Multi-Stage Phishing Campaign Targets Russia with Amnesia RAT and Ransomware

""The attack begins with social engineering lures delivered via business-themed documents crafted to appear routine and benign," Fortinet FortiGuard Labs researcher Cara Lin said in a technical breakdown published this week. "These documents and accompanying scripts serve as visual distractions, diverting victims to fake tasks or status messages while malicious activity runs silently in the background.""

"The campaign stands out for a couple of reasons. First, it uses multiple public cloud services to distribute different kinds of payloads. While GitHub is mainly used to distribute scripts, binary payloads are staged on Dropbox. This separation complicates takedown efforts, effectively improving resilience."

"The campaign leverages social engineering to distribute compressed archives, which contain multiple decoy documents and a malicious Windows shortcut (LNK) with Russian-language filenames. The LNK file uses a double extension ("Задание_для_бухгалтера_02отдела.txt.lnk") to give the impression that it's a text file. When executed, it runs a PowerShell command to retrieve the next-stage PowerShell script hosted on a GitHub repository ("github[.]com/Mafin111/MafinREP111"), which then serves as a first-stage loader to establish a foothold, readies the system to hide evidence of malicious activity, and hands off control flow to subsequent stages."

A multi-stage phishing campaign targets users in Russia to deliver ransomware and the Amnesia RAT. The campaign uses business-themed decoy documents and accompanying scripts to distract victims while malicious activity runs unnoticed. Operators distribute scripts via GitHub and stage binary payloads on Dropbox, increasing resilience and complicating takedown efforts. The campaign abuses the defendnot utility to disable Microsoft Defender by making Windows believe another antivirus is installed. Malicious archives include decoy documents and a Russian-named LNK with a double extension that executes PowerShell to fetch a GitHub-hosted loader which establishes persistence and hands off subsequent payloads.

Read at The Hacker News