Sharpening the knife: GOLD BLADE’s strategic evolution

MITRE Techniques

• [T1566 ] Phishing (Spearphishing Attachment) – HR-targeted spearphishing with malicious resumes and PDFs used as the initial lure (‘historically targeted human resources (HR) personnel by sending well-crafted spearphishing emails containing malicious documents disguised as resumes, curricula vitae (CVs), or cover letters’).
• [T1204 ] User Execution – Malicious document and link interaction required for initial execution (‘the initial lure used in the STAC6565 campaign is often a resume submitted as a PDF… These PDFs are either weaponized directly or link to externally hosted content’).
• [T1105 ] Ingress Tool Transfer – Downloading payloads from external WebDAV and Cloudflare Workers domains to victim systems (‘uses rundll32.exe to retrieve the initial RedLoader DLL from a WebDAV server hosted behind a Cloudflare Workers domain’).
• [T1574.001 ] DLL Search Order Hijacking / DLL Side‑Loading – Sideloading RedLoader DLLs via renamed legitimate ADNotificationManager.exe and other binaries (‘the .iso or .img file… contains a renamed copy of the legitimate ADNotificationManager.exe… Execution of the legitimate file sideloads the initial RedLoader DLL’).
• [T1053.005 ] Scheduled Task – Creation and use of scheduled tasks to download and execute second- and third-stage payloads (‘the first-stage DLL connects to an external C2 server before creating a scheduled task to download and execute the second-stage payload’).
• [T1218 ] System Binary Proxy Execution (LOLBin abuse) – Using pcalua.exe, rundll32.exe, conhost.exe and other system binaries to execute payloads (‘use of the Program Compatibility Assistant (pcalua.exe) living-off-the-land binary (LOLBin) for payload execution has remained the same’).
• [T1543.003 ] Create or Modify Windows Service – Using NSSM to install Chisel as services and to run SOCKS clients (‘created two distinct Windows service entries pointing to the same Chisel binary… Each service was configured as a SOCKS client to attacker-controlled servers’).
• [T1090 ] Proxy – Tunneling C2 into victim networks via RPivot and Chisel (SOCKS) to reach internal resources (‘deploying RPivot for C2 communications… establishes a connection to remote IP address 109[.]206[.]236[.]209’ and use of Chisel services to attacker servers).
• [T1036 ] Masquerading – Renaming binaries, drivers, and shortcuts and disguising lures to appear legitimate (‘the fake resume drops a ZIP archive containing a .lnk file disguised as a PDF’ and loaders/drivers were renamed to lmhost.exe/lmhost.sys, wmlib.exe/wmlib.sys, etc.).
• [T1112 ] Modify Registry – Disabling Windows security controls by changing registry keys to allow vulnerable driver loading and disable HVCI (‘modified the registry to disable two core Windows security mechanisms… VulnerableDriverBlocklistEnable /d 0x0 … HypervisorEnforcedCodeIntegrity /d 0x0’).
• [T1021.001 ] Remote Services: SMB/Windows Admin Shares – Lateral execution and staging via automated SMB transfers and Impacket remote execution using local admin accounts (‘staged on endpoints across the environment via automated SMB transfers… local admin accounts and Impacket remote execution to run the launcher script’).
• [T1041 ] Exfiltration Over C2 Channel / Web Service – Compressing and transferring collected system discovery data to attacker-controlled WebDAV/Cloudflare Workers endpoints (‘compresses the results into encrypted, password-protected archives via 7-Zip and transfers the data to an attacker-controlled WebDAV server’).