Elastic Details REF6598 Campaign Abusing Obsidian Plugins to Deliver PHANTOMPULSE RAT
Summary
Elastic Security Labs describes REF6598, a LinkedIn- and Telegram-led campaign that abused synced Obsidian plugins to deliver PHANTOMPULL and PHANTOMPULSE on Windows and an AppleScript dropper on macOS. Elastic says it blocked an observed attack early.
Key points
- The campaign used LinkedIn and Telegram social engineering to direct targets in financial and cryptocurrency sectors to an attacker-controlled Obsidian vault and enable community plugin sync.
- Trojanized Shell Commands and Hider plugin configurations enabled code execution when the synced vault was opened; victims had to manually enable plugin syncing.
- On Windows, the PHANTOMPULL loader decrypts and reflectively loads PHANTOMPULSE in memory. The RAT supports remote commands, screenshots, keylogging, and process injection.
- PHANTOMPULSE resolves its C2 through Ethereum transaction data. Researchers found it accepts the newest transaction without checking the sender, allowing a crafted transaction to redirect implants to a sinkhole.
- On macOS, an obfuscated AppleScript dropper uses a LaunchAgent for persistence and Telegram as a fallback for C2 resolution; the researchers said the associated C2 servers were offline during analysis.
- Elastic reports that its behavioral protections blocked the observed intrusion before PHANTOMPULSE executed, and recommends monitoring unusual child processes from Obsidian and enforcing plugin policies.
Article Details
- Attack Vectors
- Operators posing as a venture-capital firm contacted targets on LinkedIn, moved conversations to Telegram, and provided credentials for an attacker-controlled Obsidian cloud vault.
- After victims manually enabled community-plugin sync, trojanized Obsidian Shell Commands configuration executed attacker-defined commands when the vault opened; the Hider plugin concealed interface elements.
- On Windows, the plugin launched PowerShell to download PHANTOMPULL, which reflectively loaded PHANTOMPULSE in memory.
- On macOS, the plugin ran an obfuscated AppleScript dropper that installed a LaunchAgent and used a Telegram channel as a fallback for resolving C2.
- Defensive Notes
- Monitor anomalous child-process creation from Obsidian, including PowerShell, shell, and scripting interpreters.
- Enforce application-level community-plugin policies where possible; vault synchronization alone does not enable or install community plugins, but victims can trigger the chain by manually enabling plugin sync.
- The article reports that Elastic Defend detected and blocked the observed intrusion early, before PHANTOMPULSE executed.
- The researchers report that PHANTOMPULSE accepts the most recent transaction associated with its C2-resolution wallet without verifying the sender; a newer transaction containing a sinkhole URL could redirect infected hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 0x666[.]info | C2 domain used by the macOS dropper to check for an available server. |
| DOMAIN | panel[.]fefea22134[.]net | PHANTOMPULSE C2 domain used to host the panel and deliver the next stage. |
| DOMAIN | thoroughly-publisher-troy-clara[.]trycloudflare[.]com | Previously used PHANTOMPULSE C2 endpoint identified in the article's blockchain transaction analysis. |
| IPV4 | 195[.]3[.]222[.]251 | Payload staging server used to deliver the PowerShell script and PHANTOMPULL loader. |
| SHA256 | 33dacf9f854f636216e5062ca252df8e5bed652efd78b86512f5b868b11ee70f | SHA-256 identified for the PHANTOMPULSE final payload. |
| SHA256 | 70bbb38b70fd836d66e8166ec27be9aa8535b3876596fc80c45e3de4ce327980 | SHA-256 of syncobs.exe, the PHANTOMPULL loader delivered in the Windows chain. |
| SHA256 | 9e3890d43366faec26523edaf91712640056ea2481cdefe2f5dfa6b2b642085d | Sample hash referenced by the article's PHANTOMPULSE YARA rule. |
| URL | hxxp[:]//195[.]3[.]222[.]251/script1.ps1 | Malicious PowerShell stage downloaded by the Windows command chain. |
| URL | hxxp[:]//195[.]3[.]222[.]251/stuk-phase | Attacker endpoint receiving execution-status updates from the PowerShell stage. |
| URL | hxxp[:]//195[.]3[.]222[.]251/syncobs.exe?q=%23OBSIDIAN | URL used to download the PHANTOMPULL loader from the payload staging server. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe macOS dropper constructed sensitive strings at runtime and used fragmented, obfuscated AppleScript strings.T1041 · Exfiltration Over C2 ChannelPHANTOMPULSE sends screenshots, keylogs, and command results to operator-controlled endpoints over its C2 channel.T1055 · Process InjectionPHANTOMPULSE supports process injection, including module stomping and injection of shellcode, DLLs, or EXEs into target processes.T1056.001 · KeyloggingPHANTOMPULSE includes keylogging functionality and uploads keylog data through its C2.T1059.001 · PowerShellThe trojanized Shell Commands plugin launched PowerShell to download and execute the Windows stages.T1059.002 · AppleScriptThe macOS chain used osascript to execute the AppleScript dropper and staged code.T1071.001 · Web ProtocolsPHANTOMPULSE used WinHTTP over HTTPS to communicate with its C2 endpoints and API paths.T1102.001 · Dead Drop ResolverThe macOS dropper scraped a public Telegram channel for a backup C2 domain when its primary domain was unreachable.T1105 · Ingress Tool TransferPowerShell and BitsTransfer downloaded the loader, and PHANTOMPULL fetched the next-stage payload from C2.T1113 · Screen CapturePHANTOMPULSE can capture screenshots and upload them to its C2.T1140 · Deobfuscate/Decode Files or InformationPHANTOMPULL decrypted an AES-256-CBC resource payload, and the next stage decrypted its downloaded payload before loading it.T1547.011 · Plist ModificationThe macOS dropper created a LaunchAgent plist configured to run at login and restart if terminated.T1548 · Abuse Elevation Control MechanismPHANTOMPULSE includes a capability described in the article as escalating to SYSTEM via a COM elevation moniker.T1566.003 · Spearphishing via ServiceOperators used LinkedIn contact and a Telegram conversation to lure targets into accessing the attacker-controlled Obsidian vault.T1620 · Reflective Code LoadingPHANTOMPULL reflectively mapped decrypted PE payloads into memory, and the next stage reflectively loaded PHANTOMPULSE.
Malware
PHANTOMPULLtrojanized Obsidian Shell Commands and Hider plugins for initial access, an in-memory loader called PHANTOMPULL on Windows, and an obfuscated AppleScript dropper with Telegram fallback on macOS.PHANTOMPULSEplugin sync to execute a cross-platform intrusion chain culminating in a novel Windows RAT named PHANTOMPULSE with blockchain-based C2 resolution.
Vendors
Products
Elastic DefendIn the observed intrusion, Elastic Defend detected and blocked the attack at the early stage, preventing the threat actors from achieving their objectives on the victim’s machine.HiderThe campaign used LinkedIn/Telegram lures, trojanized Obsidian Shell Commands and Hider plugins for initial access, an in-memory loader called PHANTOMPULL on Windows, and an obfuscated AppleScript dropper with TelegramLinkedInThe campaign used LinkedIn/Telegram lures, trojanized Obsidian Shell Commands and Hider plugins for initial access, an in-memory loader called PHANTOMPULL on Windows, and an obfuscated AppleScript dropper with TelegramObsidianElastic Security Labs tracked REF6598, a targeted social-engineering campaign that abused Obsidian’s community plugin sync to execute a cross-platform intrusion chain culminating in a novel Windows RAT namedShell CommandsThe campaign used LinkedIn/Telegram lures, trojanized Obsidian Shell Commands and Hider plugins for initial access, an in-memory loader called PHANTOMPULL on Windows, and an obfuscated AppleScript dropper with TelegramTelegramThe campaign used LinkedIn/Telegram lures, trojanized Obsidian Shell Commands and Hider plugins for initial access, an in-memory loader called PHANTOMPULL on Windows, and an obfuscated AppleScript dropper with Telegram
Industries
CryptocurrencyThe campaign, which we track as REF6598, targets individuals in the financial and cryptocurrency sectors through elaborate social engineering on LinkedIn and Telegram.Financial ServicesThe discussion centers around financial services, specifically cryptocurrency liquidity solutions, creating a plausible business context.