Operation PhantomCLR Abuses .NET AppDomainManager for Stealthy Malware Execution

Apr 18, 2026 · Original article ↗

Summary

CYFIRMA analyzes Operation PhantomCLR, a campaign targeting Middle East and EMEA financial organizations. It details AppDomainManager hijacking, JIT-based shellcode execution, reflective loading, sandbox evasion and CloudFront-fronted command-and-control.

Key points

The report describes spear-phishing ZIP archives that deliver a disguised .pdf.lnk, a malicious .config file, a .NET DLL, an encrypted payload and a decoy PDF.
A co-located configuration file abuses .NET AppDomainManager to load attacker-controlled code through the signed Intel utility IAStorHelp.exe without modifying the host binary.
The framework delays execution using a 60-second prime-sieve computation and a constrained SHA-256-based AES key derivation loop.
The analysis details a JIT trampoline that overwrites JIT-compiled memory with shellcode, alongside PEB-based API resolution, direct syscalls and reflective DLL loading.
CYFIRMA reports HTTPS command-and-control routed through Amazon CloudFront to backend infrastructure hosted on AWS ELB; it says dynamic analysis observed beaconing.
The report describes memory cleanup and heap-based context recovery, and provides YARA rules and recommendations including AppDomainManager restrictions and DNS monitoring.

Article Details

Attack Vectors: Spear-phishing email delivered a ZIP archive containing a disguised .pdf.lnk shortcut, a signed IAStorHelp.exe host binary, a malicious configuration file and DLL, an encrypted payload, and a decoy PDF.
The user’s execution of the disguised shortcut launched IAStorHelp.exe, which loaded attacker-controlled code through a co-located .NET AppDomainManager configuration.
The framework used a 60-second prime-sieve delay and a constrained AES key-derivation loop to evade automated analysis.
The malware decrypted its payload at runtime, used a JIT-generated memory region to execute shellcode, and reflectively loaded DLLs in memory.
C2 beaconing used HTTPS domain fronting through a CloudFront redirector to backend infrastructure on AWS Elastic Load Balancing.
Defensive Notes: Deploy endpoint detection signatures for the framework and its AppDomainManager hijacking artifacts.
Enforce AppDomainManager restrictions through policy controls and application whitelisting.
Inspect TLS traffic, particularly CDN-bound connections from non-browser processes; IP-based blocking alone may be ineffective against domain fronting.
Block the identified C2 domains at DNS and firewall levels, and review DNS logs for systems that resolved them.
Sweep endpoints for suspicious binaries executing from non-standard paths and use memory forensics and behavior-based monitoring to investigate suspected compromise.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`dp8519iqiftub[.]cloudfront[.]net`	CloudFront-hosted C2 redirector used to route malware communications.
DOMAIN	`dunamis-ethos508-prod-va6-856defacfb833db1[.]elb[.]us-east-1[.]amazonaws[.]com`	Backend C2 infrastructure identified as the destination behind the CloudFront redirector.
SHA256	`4f353b9634509a5e1456e54ccb4ce64c1e6d95094df96048ef79b30cc2fda6cb`	Malware binary hash listed for blocking.
SHA256	`5d784d3ca02ab0015b028f34aa54bc8c50db39f9671dc787bc2a84f0987043b2`	Malware binary hash listed for blocking.
SHA256	`8ba1b0392a8fbfb455c43c4e1408352d0e5fc281148810143a5b64938fb0982f`	Malware binary hash listed for monitoring.
SHA256	`f2266b45d60f5443c5c9304b5f0246348ad82ca4f63c7554c46642311e3f8b83`	Malware binary hash listed for blocking.