Malspam Campaign Abuses Google DoubleClick to Deliver DesckVB RAT
Summary
Researchers report a phishing campaign that routes victims through Google DoubleClick before delivering DesckVB RAT. The infection chain uses multiple loaders, process hollowing, security-tool evasion, and persistence.
Key points
- The campaign begins with an HTML attachment in a phishing email and routes victims through Google DoubleClick to a personalized landing page.
- A ZIP archive delivered from the landing page starts an infection chain involving a JavaScript loader, PowerShell, and a .NET loader.
- The loader checks for analysis tools, disables security controls, establishes persistence, and uses process hollowing to run DesckVB RAT in Microsoft-signed processes.
- The RAT communicates with a command-and-control server over raw TCP sockets and can gather system information, run commands, extract data, and deploy additional payloads.
- The malware patches AMSI and ETW, configures Microsoft Defender exclusions, and uses Registry Run and RunOnce entries and the Startup folder for persistence.
- Huntress recommends restricting script-file execution through Group Policy and using email authentication and attachment/link sandboxing.
Article Details
- Attack Vectors
- A phishing email delivers an HTML attachment that redirects through a Google DoubleClick Campaign Manager click-tracking URL to a landing page.
- The landing page personalizes its lure using the victim's email address and offers a ZIP archive through a “Download PDF” button.
- A JavaScript loader runs a PowerShell script, which fetches a .NET loader that downloads and launches DesckVB RAT.
- Defensive Notes
- Huntress recommends using an Active Directory Group Policy Object to make .vbs, .hta, and .js files open in Notepad by default.
- Huntress recommends DMARC, DKIM, and SPF records to reduce spoofed or malicious email, and an email gateway that sandboxes attachments and links.
MITRE ATT&CK
T1055.012 · Process HollowingThe loader runs DesckVB RAT by injecting it into Microsoft-signed processes using process hollowing.T1059.001 · PowerShellThe JavaScript loader extracts and runs a PowerShell script that fetches a .NET loader.T1095 · Non-Application Layer ProtocolDesckVB RAT communicates with its command-and-control server over raw TCP sockets.T1105 · Ingress Tool TransferThe PowerShell script fetches a .NET loader from an external server, and the loader downloads the RAT payload.T1204.002 · Malicious FileThe infection begins when the victim opens the attached HTML file.T1497.001 · System ChecksThe malware detects sandboxed environments and analysis tools, and may terminate and reboot the machine when it detects them.T1547.001 · Registry Run Keys / Startup FolderThe malware establishes persistence with Run and RunOnce Registry entries and a loader in the user's Startup folder.T1562.001 · Disable or Modify ToolsThe loader neutralizes security controls, while the RAT configures Microsoft Defender exclusions and patches AMSI and ETW.T1566.001 · Spearphishing AttachmentThe campaign delivers an HTML file as an attachment in a phishing email.
People
Malware
Vendors
GoogleResearchers uncovered a malspam campaign that abuses Google’s DoubleClick domain to hide its redirect chain and deliver DesckVB RAT through a phishing email attachment.Microsoftthe RAT payload by using a technique called process hollowing that involves injecting the malware into Microsoft-signed processes.
Products
DoubleClickResearchers uncovered a malspam campaign that abuses Google’s DoubleClick domain to hide its redirect chain and deliver DesckVB RAT through a phishing email attachment.Microsoft Defender Antimalware PlatformOnce launched, the trojan communicates with a command-and-control (C2) server over raw TCP sockets, carries out system reconnaissance, and configures Microsoft Defender exclusions.