MalwarePublished 11 Jun 2025Updated 11 Jul 2025

Unmasking the Infrastructure of a Spear‑phishing Campaign

Source AlienVault OTX General

Description

Censys researchers uncovered a spear‑phishing campaign where threat actors leveraged a cluster of 16 open directories hosting heavily obfuscated Visual Basic Script (VBS) files. The study analyzes how attackers set up these public-accessible directories to store malicious scripts, the obfuscation techniques employed, and the infrastructure's lifecycle.

Impact

For European organizations, this spear-phishing campaign poses a medium-level risk primarily through targeted social engineering attacks that can lead to remote compromise via RATs. Successful exploitation could result in unauthorized access to sensitive data, espionage, intellectual property theft, and potential lateral movement within networks. The use of obfuscated VBS scripts complicates detection by traditional antivirus and endpoint protection solutions, increasing the likelihood of successful infection. Organizations in sectors with high-value data or strategic importance, such as government, finance, critical infrastructure, and technology, are particularly at risk. The public availability of the infrastructure means the campaign can be scaled or adapted rapidly, increasing exposure. Additionally, the use of multiple RAT families suggests attackers may tailor payloads to specific targets or objectives, increasing the sophistication and potential damage. Disruption to operations, reputational damage, and regulatory consequences under GDPR for data breaches are possible impacts for European entities. The medium severity reflects the need for vigilance but also acknowledges that exploitation requires user interaction (opening spear-phishing attachments) and does not exploit zero-day vulnerabilities.

Defensive guidance

1. Implement advanced email filtering solutions capable of detecting and blocking spear-phishing attachments, especially those containing obfuscated scripts like VBS files. 2. Deploy endpoint detection and response (EDR) tools with behavioral analysis to identify suspicious script execution and RAT activity beyond signature-based detection. 3. Conduct regular user awareness training focused on recognizing spear-phishing attempts and the risks of opening unsolicited attachments, particularly VBS files. 4. Restrict execution of scripts from user directories and network shares using application control policies such as Microsoft AppLocker or Windows Defender Application Control. 5. Monitor network traffic for unusual outbound connections, especially to non-standard ports or known RAT command and control infrastructure. 6. Regularly audit and secure public-facing infrastructure to prevent attackers from leveraging open directories or misconfigured services. 7. Employ threat intelligence feeds to stay updated on emerging indicators related to this campaign and proactively block associated IPs or domains. 8. Enforce the principle of least privilege to limit the impact of potential compromises and segment networks to contain lateral movement. 9. Use multi-factor authentication (MFA) to reduce the risk of credential theft exploitation following initial infection. 10. Establish incident response plans tailored to malware infections involving RATs and spear-phishing to enable rapid containment and remediation.

Indicators of compromise

Domains 9

dcupdate.duckdns.org
dgflex.duckdns.org
gotemburgoxm.duckdns.org
purelogs2025.duckdns.org
rem25rem.duckdns.org
remc21.duckdns.org
romanovas.duckdns.org
sosten38999.duckdns.org
trabajonuevos.duckdns.org

URLs 11

http://154.26.154.57:2404
http://186.169.80.199:1515
http://193.142.146.50:2404
http://193.23.3.29:2404
http://213.199.55.238:5555
http://213.209.150.22:55140
http://216.250.253.13:2404
http://45.133.180.26:3010
http://45.141.233.60:55330
http://78.142.18.221:2401

IP addresses 10

154.26.154.57CC=US ASN=AS141995 contabo asia private limited
186.169.80.199CC=CO ASN=AS3816 colombia telecomunicaciones s.a. esp
193.142.146.50CC=NL ASN=AS208046 maximilian kutzner
193.23.3.29CC=DE ASN=AS207083 hostslim b.v.
213.199.55.238CC=CA ASN=AS9009 m247 ltd
213.209.150.22CC=TR ASN=AS39144 redes digitales de telecomunicacion en internet sl
216.250.253.13CC=US ASN=AS396073 majestic hosting solutions llc
45.141.233.60CC=BG ASN=AS25211 euro crypt eood
78.142.18.221CC=NL ASN=AS208046 maximilian kutzner
89.117.77.234CC=LT ASN=ASNone

Hashes 35

1e768bd3a48253dd4b61c0ffead91488MD5 of 657e021f0dfdd8c628a428a824da278d14d674aefd248f86a58f5bbe4472f0dc
3aabc215331102df8f2a93ce097d37dbMD5 of b7d205a1560b07a92d744053744c29823064e2c415a71887fccd8524a3cad3fb
7c49b97157ded99194130320e884c697MD5 of d8119df3e735dba78bc6c528f2737d8acb2e87f442596c810afcb5fa85261ad5
d867cb352bc3d5854f18282d03f191efMD5 of 4297de28d569560bf2cd287e1a44771ec4f8deac993cb69b54b36fa497af52d3
0012bb17a84a2ef674f69c1373e2868f6e3d6811SHA1 of d8119df3e735dba78bc6c528f2737d8acb2e87f442596c810afcb5fa85261ad5
0592a174dcc1420909aa22c7f0641602d2ac4a2f
2a8ab6d18d53f25f826cb0cefbda28a7a61c2f77
4fd7a9efb3b42ecd8931f799fe6a821f2dc7b136SHA1 of b7d205a1560b07a92d744053744c29823064e2c415a71887fccd8524a3cad3fb
662da402d2a6e13e0cbc8792b84a7c4a8fe2fba7SHA1 of 4297de28d569560bf2cd287e1a44771ec4f8deac993cb69b54b36fa497af52d3
9963a857a61525ee23bb8727a0b8ad8f4c09b162

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Jul 2025, 05:46 UTC

MITRE ATT&CK techniques6 from threat tags

Technical details