Operation ForumTroll continues: Russian political scientists targeted using plagiarism reports

MITRE Techniques

• [T1059.001 ] PowerShell – Used to execute a downloader script launched by the shortcut to fetch and run the payload. (‘When the user clicked the shortcut, it ran a PowerShell script.’)
• [T1105 ] Ingress Tool Transfer – The PowerShell script retrieved the final DLL payload from a remote URL on the malicious site. (‘Contacted a URL in the format: https://e-library[.]wiki/elib/query.php?id=&key= to retrieve the final payload, a DLL file.’)
• [T1546.011 ] COM Hijacking – Persistence was achieved by writing the DLL path into a CLSID InProcServer32 registry key to hijack COM component loading. (‘writing the path to the DLL file into the registry key HKCRCLSID{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}InProcServer32.’)
• [T1027 ] Obfuscated Files or Information – The final loader was OLLVM-obfuscated to impede analysis and detection. (‘The DLL file deployed to infected devices proved to be an OLLVM-obfuscated loader.’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – C2 communications and payload hosting used HTTP/S and fastly.net hostnames for command-and-control. (‘As in the previous campaign, the attackers used fastly.net as C2 servers.’)
• [T1204 ] User Execution – The attack relied on social engineering (clicking the link, downloading the archive, and opening the shortcut and decoy PDF) to execute the malicious payload. (‘The downloaded archive was named with the victim’s last name, first name, and patronymic.’ and ‘This PDF was saved to the user’s Downloads folder … and then opened automatically.’)