Multi-Stage Phishing Campaign Targets Russia with Amnesia RAT and Ransomware

Multi-Stage Phishing Campaign Targets Russia with Amnesia RAT and Ransomware

A recent phishing campaign is targeting users in Russia, deploying both Amnesia RAT for remote access and a Hakuna Matata ransomware variant. The campaign is notable for its multi-stage approach and use of legitimate cloud services like GitHub and Dropbox to distribute malicious payloads.

Why This Matters

Modern malware increasingly avoids direct software vulnerabilities, instead exploiting misconfigurations and abusing legitimate system tools. This campaign demonstrates a shift towards leveraging native Windows features and administrative tools for malicious purposes, bypassing traditional security measures and increasing the scale of potential compromise – a successful attack can lead to data theft, financial fraud, and system disruption, with the cost of remediation potentially reaching millions of dollars.

Key Insights

• Defendnot Abuse, 2024: A tool designed to bypass Microsoft Defender by falsely reporting another antivirus is present.
• Cloud Service Resilience: Utilizing GitHub for scripts and Dropbox for binaries complicates takedown efforts, increasing campaign longevity.
• PowerShell as a Loader: PowerShell is used extensively for initial access, payload staging, and evasion techniques.

Working Example

# Example of a PowerShell command used in the campaign (simplified)
# This is a demonstration and should not be executed.
import subprocess

command = "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File malicious_script.ps1"
try:
    result = subprocess.run(command, shell=True, capture_output=True, text=True, check=True)
    print("Script executed successfully.")
    print("Output:", result.stdout)
except subprocess.CalledProcessError as e:
    print("Error executing script:", e)
    print("Error output:", e.stderr)

Practical Applications

• Enterprise Security: Organizations should implement robust email filtering, user awareness training, and endpoint detection and response (EDR) systems.
• Pitfall: Relying solely on signature-based antivirus detection is insufficient against fileless malware and dynamic payloads.