FIN6, also known as Skeleton Spider, employs sophisticated social engineering tactics leveraging professional job platforms to distribute the Moreeggs backdoor via cloud-hosted malicious infrastructure. Their campaigns utilize fake resumes, CAPTCHA protections, and environmental filtering to evade detection and deliver ransomware and credential theft malware. #FIN6 #Moreeggs #Skeleton_Spider
Keypoints
- FIN6 uses social engineering by impersonating job seekers on platforms like LinkedIn and Indeed to build trust with recruiters before delivering phishing emails.
- The group hosts phishing sites on trusted cloud services such as AWS, leveraging CloudFront, EC2, and S3 to obscure malicious infrastructure and evade detection.
- Phishing emails contain no clickable links, forcing manual URL entry to bypass automated security filters, with domains mimicking real applicant names and anonymized registrations through GoDaddy.
- Malicious landing pages employ traffic filtering including IP reputation, geolocation checks, browser fingerprinting, and CAPTCHA to deliver malware only to targeted human users.
- The More_eggs JavaScript backdoor is deployed via ZIP archives containing disguised .LNK files that execute hidden scripts leading to credential theft and follow-on ransomware operations.
- Persistence is maintained through registry run keys and scheduled tasks, while communication with C2 servers uses HTTPS with spoofed user-agent headers.
- Recommendations include avoiding manual typing of suspicious URLs, blocking execution of .LNK files from unknown ZIPs, monitoring domain registrations for suspicious changes, and enhancing endpoint detection for scripting abuse.
MITRE Techniques
- [T1193] Spear Phishing Link – FIN6 sends phishing emails impersonating job applicants with no clickable links to force manual URL entry (“…non-clickable, no hyperlink (‘bobbyweisman[.]com’) to bypass automated link detection…”).
- [T1566.002] Phishing: Spearphishing Link – Use of social engineering via professional networking platforms LinkedIn and Indeed to establish trust before phishing (“…initiating contact via professional job platforms…posing as enthusiastic job seekers…”).
- [T1204.002] User Execution: Malicious File – Delivery of More_eggs backdoor via ZIP archives containing disguised .LNK files executing hidden JavaScript (“ZIP file contains a disguised .LNK (Windows shortcut) file…LNK file executes hidden JavaScript using wscript.exe”).
- [T1059.006] Command and Scripting Interpreter: Windows Script Host – Hidden JavaScript executed with wscript.exe to launch malware (“LNK file executes hidden JavaScript using wscript.exe”).
- [T1543.003] Create or Modify System Process: Windows Service – Persistence via registry run keys and scheduled tasks (“Persistence: Registry run keys or scheduled tasks HKCUSoftwareMicrosoftWindowsCurrentVersionRun”).
- [T1071.001] Application Layer Protocol: Web Protocols – C2 communication over HTTPS with spoofed User-Agent headers (“C2 Communication: HTTPS with spoofed User-Agent headers Mozilla/5.0 (Windows NT 10.0; Win64; x64)”).
- [T1059.001] Command and Scripting Interpreter: PowerShell – Use of PowerShell with encoded commands for execution (“powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -EncodedCommand “).
- [T1497] Virtualization/Sandbox Evasion – Environmental fingerprinting and behavioral checks including IP, browser, operating system, and CAPTCHA to evade detection (“The site checks for typical Windows browser user-agent strings…CAPTCHA verification…traffic filtering logic”).
Indicators of Compromise
- [Domain] Phishing domains hosted on AWS with fake applicant names – bobbyweisman[.]com, emersonkelly[.]com, davidlesnick[.]com, and others.
- [File Hash] ZIP archives containing More_eggs payload – examples available in referenced GitHub IOC repository (https://github.com/DomainTools/SecuritySnacks/blob/main/2025/Skeleton-Spider-Trusted-Cloud-Malware-Delivery.csv).
- [Email] Generic abuse contact used in Whois for related domains – [email protected].
- [Registry] Persistence run key registry path – HKCUSoftwareMicrosoftWindowsCurrentVersionRun.
Read more: https://dti.domaintools.com/skeleton-spider-trusted-cloud-malware-delivery/