Microsoft ATP

Finance-themed emails found in environments protected by Cisco Ironport and Microsoft ATP deliver an attached PDF that contains a link to a WSF script. When run, the WSF is used to a chain of a JSDropper, Malicious Batch Script, Python Installer, and VBS scripts that run multiple instances of DcRAT, Async RAT, Pure RAT, and Venom RAT in memory. At the time of analysis, additional payloads from other campaigns have been found.

Australian Taxation Office-spoofing, taxes-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an attached PDF that contains an embedded link to a Malicious Downloader. The downloader is used to deliver ConnectWise RAT.

Finance-themed emails found in environments protected by Proofpoint and Microsoft ATP deliver a JSDropper via an embedded URL. The JSDropper drops and runs a PowerShell Script which delivers a DotNETLoader and Agent Tesla Keylogger.

Benefits-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an attached PDF file that contains a QR code to a credential phishing site.

Fidelity-spoofing campaign found in environments protected by Microsoft ATP and Cisco IronPort delivers Itarian RAT via an embedded URL.

Taxes-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver a Nullsoft Installer via an embedded URL to an Adobe-spoofing site. The Nullsoft Installer delivers Datto RMM.

Microsoft-spoofing emails found in environments protected by Abnormal Security and Microsoft ATP deliver an embedded link to an OAuth 2.0-based Credential Phishing site.

Booking.com-spoofing emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a fake CAPTCHA website that delivers a malicious PowerShell Script to the clipboard. When run, the script delivers PureRAT.

Voicemail-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an attached PDF that contains a link to an OAuth 2.0-based Credential Phishing site.

Microsoft-spoofing emails found in environments protected by Microsoft ATP deliver a multi-stage ConnectWise RAT via an embedded URL.

Griffin Editions-spoofing emails found in environments protected by Microsoft ATP, Proofpoint, Cisco IronPort, and Check Point delivers Sectop RAT via an embedded URL to a fake CAPTCHA that prompts to run a PowerShell script from clipboard.

Griffin Editions-spoofing emails found in environments protected by Microsoft ATP, Proofpoint, Cisco IronPort, and Check Point delivers Sectop RAT via an embedded URL to a fake CAPTCHA that prompts to run a PowerShell script from clipboard.