From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting  Russian Aerospace Organizations  

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – Used a targeted email with a password-protected archive attachment to deliver the initial payload [‘The email contains a password-protected archive named счет на оплату.rar.’]
• [T1204.002] User Execution: Malicious File – Relied on the recipient opening and executing the attached archive and extracted files [‘to open it and so scanners cannot inspect content’]
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – Used .cmd and batch scripts to execute downloader, extraction, persistence, and cleanup actions [‘it also runs the batch file’, ‘xml_file.cmd is trying to connect to the C2’]
• [T1059.001] Command and Scripting Interpreter: PowerShell – The report’s MITRE mapping states PowerShell was used, indicating script-based execution was part of the campaign [‘Command and Scripting Interpreter: PowerShell’]
• [T1053.005] Scheduled Task/Job: Scheduled Task – Created a scheduled task named “Auto apdate” to run at user logon for persistence [‘Creates a scheduled task named “Auto apdate” that executes Trays.exe -tray at user logon’]
• [T1547] Boot or Logon Autostart Execution – Achieved autostart by using a scheduled task that launches on logon [‘at user logon’]
• [T1036] Masquerading – Impersonated a legitimate Russian institute and used lookalike domains to appear trusted [‘The phishing email impersonates a legitimate Russian research institute’, ‘freshly registered’]
• [T1027] Obfuscated Files or Information – Used password-protected archives to prevent inspection by security tools [‘The password was placed in the email body so the victim can open it and so scanners cannot inspect content’]
• [T1564.003] Hide Artifacts: Hidden Window – Used Tray Minimizer to conceal the AnyDesk interface and reduce visibility [‘additional utilities such as Tray Minimizer are used to reduce user visibility’, ‘conceal the remote access activity’]
• [T1070.004] Indicator Removal on Host: File Deletion – Deleted temporary scripts, archives, executables, and PDFs to reduce forensic evidence [‘Deletes temporary command (.cmd), text (.txt), archive (.rar), executable (.exe), and PDF (*.pdf) files’]
• [T1071.001] Application Layer Protocol: Web Protocols – Downloaded the malicious RAR file from C2 using web-based retrieval logic [‘connect to the C2 to download the malicious rar file’]
• [T1219] Remote Access Software – Deployed and configured AnyDesk for unattended remote access [‘establish persistent remote access by silently configuring AnyDesk for unattended access’]
• [T1560] Archive Collected Data – Packed AnyDesk configuration and related files into an archive before exfiltration [‘Creates archive AnyDesk.rar with password limpid2903392 containing configuration files’]
• [T1005] Data from Local System – Collected AnyDesk service.conf and system.conf files from the infected host [‘These are the contents of AnyDesk’s service.conf and system.conf files’]
• [T1020] Exfiltration Over Alternative Protocol: Exfiltration Over Email – Sent the archive out via SMTP using Blat [‘The archive is subsequently exfiltrated via SMTP using Blat’]