Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – Victims were induced to download and run trojanized installers and archives (‘downloaded a trojanized windirstat.exe installer’, ‘click a top search result that led to a malicious domain’).
• [T1036 ] Masquerading – Malicious files and infrastructure impersonated legitimate software and services (‘trojanized software downloads’, ‘masquerading as a windirstat.exe installer’, ‘CrowdStrike-typosquat’).
• [T1055 ] Process Injection – The article describes malicious stages spawning and loading components into execution chains to carry out payload delivery (‘spawns three child processes’, ‘drops and loads Adblock.dll’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence was established with scheduled tasks mimicking legitimate Windows tasks (‘registers a scheduled task named Maps Performance Task’, ‘OOBETaskScheduler’).
• [T1105 ] Ingress Tool Transfer – Payloads and scripts were downloaded from remote hosts during execution (‘download t.ps1’, ‘downloads and sets up the environment needed to execute both backdoors’).
• [T1218.011 ] System Binary Proxy Execution: Rundll32 – A DLL was dropped and loaded to execute malicious functionality (‘drops and loads Adblock.dll’).
• [T1027 ] Obfuscated Files or Information – The campaign used Base64, XOR, and steganography to hide configuration and payloads (‘Base64-encoded fingerprint’, ‘LSB steganography’, ‘Base64-decoding followed by an XOR decryption routine’).
• [T1090 ] Proxy – The WebSocket tunneling RAT supported TCP and UDP tunneling to relay traffic (‘supports TCP and UDP tunneling’).
• [T1195.002 ] Supply Chain Compromise: Compromise Software Supply Chain – The operation distributed trojanized legitimate utilities to infect users (‘Bluetooth driver’, ‘WinDirStat’, ‘legitimate application’).
• [T1566.002 ] Phishing: Spearphishing Link – Users were lured through links in video descriptions and redirect chains (‘links in the description’, ‘intermediary sites’).
• [T1112 ] Modify Registry – The malware altered registry values to hide software and support persistence (‘setting SystemComponent=1 in the registry’).
• [T1057 ] Process Discovery – Collected system identifiers and environment details from victims (‘MachineGuid, hostname and operating system details’).
• [T1041 ] Exfiltration Over C2 Channel – Results and telemetry were sent back through the command-and-control channel (‘Results are reported back to the /e endpoint’, ‘Install telemetry is reported’).