MalwarePublished 3 May 2025Updated 2 Jun 2025

Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims

Source AlienVault OTX General

Description

Arctic Wolf Labs discovered a new campaign by Venom Spider targeting corporate HR departments with fake resumes containing the More_eggs backdoor. The financially motivated threat group uses spear-phishing emails and abuses legitimate job platforms to apply for real jobs. The backdoor can steal credentials, customer data, and intellectual property. Several upgrades were found, including server-side polymorphism and evasion techniques. The attack chain involves obfuscated JavaScript, LNK files, and a dropper that generates polymorphic code. Organizations are advised to train employees on phishing awareness, especially those in HR who regularly open attachments from unknown senders.

Impact

For European organizations, the Venom Spider campaign represents a considerable risk to confidentiality and integrity of sensitive corporate data. HR departments often have access to personal employee information, recruitment strategies, and sometimes privileged access to internal systems. Successful compromise could lead to credential theft, enabling lateral movement within networks and potential exposure of customer data and intellectual property. This could result in financial losses, reputational damage, regulatory penalties under GDPR for data breaches, and disruption of business operations. The polymorphic nature of the malware complicates detection and response, potentially allowing prolonged undetected access. Given the targeting of HR departments, organizations with high recruitment activity or those in sectors with valuable intellectual property (e.g., technology, pharmaceuticals, finance) are at elevated risk. The campaign's evasion techniques further increase the likelihood of bypassing conventional security controls, making early detection and response challenging.

Defensive guidance

Beyond standard phishing awareness training, European organizations should implement targeted security measures for HR teams, including: 1) Deploy advanced email filtering solutions that incorporate heuristic and behavior-based detection to identify polymorphic and obfuscated payloads; 2) Enforce strict attachment handling policies, such as sandboxing all attachments from external sources, especially those related to job applications; 3) Implement application whitelisting and restrict execution of LNK files and scripts from email attachments or downloads; 4) Use endpoint detection and response (EDR) tools capable of detecting anomalous behaviors associated with backdoors and polymorphic malware; 5) Conduct regular threat hunting focused on indicators of compromise related to More_eggs and Venom Spider TTPs; 6) Enforce multi-factor authentication (MFA) across all systems to limit the impact of credential theft; 7) Maintain up-to-date asset inventories and network segmentation to contain potential breaches; 8) Collaborate with recruitment platforms to verify the authenticity of applicants and monitor for suspicious activity; 9) Establish incident response plans specifically addressing targeted phishing campaigns and backdoor infections.

Indicators of compromise

Domains 14

contactlistsagregator.com
municipiodechepo.org
onlinemail.kz
ryanberardi.com
api.incapdns.kz
blog.jasonlees.com
cast.voxcdn.kz
developer.master.org.kz
doefstf.ryanberardi.com
dtde.ryanberardi.com

Hashes 17

17158538b95777541d90754744f41f58
2da2f53ffd9969aa8004d0e1060d2ed1
46f142198eeeadc30c0b4ddfbf0b3ffd
b1e8602e283bbbdf52df642dd460a2a2
c16aa3276e4bcbbe212d5182de12c2b7
ebb5fb96bf2d8da2d9f0f6577766b9f1
ec103191c61e4c5e55282f4ffb188156
0af266246c905431e9982deab4ad38aaa63d33a725ff7f7675eb23dd75ca4d83
184788267738dfa09c82462821b1363dbec1191d843da5b7392ee3add19b06fb
2fef6c59fbf16504db9790fcc6759938e2886148fc8acab84dbd4f1292875c6c

Yara 2

d68d0668ee588e9229e7c1eb20da20b7b04e15c3Rule to detect More_eggs_Dropper
376c809afd6aad06121e199e70477ad9ebaf0795Rule to detect More_eggs_JavaScript

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Jul 2025, 14:28 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 14

Hashes 17

Yara 2

Community reviews

Related threats