#rogueraticate — Public Fediverse posts

Notable campaign details:

Delivery: email and #RogueRaticate fake updates
Volumes & geos: email campaigns include tens of thousands of emails targeting dozens of industries primarily in North America
Attack chain: tools like 404 TDS, Keitaro TDS, and .URL files exploiting CVE-2023-36025

#FakeSG / #RogueRaticate leading to #netsupportrat

ebodyfit[.]com/wp-content/uploads/ultimatemember/58/downloading-(114.0.522735.199%20(Official%20Build).url

ebodyfit[.]com/wp-content/uploads/ultimatemember/57/consciousnessx.hta

ebodyfit[.]com/wp-content/uploads/ultimatemember/56/housealba.zip

ebodyfit[.]com/wp-content/uploads/ultimatemember/56/clients32.exe

#threatintel #IOCs

They updated the LNK to point to a different HTA which in turn grabs a different NetSupport INI to point at a new gateway. Curious how frequently this group rotates the chain.

Infection chain
compromised site
google-analytiks[.]com/sBY76j
-->
hXXps://esteticalocarno[.]com/wp-content/uploads/2023/02/Install%20Updater%20(V105.215.8412_silent).url
-->
hXXp://185[.]252.179.64:80/Downloads/shdeulerinstall[.]lnk
-->
hXXps://www[.]esteticalocarno[.]com/wp-content/uploads/2018/5/XVXCSASD.hta
-->
NetSupport GatewayAddress 94[.]158.244.41:443

0e74d799e5486979f7cafb3c6bbd8fab224f882b82197eb8975818bd61cbb667 XVXCSASD[.]hta

#FakeSG #RogueRaticate

#FakeSG is back online. URL > LNK > HTA > NetSupport.

Infection chain
compromised site
-->
google-analytiks[.]com/sBY76j
-->
esteticalocarno[.]com/wp-content/uploads/2023/02/Install%20Updater%20(V105.215.8412_silent).url
-->
hXXp://185[.]252.179.64:80/Downloads/shdeulerinstall[.]lnk
-->
www[.]esteticalocarno[.]com/wp-content/uploads/2018/04/HHYGASDBBBX.hta
-->
NetSupport GatewayAddress conluase62[.]com:5051

https://tria.ge/230724-qarsbsde69/behavioral1

#RogueRaticate