Cisco Talos Blog: Threat actor abuses Gophish to deliver new PowerRAT and DCRAT

Source URL: https://blog.talosintelligence.com/gophish-powerrat-dcrat/
Source: Cisco Talos Blog
Title: Threat actor abuses Gophish to deliver new PowerRAT and DCRAT

Feedly Summary: Cisco Talos recently discovered a phishing campaign using an open-source phishing toolkit called Gophish by an unknown threat actor.

AI Summary and Description: Yes

Summary: The text details the analysis of a sophisticated phishing campaign utilizing the Gophish toolkit, predominantly targeting Russian-speaking users. Key payloads identified include PowerRAT and DCRAT, which leverage various techniques such as malicious Microsoft Word documents and HTML files containing JavaScript. The report highlights the evolving methods of the threat actor and their specific targeting, underlining the campaign’s implications for organizations considering their security measures against such modular infection strategies.

Detailed Description:

– **Campaign Overview:**
– Cisco Talos has identified a phishing campaign using the open-source Gophish toolkit, indicating a trend towards modular infection chains.
– The campaign employs either Maldoc (malicious document) or HTML-based infection methods, which require user intervention to execute.

– **Target Victims:**
– The threat actors demonstrate a focus on Russian-speaking users, leveraging language and cultural elements from phishing emails and malicious documents associated with popular Russian platforms like Vkontakte (VK).

– **Technical Details:**
– **Framework Utilization**: The Gophish toolkit is misused for phishing emails to disseminate malicious links leading to infections.
– **Payload Mechanisms:**
– **PowerRAT**:
– Acts as a remote access tool that can execute commands and scripts on infected machines.
– The infection begins with user interaction via malicious Word documents that run VB macros to install the PowerRAT.
– Reconnaissance is performed on the victim’s machine, gathering user and system data, then the malware tries to connect to a command and control (C2) server in Russia.
– **DCRAT**:
– Delivered via HTML pages linked in phishing emails, it executes JavaScript to download additional payloads.
– Capable of stealing sensitive information and modifying Microsoft Defender settings on compromised machines.

– **Persistence and Evolution:**
– The campaign shows an ability to modify Windows registry keys for persistence even when the user logs in.
– Ongoing development is inferred through placeholder functions within PowerRAT indicating the actor is continuously improving their tools.

– **Security Implications:**
– Addressing the broader implications, the report emphasizes the importance for security professionals to maintain vigilant defenses against evolving threats like DCRAT and PowerRAT.
– Organizations are encouraged to implement multi-layered security solutions that include endpoint protection, web scanning, and email security.
– Tools like Cisco Secure Endpoint and Cisco Secure Email are highlighted as vital for mitigating these threats.

– **Recommendations:**
– Implementation of robust endpoint protection combined with user training to recognize phishing attempts.
– Utilizing multi-factor authentication and continuous monitoring to detect anomalies related to such sophisticated attacks.

This report serves as a significant insight for security professionals, emphasizing the need to stay updated on threat actor tactics and the importance of layered defensive measures against sophisticated phishing and RAT infections.