ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

MITRE Techniques

• [T1566.002] Spearphishing Link – Phishing emails with URLs leading to malicious archives; “The phishing URL would contain a unique hardcoded URL parameter ‘id’. This ID is necessary to be able to download the lure archive as well as Headlace’s secondary payloads and likely allows ITG05 to track infections through all stages.”
• [T1105] Ingress Tool Transfer – Downloading secondary payloads from a second download site after the initial dropper; “The backdoor uses a second download site to stage secondary payloads.”
• [T1059.005] VBScript – VBScript launcher used to execute the BAT file; “The .VBS launcher uses the Wscript.Shell object to execute the .BAT file.”
• [T1574.001] DLL Search Order Hijacking – DLL hijacking used to run the Headlace payload; “The DLL-hijacking chain involves delivering a legitimate Microsoft Calc.exe binary that is susceptible to DLL-hijacking… The DLL’s main function was overwritten to execute the hidden .CMD file that is the Headlace payload.”
• [T1036] Masquerading – Disguising the dropper as a Windows update script; “In this chain, the threat actor directs the victim to execute the Headlace CMD dropper directly by disguising it as a Windows update script and reporting fake update status messages in the console.”
• [T1027] Obfuscated/Compressed Files and Information – Use of hidden/obfuscated content within a ZIP; “the malicious ZIP file would contain several hidden files and only one visible executable, with a long whitespace-padded filename, in order to hide the extension.”
• [T1003.001] NTLM Credential Dumping – Capturing credentials and attempting exfiltration; “to capture NTLM credentials or SMB hashes of user accounts and attempt to exfiltrate them via the TOR network.”