Kaspersky Finds WhatsApp VBScript Campaign Installing ManageEngine RMM Central
Summary
Kaspersky reports a WhatsApp campaign using disguised VBScript attachments to install ManageEngine RMM Central. The infection chain varies by WhatsApp Web or Desktop; account compromise is suspected, but the method is unclear.
Key points
- Kaspersky reports the campaign targets WhatsApp Web and Desktop users across multiple countries, with the highest concentration in Malaysia.
- Attachments disguised as business or financial documents are delivered through WhatsApp direct messages.
- On WhatsApp Web, users must download and open the file; on Desktop, WhatsApp.Root.exe can spawn WScript.exe to run it.
- The obfuscated VBScript fetches additional scripts, including one that attempts to tamper with Windows UAC behavior and another that downloads and runs the ManageEngine RMM Central installer.
- Kaspersky suspects some WhatsApp accounts were accessed and used to distribute the files, but says how they were compromised is unclear.
- Kaspersky observed infrastructure overlap with activity previously linked to Gh0st RAT and ValleyRAT; the campaign remains unattributed.
Article Details
- Attack Vectors
- Malicious VBScript files disguised with business or financial document names are distributed through WhatsApp direct messages.
- Recipients execute the attachment after downloading it in WhatsApp Web, or it is executed through WhatsApp Desktop, where WhatsApp.Root.exe spawns WScript.exe.
- The VBScript downloads and runs additional VBScript components and a ZIP file containing the ManageEngine RMM Central installation package.
- Defensive Notes
- Be cautious with unexpected WhatsApp attachments, including those that appear to come from known contacts.
- Do not open script or executable files such as VBS, VBE, EXE, BAT, CMD, JS, and PS1 unless their legitimacy has been independently verified.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 202[.]61[.]160[.]201 | Infrastructure overlapping with prior activity linked by Kaspersky to Gh0st RAT and ValleyRAT. |
MITRE ATT&CK
T1036 · MasqueradingThe VBScript files use business and financial document names to appear harmless.T1059.005 · Visual BasicWScript.exe launches the malicious VBScript, which runs additional VBScript components.T1105 · Ingress Tool TransferThe VBScript downloads additional VBScript components and a ZIP file containing the ManageEngine RMM Central installation package.T1204.002 · Malicious FileThe infection chain depends on recipients opening the downloaded VBScript, believing it to be a legitimate document.T1219 · Remote Access ToolsThe infection chain installs legitimate ManageEngine RMM Central software to enable remote access to victims’ systems.T1566.003 · Spearphishing via ServiceMalicious attachments are distributed to recipients through WhatsApp direct messages.
People
Malware
Gh0st RATThe operation targets users across multiple countries, often using deceptive business-document filenames and infrastructure overlaps linked to Gh0st RAT and ValleyRAT.ValleyRATThe operation targets users across multiple countries, often using deceptive business-document filenames and infrastructure overlaps linked to Gh0st RAT and ValleyRAT.
Products
Countries
AustraliaPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.BrazilPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.IndiaPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.MalaysiaPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.MexicoPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.RussiaPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.SingaporePer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.SpainPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.TaiwanPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.United KingdomPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.VietnamPer findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsApp Web across Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, Australia, Russia, and Vietnam.