Threats Tagged 'blockchain c2'

This threat describes a FakeAgent intrusion campaign discovered through an automated threat hunting agent within ten minutes. The campaign used malvertising on Bing to distribute trojanized Claude Desktop installers hosted on legitimate Anthropic infrastructure. The attack chain involved DLL sideloading via Java Chromium Embedded Framework, tampering with Microsoft Defender, scheduled task persistence disguised as Microsoft Edge updates, and blockchain-based command-and-control infrastructure using EtherHiding techniques. The intrusion deployed SectopRAT malware, which has infostealing and remote desktop capabilities, necessitating full endpoint reimaging and credential resets.

A sophisticated multi-stage loader dubbed PavinLoader has been identified across multiple distribution campaigns including ClickFix attacks, fake software downloads, and malicious RenPy games. The loader employs heavily obfuscated .NET DLLs, abuses legitimate Windows tools like MSBuild, and utilizes EtherHiding technique to retrieve command-and-control domains via blockchain. The infection chain consists of four main stages: a Loader DLL performing anti-forensics, an EtherHiding Loader obtaining C2 infrastructure, an Anti-Analysis DLL checking for virtualized environments, and a PE Loader delivering final payloads including Amatera Stealer. Evidence suggests PavinLoader may be offered as a Loader-as-a-Service, with common artifacts found across over 200 related files. The campaigns demonstrate sophisticated evasion techniques including custom obfuscation, API hashing, and extensive anti-analysis checks targeting virtualized environments and specific geographic regions.