Threats Tagged 't1070'

A multi-stage PowerShell loader campaign was identified involving heavily obfuscated PowerShell scripts hosted on Vercel infrastructure. The loaders retrieve and execute payloads such as Grape.exe, UltraToolliteSetup.exe, and draw.io.exe. Obfuscation techniques include Base64 encoding, XOR with the key 'Write', and dynamic IEX command construction. Victims see a decoy 'Verification complete!' message disguised as Google.com during execution. The initial infection vector is unknown, indicating these URLs serve as second-stage delivery points in the attack chain.

A sophisticated multi-stage campaign targets government entities in the Middle East, deploying BINDCLOAK, a previously undocumented 64-bit modular Windows backdoor written in C++. BINDCLOAK is decrypted and reflectively loaded by MIXEDKEY loader as part of a complex attack chain. The backdoor employs advanced techniques including a complex message routing mechanism for C2 communications, EDR evasion to prevent detection of API calls from unbacked executable memory regions, and token manipulation for privilege escalation. Code similarities and shared infrastructure directly connect this activity to the OctLurk backdoor, representing an expansion from Central Asia operations to Middle East targeting with focus on energy sector. The threat actor demonstrates sophisticated development capabilities through custom encryption, modular plugin architecture, and careful operational security measures.