Phishing Campaign Uses Gophish to Deliver PowerRAT and DCRAT
Summary
Cisco Talos details a campaign targeting Russian-speaking users with phishing emails sent through Gophish. Malicious Word documents deploy PowerRAT, while HTML lures lead to DCRAT infections.
Key points
- Talos assesses with high confidence that the campaign targets Russian-speaking users; infection requires victims to open malicious documents or follow links and run downloaded files.
- A Word document macro extracts a hidden payload, establishes persistence through a Windows registry key, and loads PowerRAT in memory.
- PowerRAT collects host details, contacts hardcoded command-and-control servers, and can execute PowerShell commands or scripts delivered through XML configuration.
- HTML lures use JavaScript to download an archive that leads to DCRAT, either directly or through a Go-compiled loader.
- The Go loader adds Microsoft Defender exclusions before downloading DCRAT; the RAT can steal credentials and files, capture keystrokes and screenshots, and run commands.
- DCRAT creates disguised executable copies and scheduled tasks for persistence, and communicates with command-and-control servers to exfiltrate collected data.
- Talos reported that PowerRAT's C2 servers did not respond during analysis and that the malware contained placeholders suggesting active development.
Article Details
- Attack Vectors
- Phishing emails delivered using the Gophish toolkit carried malicious Word documents and HTML files with JavaScript; both infection chains required victim interaction.
- Opening a Word document and enabling its contents triggered a malicious VB macro that decoded an HTA file and PowerShell loader, then configured the Windows LOAD registry key for execution at user logon.
- Clicking a link opened a remote HTML file whose JavaScript generated a download of an embedded 7-Zip archive containing a masquerading SFXRAR executable; running the archive led to DCRAT infection.
- GOLoader modified Microsoft Defender Antivirus exclusions for C:\ and the user's Desktop, then downloaded and wrote the DCRAT payload as file.exe.
- DCRAT used copied executables, scheduled tasks, and logon-triggered tasks for persistence.
- Defensive Notes
- The article recommends Cisco Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, Cisco Duo, Snort rules, and ClamAV detections for protection or detection.
- Snort SIDs listed for the threat: 63963–63970, 63971, and 301004.
- ClamAV detection names listed include Win.Downloader.RustAgent-10036537-0 through Win.Downloader.RustAgent-10036539-0, Win.Downloader.GoAgent-10036540-0, Win.Backdoor.PowershellRAT-10036541-0, Win.Phishing.VbsAgent-10036542-0, Win.Phishing.JsAgent-10036543-0, Win.Loader.PowershellLoader-10036544-0, Win.Loader.HtaAgent-10036545-0, and Win.Loader.DonutLoader-10036546-0.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | disk-yanbex[.]ru | Attacker-controlled hosting domain that delivered a malicious Word document and HTML file. |
| DOMAIN | e-connection[.]ru | Domain resolving to the attacker-used server and used to deliver malicious JavaScript-embedded HTML. |
| IPV4 | 34[.]236[.]234[.]165 | Attacker-used server that delivered phishing content and hosted the Gophish toolkit. |
| IPV4 | 5[.]252[.]176[.]55 | PowerRAT C2 server identified in the campaign. |
| IPV4 | 94[.]103[.]85[.]47 | PowerRAT C2 server identified in the campaign. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelDCRAT communicated with its C2 and exfiltrated sensitive information collected from the victim machine.T1053.005 · Scheduled TaskDCRAT established persistence by creating scheduled tasks that ran periodically or at logon.T1059.001 · PowerShellThe infection chain executed PowerShell loaders and PowerRAT commands using PowerShell.T1059.005 · Visual BasicA malicious VB macro in the Word document executed the initial loader actions.T1059.007 · JavaScriptThe HTA launched JavaScript through cscript.exe, and the HTML-based infection also used malicious JavaScript.T1082 · System Information DiscoveryPowerRAT collected the computer name, username, system drive letter, and drive serial number.T1105 · Ingress Tool TransferGOLoader downloaded the DCRAT binary from a hardcoded remote URL.T1218.005 · MshtaThe HTA executed its JavaScript using the Windows Script Host binary cscript.exe.T1547.001 · Registry Run Keys / Startup FolderThe macro configured the Windows NT CurrentVersion LOAD registry key to launch the HTA at user logon.T1562.001 · Disable or Modify ToolsGOLoader added C:\ and the user's Desktop to Microsoft Defender Antivirus exclusion paths.T1566.001 · Spearphishing AttachmentPhishing emails carried malicious Word documents as attachments or linked content.T1566.002 · Spearphishing LinkPhishing emails contained malicious hyperlinks leading to HTML-based infection content.
People
Malware
DCRatThreat actor abuses Gophish to deliver new PowerRAT and DCRATGOLoaderIn another sample, we observed that the SFXRAR drops the GOLoader and the decoy document Excel spreadsheet in the victim machine user profile applications temporary folder and runs the GOLoader along with opening thePowerRATThreat actor abuses Gophish to deliver new PowerRAT and DCRATSparkRATTalos observed an overlap of the technique used by the threat actor in this campaign with an earlier SparkRAT attack reported by Hunt researchers in April 2024, indicating that SparkRAT is another payload in the threat
Vendors
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks. ClamAVClamAV detections are also available for this threat: Microsoft Defender Antiviruswe are calling “GOLoader” is compiled in Golang. It modifies the configuration settings for Microsoft Defender Antivirus, specifically by excluding the root directory “C:\” and the folder “C:\Users\$user\Desktop” inMicrosoft WindowsThe actor has abused the Windows NT current version autorun registry key called “LOAD”. The registry key “HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LOAD” is used by Windows to automatically launchMicrosoft Worddisclosed to us the attacker-controlled hosting domains disk-yanbex[.]ru delivered the Malicious Microsoft Word document, and an HTML file embedded with the malicious JavaScript. SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 63963 – 63970, 63971 and 301004. UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
Countries
Azerbaijanamongst Russian speakers, especially in Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Azerbaijan. Belarus(VK), a popular social media application amongst Russian speakers, especially in Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Azerbaijan. Kazakhstana popular social media application amongst Russian speakers, especially in Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Azerbaijan. RussiaHTML webpage of Vkontake (VK), a popular social media application amongst Russian speakers, especially in Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Azerbaijan. Ukraineof Vkontake (VK), a popular social media application amongst Russian speakers, especially in Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Azerbaijan. Uzbekistansocial media application amongst Russian speakers, especially in Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Azerbaijan.