SneakyChef Uses SpiceRAT in Phishing Campaign Targeting Government Agencies
Summary
Cisco Talos details SneakyChef phishing campaigns delivering SpiceRAT and SugarGh0st to government agencies in EMEA and Asia, describing two infection chains, malware capabilities, C2 communications, and indicators of compromise.
Key points
- SneakyChef used phishing emails with RAR attachments to deliver SpiceRAT or SugarGh0st; lures likely targeted Angolan government agencies.
- SpiceRAT was deployed through two multi-stage infection chains beginning with malicious LNK or HTA files.
- The LNK chain uses a malicious DLL sideloaded by legitimate executables, while the HTA chain creates scheduled tasks and downloads the RAT components.
- SpiceRAT collects host and user information, communicates with hardcoded C2 servers over HTTP, and can download and execute binaries or commands through a plugin.
- The malware uses encrypted payloads, process injection, and scheduled-task persistence; Talos found multiple C2 addresses and domains.
- Talos assesses with medium confidence that SneakyChef is a Chinese-speaking actor, citing artifact language and TTP overlaps.
- Talos provides Snort, ClamAV, and Cisco product coverage, with indicators of compromise available.
Article Details
- Attack Vectors
- Phishing emails with RAR attachments delivered LNK or HTA files that initiated the SpiceRAT infection chains.
- The LNK chain used a malicious shortcut to launch an executable and sideload a malicious DLL alongside a legitimate executable.
- The HTA chain ran an embedded Visual Basic script that dropped a Base64-encoded downloader and batch file; the batch file decoded the downloader and established persistence using scheduled tasks.
- A downloader retrieved a malicious ZIP archive from an attacker-controlled server.
- SpiceRAT decrypted and injected its payload into the dxcap.exe process; its plugin could download files and execute commands or binaries.
- Defensive Notes
- The article recommends Cisco Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, Cisco Duo, Snort rules, and ClamAV detections as protections.
- The article lists Snort SID 63538 for this threat.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | app[.]turkmensk[.]org | Domain used by SpiceRAT for C2 communication. |
| DOMAIN | stock[.]adobe-service[.]net | Domain used by a hardcoded SpiceRAT C2 URL. |
| IPV4 | 45[.]144[.]31[.]57 | Attacker-controlled server hosting the malicious ZIP archive. |
| IPV4 | 94[.]198[.]40[.]4 | SpiceRAT C2 server. |
| URL | hxxp[:]//45[.]144[.]31[.]57/S1VRB0HpMXR79eStog35igWKVTsdbx/chromeupdate[.]zipservers | Hardcoded payload-download URL for the malicious ZIP archive. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe SpiceRAT payload was encrypted and disguised as a legitimate .HLP file before being decrypted in memory.T1041 · Exfiltration Over C2 ChannelSpiceRAT sent encrypted reconnaissance data and user credentials from memory to its C2 server.T1053.005 · Scheduled TaskThe batch file and DLL loader created Windows scheduled tasks to run the downloader or dxcap.exe at recurring intervals.T1055 · Process InjectionThe loader injected the decrypted SpiceRAT payload into its parent process, dxcap.exe.T1059.003 · Windows Command ShellThe malicious batch file ran Windows commands to establish scheduled tasks and remove infection markers.T1070.004 · File DeletionThe batch script deleted the Microsoft.txt downloader, the HTA file, and other unpacked attachment contents.T1071.001 · Web ProtocolsSpiceRAT communicated with its C2 server over HTTP using POST requests.T1105 · Ingress Tool TransferThe downloader retrieved a malicious ZIP archive, and SpiceRAT received a plugin binary from its C2 server.T1140 · Deobfuscate/Decode Files or InformationThe batch file used certutil -decode to decode the Base64 downloader from Microsoft.txt into Microsoft.exe.T1204.002 · Malicious FileThe infection chains required victims to open a malicious LNK shortcut or run a malicious HTA file.T1218.005 · MshtaThe HTA infection chain executed an embedded Visual Basic script from a malicious HTA file.T1566.001 · Spearphishing AttachmentSneakyChef sent phishing emails with RAR file attachments delivering LNK or HTA files.T1574.002 · DLL Side-LoadingSpiceRAT used a legitimate executable to sideload the malicious ssMUIDLL.dll.
People
Threat Actors
Malware
PlugXmasquerading “ssMUIDLL.dll” file is particularly notable. This method has been previously observed in the PlugX and SPIVY RAT campaigns. SpiceRATUnveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and AsiaSPIVY RAT“ssMUIDLL.dll” file is particularly notable. This method has been previously observed in the PlugX and SPIVY RAT campaigns. SugarGh0stWe observed that SneakyChef launched a phishing campaign, sending emails delivering SugarGh0st and SpiceRAT with the same email address.
Vendors
CiscoCisco Talos discovered a new remote access trojan (RAT) dubbed SpiceRAT, used by the threat actor SneakyChef in a recent campaign targeting government agencies in EMEA and Asia. Samsungas a launcher to sideload the malicious DLL loader file (ssMUIDLL.dll). This legitimate executable is a Samsung RunHelp application signed with the certificate of "Samsung Electronics CO., LTD.” In some instances, it
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. Cisco Secure Endpoint Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks. ClamAVClamAV detections are also available for this threat: Google Chromewith Visual Studio, and “ChromeDriver.exe,” an executable that Selenium WebDriver uses to control the Google Chrome web browser. Microsoft WindowsThe LNK-based infection chain begins with a malicious RAR file that contains a Windows shortcut file (LNK) and a hidden folder. This folder contains multiple components, including a malicious executable launcher, aSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SID for this threat is 63538. SpiceRATUnveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and AsiaSugarGh0stWe observed that SneakyChef launched a phishing campaign, sending emails delivering SugarGh0st and SpiceRAT with the same email address. UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here. Visual Studiosome instances, it has been observed masquerading as “dxcap.exe,” a DirectX diagnostic included with Visual Studio, and “ChromeDriver.exe,” an executable that Selenium WebDriver uses to control the Google Chrome web
Tools
certutilThe certutil command decodes the base64-encoded binary data from “Microsoft.txt” and saves it as “Microsoft.exe” in the victim’s user profile temporary folder. ChromeDriver.exeThe batch script creates another Windows task named “MicrosoftDeviceSync” to run a downloaded legitimate executable “ChromeDriver.exe” every 10 minutes.dxcap.exedxcap.exe RunHelp.exeThe threat actor is using a legitimate executable (named “RunHelp.exe”) as a launcher to sideload the malicious DLL loader file (ssMUIDLL.dll). This legitimate executable is a Samsung RunHelp application signed with theschtasksschtasks /create /tn MicrosoftEdgeUpdateTaskMachineClSAN /tr %temp%\\Microsoft.exe /sc minute -mo 5 /F