In a sophisticated phishing campaign uncovered by the BI.ZONE Threat Intelligence team, the Squid Werewolf group, also known as APT37, has been impersonating recruiters to target key employees in various organizations.
This espionage cluster masquerades as a legitimate company, sending fake job descriptions via email to lure victims into opening malicious attachments.
The campaign highlights the evolving tactics of threat actors in exploiting well-known brands to gain credibility and access sensitive data.
Phishing Tactics
The attack begins with a phishing email disguised as a job offer from a United Industrial Complex HR representative.
mngs Attachement.pdfThe email contains a password-protected ZIP archive named “Предложение о работе.zip,” which includes a malicious LNK file.
Once opened, this LNK file executes a PowerShell command that decodes a Base64-encoded payload.
The payload is used to create several files, including a .NET executable named “d.exe,” a configuration file “d.exe.config,” and a DLL file “DomainManager.dll.”
According to the Report, these files are placed in the system’s startup folder to ensure persistence.
The “d.exe” executable runs the “DomainManager.dll” dynamic-link library, which is a C#-based loader obfuscated using Obfuscar.
Malware Deployment
The loader performs several checks, including verifying internet connectivity and evading sandbox detection by introducing a delay.
If these checks pass, it modifies registry settings to disable autoruns from the startup folder.
It also decrypts and executes a malicious payload stored in the “DomainManager.conf” file using AES128 CBC encryption.
If this file does not exist, the loader fetches the payload from a remote server.
To protect against such threats, organizations should implement robust email protection solutions that analyze email traffic for suspicious patterns.
Advanced threat detection systems like Endpoint Detection and Response (EDR) are crucial in identifying and mitigating sophisticated attacks.
Understanding the tactics and tools used by adversaries is essential for building an effective cybersecurity strategy.
Leveraging threat intelligence platforms can provide insights into current attacks and help accelerate incident response.
By staying informed and proactive, companies can safeguard their infrastructure against evolving cyber threats.
