CampaignPublished 24 Nov 2025

Stories from the SOC: Mystery of the postponed proxyware install

Source AlienVault OTX General

Description

A sophisticated attack chain was uncovered involving a malicious disk-cleaning utility that installed proxyware on a compromised system. The infection used PowerShell scripts, download cradles, and in-memory execution to evade detection and establish a connection to a command-and-control (C2) server. The attack was intercepted before the proxyware installation completed. This incident underscores the dangers of unauthorized software installations and the critical need to restrict PowerShell usage in corporate environments. The threat leverages multiple advanced techniques including obfuscation, living-off-the-land binaries, and scheduled task abuse. Although no known exploits are currently in the wild, the attack demonstrates a medium severity risk due to its potential for stealthy persistence and resource abuse. European organizations should be vigilant, especially those with lax software installation policies and insufficient PowerShell controls.

Impact

For European organizations, this threat poses risks including unauthorized use of computing resources, potential network abuse through proxyware, and exposure to further compromise via persistent backdoors. Proxyware can degrade system performance, cause bandwidth abuse, and implicate organizations in malicious network activities, potentially leading to reputational damage and legal consequences under GDPR if personal data is involved or if the organization is used as a launchpad for attacks. The stealthy nature of the attack, leveraging in-memory execution and living-off-the-land techniques, makes detection difficult, increasing the risk of prolonged undetected presence. Organizations with lax controls on software installation or PowerShell usage are particularly vulnerable. The infection vector via a disk-cleaning utility also highlights supply chain risks and the need for stringent software vetting. The medium severity rating reflects the attack's potential for persistence and resource abuse, though no direct data exfiltration or destructive payload was observed in this case.

Defensive guidance

European organizations should implement strict application control policies to prevent unauthorized software installations, especially utilities downloaded from untrusted sources. PowerShell execution policies should be hardened to restrict script execution to signed scripts only and monitor for unusual PowerShell activity using endpoint detection and response (EDR) tools. Employ network segmentation and egress filtering to detect and block suspicious outbound connections to known malicious domains such as featherstorage.com and others listed in the indicators. Use threat intelligence feeds to update detection rules with the provided file hashes and domains. Implement scheduled task auditing to detect abuse of task scheduling (T1053.005). Conduct regular software supply chain risk assessments and enforce strict software vetting processes. Educate users about the risks of installing unauthorized utilities. Finally, enable in-memory execution detection capabilities and monitor for living-off-the-land binary usage to detect stealthy attacks early.

Summary

This threat involves a multi-stage attack chain initiated by the installation of a seemingly legitimate disk-cleaning utility that was in fact bundled with malicious PowerShell scripts. These scripts leveraged download cradle techniques to fetch additional payloads from domains such as featherstorage.com and others, executing them in-memory to avoid detection by traditional antivirus solutions. The attack utilized living-off-the-land binaries (LOLBins) and scheduled task abuse (T1053.005) to maintain persistence and evade security controls. The proxyware installation, which was the ultimate payload, would have allowed the compromised system to be used as a proxy node, potentially for illicit traffic routing or anonymization services, impacting network integrity and potentially implicating the victim in malicious activities. The use of PowerShell (T1059.001, T1059.003) and obfuscation techniques (T1027) further complicated detection. The SOC team detected suspicious PowerShell activity early, preventing the final proxyware installation. Indicators include multiple file hashes and suspicious domains linked to the attack infrastructure. No CVE or known exploit is associated yet, but the attack chain demonstrates advanced evasion and persistence tactics. This incident highlights the risks posed by unauthorized software installations and the need for strict application whitelisting and PowerShell execution policies.

Indicators of compromise

Domains 6

devicesetupx.com
diskcleanu.com
featherstorage.com
filerit.com
ilesystemwcm.com
maintenancesat.com

URLs 1

http://featherstorage.com/1637.exe

Hashes 7

bfc34934a91a4893817098f73415917a
c9786f9c250feac62315bbc344d154e3
0996ad1e35456a1859bc972c8b31d4ad543409a8
3e131fe553009de2645b0c68a4a731114973ddef040d313028499972d127182d
58a02a4563a875f8f5304d72371e90f1a3a997579c54bd59b69e0ecb9b3b375d
9e694f03742aa171cc0d4c84127e4fc8d3ae187ebb1c6905f144a744ce030577
f05a06f1d20f437764fbdf1e8ed205b1702751e1319f128f8fba9be07f9e4413

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Nov 2025, 09:28 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 6

URLs 1

Hashes 7

Community reviews

Related threats