CampaignPublished 26 Jun 2025

Hacker Exploit Social Security Statement Theme to Target Over 2,000 Victims with Malware

Source AlienVault OTX General

Description

A sophisticated phishing campaign has targeted over 2,000 individuals by exploiting the theme of official Social Security statements. Cybercriminals used a convincing phishing lure, mimicking legitimate communication from the Social Security Administration. The attack involved a URL directing victims to a phishing page hosted on Amazon Web Services, enhancing its perceived legitimacy. Users were tricked into downloading and executing malware, which is a .NET application loader that installs ScreenConnect, establishing a silent connection to the attacker's command-and-control server. The malware's behavior includes loading additional files and executing a primary backdoor component. The campaign's impact is significant, with a large percentage of targeted users unknowingly installing the malware.

Impact

For European organizations, this campaign poses a substantial risk primarily through social engineering targeting employees or individuals who might receive phishing emails referencing social security or similar government benefits. Although the Social Security Administration is a U.S. entity, European users might be targeted via similar themed phishing lures adapted to local social welfare or tax authorities. Successful compromise could lead to unauthorized remote access via ScreenConnect, enabling attackers to steal sensitive data, deploy ransomware, or conduct espionage. The use of AWS-hosted phishing infrastructure may bypass some network security controls, increasing infection likelihood. The stealthy nature of the .NET loader and backdoor complicates detection, potentially allowing prolonged attacker presence. This could impact confidentiality, integrity, and availability of organizational data and systems. Additionally, the campaign’s scale and use of legitimate remote access tools increase the risk of widespread compromise if phishing emails are distributed broadly within European organizations. The campaign also highlights the ongoing threat of phishing and the need for robust user awareness and endpoint security measures.

Defensive guidance

1. Implement advanced email filtering solutions that can detect and block phishing emails, especially those impersonating government agencies or containing links to cloud-hosted phishing pages. 2. Employ domain and URL reputation services to identify and block access to malicious domains such as 'secure.ratoscbom.com' and other known phishing infrastructure. 3. Enforce strict application whitelisting and endpoint protection to prevent execution of unauthorized .NET loaders and suspicious binaries. 4. Monitor for unusual use of legitimate remote access tools like ScreenConnect, including unexpected installations or connections outside normal business hours. 5. Conduct targeted user training focused on recognizing phishing attempts that impersonate government or social welfare communications, emphasizing verification of sender authenticity and cautious handling of unsolicited attachments or downloads. 6. Utilize network segmentation and least privilege principles to limit the potential lateral movement of attackers if initial compromise occurs. 7. Deploy endpoint detection and response (EDR) solutions capable of detecting obfuscated code execution, command interpreter abuse, and anomalous network connections to C2 servers. 8. Regularly update and patch systems to reduce the attack surface, even though no specific CVEs are identified here, to maintain overall security hygiene. 9. Establish incident response playbooks for phishing and remote access tool abuse scenarios to enable rapid containment and remediation.

Indicators of compromise

Domains 1

secure.ratoscbom.com

Hashes 3

bc219ea52e5d250b689bfb0203eb9e4e
97997862c73cfe301af43c355ffa4b2d8b1e7d7f
1c939551452b2137b2bd727f13fab80da192f174d0311d23fc3c1c531cefdc87

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Jun 2025, 21:35 UTC

MITRE ATT&CK techniques9 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 3

Community reviews

Related threats