Phishing Campaign Targets Taiwan Facebook Business Accounts With LummaC2 and Rhadamanthys
Summary
Cisco Talos describes a campaign targeting Facebook business and advertising account users in Taiwan with copyright-themed phishing emails that deliver LummaC2 or Rhadamanthys information stealers through evasive loaders.
Key points
- The campaign has targeted Taiwan-based Facebook business and advertising account users since at least July 2024, using traditional Chinese copyright-infringement lures.
- Emails link to downloads through Google Appspot domains, a URL-shortening service and Dropbox, then deliver password-protected RAR archives.
- The archives contain fake PDF executables that run LummaC2 or Rhadamanthys information stealers, which can collect credentials, browser data, cryptocurrency wallet information and other sensitive data.
- Loaders evade analysis and detection through obfuscation, encrypted shellcode, malicious code hidden in resource data, and payloads embedded in legitimate binaries.
- The Rhadamanthys loader expands a file beyond 700 MB, establishes persistence through a Windows Run registry entry, and injects its payload into dialer.exe.
- Talos identified multiple command-and-control domains and published Snort rules 64167–64169; the article also points to a GitHub repository for IOCs.
Article Details
- Attack Vectors
- Phishing emails impersonate company legal departments and use copyright-infringement allegations to lure Facebook business and advertising account users in Taiwan into downloading malicious RAR archives.
- The download chain connects to Appspot.com, redirects through a third-party short URL, and then redirects to Dropbox to deliver the malicious archive.
- The archives contain fake PDF executables that run embedded LummaC2 or Rhadamanthys information stealers, sometimes alongside an additional DLL.
- The Rhadamanthys loader copies itself to a user Documents folder, creates a Run registry entry for persistence, and injects its payload into dialer.exe.
- Defensive Notes
- Talos recommends Cisco Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, Cisco Duo, and Snort protections for detecting or blocking activity described in the report.
- Snort Subscriber Rule Set customers can use Snort SIDs 64167-64169.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loaders use code obfuscation, encrypted shellcode, and obfuscated resource data to conceal malicious code.T1027.001 · Binary PaddingThe Rhadamanthys loader expands its file size to over 700 MB to evade antivirus and sandbox analysis.T1041 · Exfiltration Over C2 ChannelThe information stealers send collected credentials and other victim data back to a C2 server.T1055 · Process InjectionThe loader injects the Rhadamanthys payload into the legitimate dialer.exe process.T1071.001 · Web ProtocolsThe malware communicates with command-and-control servers and sends stolen data; the article describes a POST message using the /api path.T1204.002 · Malicious FileVictims are lured into downloading and running fake PDF executable malware from the phishing archive.T1547.001 · Registry Run Keys / Startup FolderThe loader adds a value named sausageLoop under the current user's Windows Run registry key to execute at startup.T1566.001 · Spearphishing AttachmentThe campaign delivers malware through phishing emails containing malicious download links.
People
Malware
LummaC2encryption, hiding malicious code in resource data to expand the file size to over 700 MB, and embedding LummaC2 or Rhadamanthys information stealers into legitimate binaries. Rhadamanthysmalicious code in resource data to expand the file size to over 700 MB, and embedding LummaC2 or Rhadamanthys information stealers into legitimate binaries.
Vendors
Products
Adaptive Security ApplianceNext-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat. Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks. DropboxThis campaign abuses Google's Appspot[.]com domains, a short URL and Dropbox service, to deliver an information stealer onto the target's machine to avoid network security product detections. FacebookCisco Talos has observed an unknown threat actor conducting a phishing campaign targeting Facebook business and advertising account users in Taiwan. foobar2000information stealers into legitimate binary and the legitimate binary including iMazing Converter, foobar2000, Punto Switcher, PDF Visual Repair, LedStatusApp, and PrivacyEraser. Below shows one of the fileiMazing Converteror Rhadamanthys information stealers into legitimate binary and the legitimate binary including iMazing Converter, foobar2000, Punto Switcher, PDF Visual Repair, LedStatusApp, and PrivacyEraser. Below shows one ofLedStatusAppand the legitimate binary including iMazing Converter, foobar2000, Punto Switcher, PDF Visual Repair, LedStatusApp, and PrivacyEraser. Below shows one of the file details of the fake PDF executable. Meraki MXFirewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat. PDF Visual Repairbinary and the legitimate binary including iMazing Converter, foobar2000, Punto Switcher, PDF Visual Repair, LedStatusApp, and PrivacyEraser. Below shows one of the file details of the fake PDF executable. PrivacyEraserbinary including iMazing Converter, foobar2000, Punto Switcher, PDF Visual Repair, LedStatusApp, and PrivacyEraser. Below shows one of the file details of the fake PDF executable. Punto Switcherstealers into legitimate binary and the legitimate binary including iMazing Converter, foobar2000, Punto Switcher, PDF Visual Repair, LedStatusApp, and PrivacyEraser. Below shows one of the file details of the fakeSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 64167-64169. Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisUmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Countries
Hong Kongis that the fake PDF malware uses the names of well-known technology and media companies in Taiwan and Hong Kong. This provides strong evidence that the threat actor conducted thorough research before launching thisTaiwanCisco Talos has observed an unknown threat actor conducting a phishing campaign targeting Facebook business and advertising account users in Taiwan.