTP while retaining the same encryption and wrapping format. Quote: ‘If six consecutive DNS requests fail, MixShell falls back to HTTP while retaining the same encryption and data wrapping format.’
- [T1098] Account Manipulation / Scheduled Task – The PowerShell variant uses scheduled tasks for persistence as an alternate mechanism. Quote: ‘Establish persistence via a scheduled task.’
- [T1497] Virtualization/Sandbox Evasion – The PowerShell variant checks for debugging/sandbox artifacts (tools, named pipes, BIOS strings, memory/CPU) and exits if criteria indicate analysis or low-resources. Quote: ‘Scans for analysis/debugging tools…Terminates if the physical memory is less than 4 GB.’
Indicators of Compromise
- [File Hash ] Observed malicious payload hashes – e69d8b96b106816cb732190bc6f8c2693aecb6056b8f245e2c15841fcb48ff94, d39e177261ce9a354b4712f820ada3ee8cd84a277f173ecfbd1bf6b100ddb713 (and 12 more hashes)
- [Domain ] Fabricated/abused domains used for initial contact and infrastructure – humcrm[.]com, tollcrm[.]com (and other crm/consulting domains listed)
- [Heroku Delivery URLs ] Heroku-hosted payload delivery links – signstream-docs-de3fa399b173[.]herokuapp[.]com, collab-sign-8e36fa762841[.]herokuapp[.]com
- [IP Address ] C2 / infrastructure IPs – 172.210.58[.]69 (associated nameserver and overlapping certificates), 162.33.179[.]82
- [File Name ] Lure and persistence artifacts – Udate_Srv.sct (TypeLib hijack scriptlet), .lnk shortcut files used to trigger the loader
Read more: https://research.checkpoint.com/2025/zipline-phishing-campaign/