Operation Red Deer is a targeted Israeli phishing campaign that evolves its attack chain across incidents, leveraging impersonation of Israel Post and HTML smuggling to deliver a malware payload. The actors use AsyncRAT (3LOSH RAT) variants, PowerShell and VBScript stages, and SSL-enabled C2 infrastructure, with consistent attribution to Aggah.
Keypoints
- The operation is named Red Deer because attackers impersonated Israel Post in phishing lures.
- The phishing email asks users to open an attached HTML document to choose a delivery method, pressuring user action.
- The HTML attachment triggers automatic download of an ISO image, a technique known as HTML Smuggling.
- The ISO contains an obfuscated Visual Basic script (.vbs) that fetches and executes a remote PowerShell payload.
- The campaign uses the AsyncRAT family (3LOSH RAT) with consistent configuration details across incidents, including specific hostnames and SSL certificates.
- From 2022 to 2023, the actors changed parts of the execution flow (ZIP vs ISO, .wsf vs .vbs, added pre-stager, port changes, and more stagers) while reusing the same malware family.
- Open directories and SSL-backed C2 infrastructure were used, with multiple IPs and domains tied to the activity and a single certificate footprint across incidents.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The phishing mail is a classic attempt to apply social engineering pressure on the user, informing them of a package waiting for them and that they need to choose their preferred delivery method by opening the attachment. “The phishing mail is a classic attempt to apply social engineering pressure on the user, informing them of a package waiting for them and that they need to choose their preferred delivery method by opening the attachment.”
- [T1059] Command and Scripting Interpreter – The attachment is an .html file which by default will be opened on the user’s browser. “The attachment is an .html file which by default will be opened on the user’s browser.” The .iso image then contains an obfuscated Visual Basic script inside (.vbs): “The .iso image contains an obfuscated Visual Basic script inside (.vbs):”
- [T1027.006] HTML Smuggling – HTML Smuggling is described as the technique used when the HTML document is used to deliver the payload: “HTML documents can store large binary objects known as JavaScript Blobs…” and “This is part of a technique called HTML Smuggling.”
- [T1053] Scheduled Task/Job – The October 2022 campaign notes: “Two additional .bat script stagers were added.” indicating multiple staged execution steps.
- [T1041] Exfiltration Over C2 Channel – The operation uses C2 channels via SSL and a recurring C2 domain/IP infrastructure: “AsyncRAT SSL Certificate C2s” and references to a C2 domain such as “mtest.loseyourip[.]com.” The fingerprint/SSL discussion supports encrypted C2 communication between client and server.
Indicators of Compromise
- [Files] context – RS0494357706Y.html, RS0494357706Y.iso, RS0494357706Y.vbs, UK.jpg, 1981.exe, SF982747231IL.html, SF982747231IL.zip, SF982747231IL.WSF, 578.png, Stub.exe, rs00079617100q.zip, RS00079617100Q.html, RS00079617100Q.iso, MqQQsXQWKe.wsf, t.png, Stub.exe
- [IP Addresses] 38.242.242[.]149, 45.80.158[.]65:222, 194.26.192[.]174:222, 194.26.192[.]174:2005, 45.80.158[.]65:2005
- [Domain Names] superfaster1.is-found[.]org:1981, superfaster22.selfip[.]info:1981, superslow.is-a-nascarfan[.]com:1981, superhay.is-a-geek[.]com:1981, Superziad.is-a-liberal[.]com:1981, ridaq1.is-a-caterer[.]com:2005, ridaq2.is-a-caterer[.]com:2005, Ridaq1.is-a-caterer[.]com:222, mtest.loseyourip[.]com:7777, Mtest.loseyourip[.]com:2005
- [AsyncRAT SSL Certificate C2s] 15[.]204[.]170[.]1, 20[.]169[.]37[.]196, 23[.]254[.]130[.]126, 23[.]254[.]227[.]121, 23[.]254[.]231[.]83, 38[.]242[.]242[.]149, 45[.]80[.]158[.]116, 45[.]80[.]158[.]183, 45[.]138[.]16[.]213, 45[.]154[.]98[.]194, 51[.]81[.]24[.]93, 51[.]81[.]126[.]13, 51[.]89[.]204[.]67, 51[.]89[.]207[.]166, 51[.]161[.]59[.]75, 51[.]161[.]104[.]149
Read more: https://perception-point.io/blog/operation-red-deer/