Larva-24009 Uses Phishing to Deploy PowerShell Backdoors and Steal Data
Summary
AhnLab reports that Larva-24009 continues phishing attacks in 2026, using malicious LNK files to deploy PowerShell backdoors, remote-control tools, and credential- and information-stealing tools.
Key points
- Phishing emails deliver LNK files disguised as documents, using lures such as surveys, project proposals, blockchain topics, and resumes.
- Opening an LNK runs an obfuscated PowerShell command that creates a decoy file and downloads additional scripts.
- PowerShell scripts download payloads, establish persistence through scheduled tasks, capture screenshots, and disable Windows Defender.
- The attackers use QuasarRAT and UltraVNC for remote control; evidence also suggests RDP access and a script that creates a backdoor account.
- NirSoft tools, custom keyloggers, and screenshot scripts are used to collect credentials and other information from infected systems.
- A notifier version uses the Telegram API to report infection status; AhnLab provides associated hashes, URLs, domains, and IP addresses as IOCs.
Article Details
- Attack Vectors
- Phishing emails deliver LNK files disguised as document files. When executed, an obfuscated PowerShell command creates and runs a decoy file and downloads and executes another PowerShell script.
- PowerShell scripts download and execute additional payloads from command-and-control infrastructure, establish persistence through scheduled tasks, capture screenshots, and disable Windows Defender.
- The actor installs QuasarRAT and UltraVNC Server for remote control and is believed to also use RDP. A batch script on the download server adds a backdoor account named “_BootUEFI_”.
- Information gathering includes credential and browser-data collection with NirSoft tools, screenshot capture, and keylogging.
- Defensive Notes
- Exercise caution with email attachments and executable files from unknown sources.
- Update V3 to the latest version to help prevent malware infection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aonexa[.]shop | Domain hosting a C2 payload-download URL. |
| DOMAIN | final[.]mainsec2[.]site | Domain hosting attacker-used tool download URLs. |
| DOMAIN | mainsec[.]site | Listed as an FQDN in the article's threat IOC section. |
| DOMAIN | pozeny[.]shop | Listed as an FQDN in the article's threat IOC section. |
| DOMAIN | serverdock[.]online | Listed as an FQDN in the article's threat IOC section. |
| IPV4 | 217[.]77[.]6[.]50 | IP indicator listed in the article's threat IOC section. |
| MD5 | 10b40185106eb3760cb71c46117aa0bf | MD5 indicator listed in the article's threat IOC section. |
| MD5 | 1500fefcdda275b70e2051a3e7d9f794 | MD5 indicator listed in the article's threat IOC section. |
| MD5 | 2973fda8d0d0fa0200a05889fce85df6 | MD5 indicator listed in the article's threat IOC section. |
| MD5 | 444fb3592cd1848660259a913684795b | MD5 indicator listed in the article's threat IOC section. |
| MD5 | 4ad28d0313549e98383144d82982be6e | MD5 indicator listed in the article's threat IOC section. |
| URL | hxxp[:]//aonexa[.]shop/candy/res/get-command[.]php | C2 URL used to download additional payloads. |
| URL | hxxp[:]//final[.]mainsec2[.]site/secsec/tool/ChromePass[.]exe | Attacker-used download URL for a credential-recovery tool. |
| URL | hxxp[:]//final[.]mainsec2[.]site/secsec/tool/LastActivityView[.]exe | Attacker-used download URL for an information-gathering tool. |
| URL | hxxp[:]//final[.]mainsec2[.]site/secsec/tool/netpass[.]exe | Attacker-used download URL for a network-password recovery tool. |
| URL | hxxp[:]//final[.]mainsec2[.]site/secsec/tool/WebBrowserBookmarksView[.]exe | Attacker-used download URL for an information-gathering tool. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article says the actor is believed to control infected systems by exploiting RDP.T1041 · Exfiltration Over C2 ChannelThe malware submits system information and sends screenshots through the C2 infrastructure.T1053.005 · Scheduled TaskPersistence is maintained by registering tasks in Windows Task Scheduler.T1056.001 · KeyloggingKeylogger malware records keystrokes and stores the data in log files.T1059.001 · PowerShellObfuscated PowerShell commands and downloaded PowerShell scripts execute payloads and perform backdoor functions.T1102.002 · Bidirectional CommunicationNotifier version 2.1 uses the Telegram API to send infection status reports to the actor.T1105 · Ingress Tool TransferPowerShell downloads scripts and additional payloads from the C2 server.T1113 · Screen CapturePowerShell scripts capture screenshots, which are sent to the C2 server.T1136.001 · Local AccountA batch script adds a backdoor account named “_BootUEFI_”.T1204.002 · Malicious FileThe infection begins when a user executes a malicious LNK disguised as a document.T1219 · Remote Access ToolsUltraVNC Server and QuasarRAT are installed for remote control of infected systems.T1562.001 · Disable or Modify ToolsA PowerShell script disables Windows Defender.T1566.001 · Spearphishing AttachmentPhishing emails deliver LNK malware as attachments.
Threat Actors
Malware
NotifierAs in previous cases, the Notifier malware was used; however, unlike past PowerShell scripts that used the same C&C server address, version 2.1 Uses the Telegram API to send infection status reports to the threat actor.QuasarRATThe Larva-24009 threat actor installs a PowerShell backdoor through LNK malware and subsequently maintains persistence by installing remote control tools such as QuasarRAT and UltraVNC.
Vendors
Products
TelegramAs in previous cases, the Notifier malware was used; however, unlike past PowerShell scripts that used the same C&C server address, version 2.1 Uses the Telegram API to send infection status reports to the threat actor.UltraVNCThe Larva-24009 threat actor installs a PowerShell backdoor through LNK malware and subsequently maintains persistence by installing remote control tools such as QuasarRAT and UltraVNC.V3Also, V3 should be updated to the latest version so that malware infection can be prevented.Windows DefenderIn addition, PowerShell scripts responsible for maintaining persistence, as well as those responsible for functions such as capturing screenshots and disabling Windows Defender, have been identified.
Tools
ChromePassViewChromePassViewLastActivityViewLastActivityViewNetwork Password RecoveryNetwork Password RecoveryPowerShellThe Larva-24009 threat actor installs a PowerShell backdoor through LNK malware and subsequently maintains persistence by installing remote control tools such as QuasarRAT and UltraVNC.UltraVNC ViewerOnce UltraVNC Server is installed on the infected system, it opens ports such as 5800 and 5900 depending on the configuration, allowing the threat actor to achieve remote control of the screen through UltraVNC Viewer.WebBrowserBookmarksViewWebBrowserBookmarksView