Cascading Shadows: Threat Actors Use Stealthy Attack Chain to Bypass Detection and Thwart Analysis

Cybersecurity researchers uncovered a sophisticated attack chain employed by threat actors to distribute infostealers such as Agent Tesla, Remcos RAT, and XLoader.

This campaign leverages a multi-stage delivery mechanism intentionally utilizing simplicity at each step over obfuscation to evade both detection and post-infection analysis.

The attackers harness multiple execution paths and dynamically switch payload deployment methods, significantly increasing the resilience and stealth of their campaigns against traditional security controls.

Analysis of the Attack Vector: From Deceptive Email to Process Injection

The attack originates with a phishing email masquerading as an authentic order release request, using tailored social engineering lures to entice victims to open a malicious archive file.

The attachment, commonly named in the “docxxxx.7z” pattern, contains a .jse (JavaScript Encoded) file disguised as a legitimate document.

Upon execution, the .jse file operates as an initial downloader, fetching and launching a PowerShell script from a remote server.

The PowerShell payload encoded in Base64 serves to deposit its next-stage dropper into a temporary directory, before decoding and executing it.

This stage is a pivot point; analysis reveals that attackers alternate between two dropper architectures: a .NET compiled executable or an AutoIt compiled executable, further complicating static and dynamic detection techniques.

.NET and AutoIt Execution Divergence

In instances where the .NET dropper is employed, the payload encrypted using AES or Triple DES is decrypted on execution and subsequently injected into a legitimate system process, typically RegAsm.exe.

According to Unit42 Report, this injection not only evades common endpoint protection mechanisms but also facilitates the deployment of various malware families, such as Agent Tesla and XLoader.

Alternatively, the use of an AutoIt compiled executable introduces another layer of complexity.

The AutoIt script harbored within is responsible for decrypting and loading shellcode into memory.

This shellcode subsequently injects a .NET assembly into the RegSvcs.exe process, ultimately unpacking and executing a .NET Reactor-protected Agent Tesla variant.

Technical dissection using analysis tools like dnSpy and IDA Pro reveals that both .NET and AutoIt paths employ process injection, memory-only persistence, and dynamic API resolution hallmarks of modern, evasive malware.

Despite the layered architecture, advanced threat analysis engines such as Palo Alto Networks’ WildFire demonstrate strong efficacy in detecting each stage of the attack chain.

Machine learning and behavioral analysis, as provided by Cortex XDR and related products, are critical in identifying and blocking both known and unknown malware variants, credential theft attempts, and post-exploitation activities.

The campaign exemplifies the shift toward modular, multi-path attack delivery, challenging automated and manual analysis workflows.

Security teams are advised to monitor for these techniques, ensure layered defense strategies, and update detection logic to include indicators stemming from both .NET and AutoIt malware variants.

This campaign signals a persistent evolution in adversarial tactics, underscoring the need for robust, adaptive defense-in-depth strategies and continuous intelligence sharing across the cybersecurity community.

Indicators of Compromise (IoCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates