MalwarePublished 28 Apr 2025Updated 28 May 2025

Pick your Poison - A Double-Edged Email Attack

Source AlienVault OTX General

Description

A sophisticated cyber-attack campaign has been identified, combining phishing techniques targeting Office365 credentials with malware delivery. The attackers use a file deletion reminder as a pretext, exploiting a legitimate file-sharing service to appear more credible. Upon opening a shared PDF file, users are presented with two hyperlinks: 'Preview' leads to a fake Microsoft login page for credential theft, while 'Download' initiates the installation of ConnectWise RAT malware. The malware establishes persistence through system services and registry modifications. This dual-threat approach emphasizes the need for user vigilance and education in recognizing phishing attempts and suspicious emails.

Impact

For European organizations, this threat poses a substantial risk due to the widespread adoption of Office365 and reliance on cloud-based collaboration tools. Successful credential theft can lead to unauthorized access to sensitive corporate data, email accounts, and cloud services, potentially resulting in data breaches, intellectual property theft, and disruption of business operations. The ConnectWise RAT's persistence mechanisms can facilitate prolonged unauthorized access, enabling attackers to conduct espionage, deploy ransomware, or move laterally within networks. Given the social engineering component, employees unaware of such tactics may inadvertently compromise their organizations. The dual-threat nature amplifies the impact, as organizations must contend with both compromised credentials and malware infections simultaneously. This can strain incident response resources and complicate remediation efforts. Additionally, regulatory frameworks such as GDPR impose strict data protection requirements; a breach resulting from this attack could lead to significant legal and financial penalties for European entities.

Defensive guidance

To mitigate this threat, European organizations should implement a layered defense strategy beyond standard advice. First, enforce multi-factor authentication (MFA) for all Office365 accounts to reduce the risk of credential misuse even if phishing succeeds. Deploy advanced email filtering solutions capable of detecting and quarantining emails containing suspicious links or attachments, especially those leveraging legitimate file-sharing services. Conduct targeted user awareness training focusing on recognizing phishing emails that use plausible pretexts and dual-action links. Implement endpoint detection and response (EDR) tools to identify and block ConnectWise RAT behaviors, including monitoring for unusual service creation and registry changes. Regularly audit and restrict the use of remote access tools like ConnectWise to only authorized personnel and systems. Establish strict application whitelisting policies to prevent unauthorized execution of downloaded files. Finally, maintain up-to-date backups and incident response plans tailored to combined credential theft and malware scenarios to enable swift recovery.

Indicators of compromise

Domains 1

femaxpipeworks.com

Hashes 11

495c7845de1d5bd46884ef03d66d4447
8a17521918bc248d3ef11de3ba36926f
b9cd7bc4f514e595561509de2177e457
d3ed45f0dfadc24c76245b036b3b9738
45edd28311bb576e25807de94995fae83c442ab2
7aa2075082a22abd425c6c3cd03c76e3fc193886
81b043d61cd7044c91f6f3a0eabc79ecab8e47d9
06df948c816fc30e69d3ea30733d0d11989c9bfd68f3d3919ceef3f8410ea1bb
2e9fb32df9b7e36c32a6348f201655f3cc6e1843d4fbcd93174743ec64897e70
aae6ae55eba4ca78041c35694a65ac08a8e6ed54eb377398e93d6a985d7b1cc7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Jun 2025, 16:40 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 11

Community reviews

Related threats