Stager Targeting Russian Organization

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – The infection relies on a malicious LNK lure that the victim must open to start the chain (‘The LNK was created on June 15, 2026… This LNK downloads a file… and executes a second LNK’).
• [T1105 ] Ingress Tool Transfer – The malware downloads the tar payload from the remote server and later retrieves additional payloads from the C2 (‘This LNK downloads a file named communigatepro.png… from ncloudtechlab[.]online’; ‘URLs to download additional payload’).
• [T1055.012 ] Process Injection: Process Hollowing – Not mentioned.
• [T1218.011 ] System Binary Proxy Execution: Rundll32 – The first LNK invokes rundll32.exe through ShellExec_RunDLL (‘Relative path … rundll32.exe’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – Persistence is created with a RunOnce registry value (‘it creates a RunOnce registry persistence entry … HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunOnce /v LightshotsService’).
• [T1027 ] Obfuscated Files or Information – Command strings and configuration are encoded/encrypted, including AES-CTR decrypted config and XOR-decrypted cookie contents (‘The stager configuration is decrypted using AES in CTR mode’; ‘The Cookie:SESSION= string is XOR decrypted’).
• [T1573.001 ] Encrypted Channel: Symmetric Cryptography – The configuration is decrypted with AES-CTR and tasks are AES-decrypted (‘The stager configuration is decrypted using AES in CTR mode’; ‘receive tasks, AES decrypt them’).
• [T1573.002 ] Encrypted Channel: Asymmetric Cryptography – The beacon is RSA-encrypted before being sent to the C2 (‘RSA encrypts it, base64-encodes it, and sends it to the C2’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – C2 traffic is sent over HTTP/S using WINHTTP (‘The connection to the C2 is implemented via the WINHTTP API’).
• [T1090.002 ] Proxy – The implant performs proxy-aware communications and attempts WPAD and IE proxy configuration discovery (‘the implant attempts WPAD automatic discovery… attempts to use the proxy configured for Internet Explorer’).
• [T1132.001 ] Data Encoding: Standard Encoding – The beacon is base64-encoded before transmission (‘RSA encrypts it, base64-encodes it’).
• [T1056.001 ] Input Capture: Keylogging – Not mentioned.
• [T1106 ] Native API – The malware uses multiple Windows APIs such as WinHttpGetIEProxyConfigForCurrentUser and CreateProcessW (‘implemented via the WINHTTP API’; ‘executed using the CreateProcessW API’).
• [T1021.005 ] Remote Services: VNC – Not mentioned.
• [T1102.001 ] Web Service: Dead Drop Resolver – Not mentioned.
• [T1217 ] Browser Session Cookie – The RSA-encrypted beacon is placed in a Cookie:SESSION header (‘sent to the C2 as a “session cookie” in the request header’).