SocGholish Campaigns Use WebDAV and SCF Files to Steal Credentials Before RansomHub Deployment
Summary
Darktrace details SocGholish infections leading to RansomHub activity, including fake browser updates, WebDAV and SCF-based forced authentication to expose NTLM hashes, Python backdoors, and port-hopping C2.
Key points
- Since January 2025, Darktrace observed cases where compromised websites redirected users to fake browser updates that delivered SocGholish through JavaScript loaders.
- SocGholish activity led to RansomHub-linked infrastructure and, in some cases, Python-based backdoors.
- Attackers used WebDAV requests to trigger Windows NTLM authentication toward an external endpoint, potentially exposing hashes for offline cracking.
- In a separate technique, attackers placed crafted Thumbs.scf files on internal SMB shares; users browsing those folders could trigger authentication to the attacker’s remote UNC path.
- RansomHub-linked command-and-control traffic used rapidly changing destination ports, including 2308, 2311, and 2313, to evade basic network monitoring.
- Darktrace lists associated domains, IP addresses, and detection alerts in the article’s IoC and appendix sections.
Article Details
- Attack Vectors
- SocGholish is delivered through malicious JavaScript injected into compromised websites, often through unpatched CMS plugins or remote code execution flaws. Visitors are redirected to fake browser-update pages and prompted to download a ZIP containing a JavaScript loader.
- SocGholish-related activity included WebDAV requests that triggered Windows NTLM authentication attempts to an external endpoint, potentially exposing NTLM hashes.
- An attacker-planted Thumbs.scf file on internal SMB shares referenced a remote UNC resource; users browsing a folder containing the file could trigger authentication attempts to the external host.
- After initial compromise, affected devices connected to SocGholish C2 infrastructure over HTTPS and to RansomHub-associated infrastructure over changing destination ports.
- Defensive Notes
- Patch and secure CMS websites and plugins to reduce the risk of malicious script injection.
- Monitor for unusual WebDAV activity, forced NTLM authentication, SCF files on SMB shares, and connections to rare external endpoints.
- Monitor outbound connections across non-standard and rapidly changing destination ports, not only common web ports.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | blacksaltys[.]com | Keitaro TDS domain used for SocGholish delivery. |
| DOMAIN | blackshelter[.]org | Keitaro TDS domain used for SocGholish delivery. |
| DOMAIN | garagebevents[.]com | Possibly compromised website identified as the SocGholish delivery entry point. |
| DOMAIN | msbdz[.]crm[.]bestintownpro[.]com | SocGholish C2 domain. |
| DOMAIN | packedbrick[.]com | Keitaro TDS domain used for SocGholish delivery. |
| DOMAIN | rednosehorse[.]com | Keitaro TDS domain used for SocGholish delivery. |
| DOMAIN | virtual[.]urban-orthodontics[.]com | Endpoint that served the script completing SocGholish distribution. |
| IPV4 | 108[.]181[.]182[.]143 | RansomHub Python C2. |
| IPV4 | 161[.]35[.]56[.]33 | External attacker-controlled endpoint targeted by WebDAV and SCF-triggered authentication attempts to expose NTLM hashes. |
| IPV4 | 166[.]88[.]182[.]126 | IP associated with SocGholish C2. |
| IPV4 | 176[.]53[.]147[.]97 | IP hosting Keitaro TDS domains used for SocGholish delivery. |
| IPV4 | 185[.]174[.]101[.]240 | RansomHub Python C2. |
| IPV4 | 185[.]174[.]101[.]69 | RansomHub Python C2. |
| IPV4 | 185[.]76[.]79[.]50 | IP associated with the endpoint that served the script completing SocGholish distribution. |
| IPV4 | 35[.]203[.]175[.]30 | IP associated with the possibly compromised website used in SocGholish delivery. |
MITRE ATT&CK
T1018 · Remote System DiscoveryListed in the article's ATT&CK mapping; the article provides no specific remote-system discovery behavior.T1021.002 · SMB/Windows Admin SharesThe article maps activity to SMB/Windows Admin Shares and describes an attacker uploading Thumbs.scf to internal SMB shares.T1046 · Network Service DiscoveryListed in the article's ATT&CK mapping; the article provides no specific network-service discovery behavior.T1059.007 · JavaScriptSocGholish delivery used obfuscated JavaScript loaders.T1071.001 · Web ProtocolsSocGholish C2 communications used HTTPS and other standard web protocols.T1083 · File and Directory DiscoveryListed in the article's ATT&CK mapping; the article provides no specific file-and-directory discovery behavior.T1110 · Brute ForceThe article lists Kerberos username brute force among the mapped activity and Darktrace alerts.T1135 · Network Share DiscoveryListed in the article's ATT&CK mapping; the article provides no specific network-share discovery behavior.T1187 · Forced AuthenticationWebDAV and SCF/UNC interactions triggered Windows authentication attempts that could expose NTLM hashes.T1571 · Non-Standard PortRansomHub-associated connections used changing, non-standard destination ports, including 2308, 2311, and 2313.T1608.004 · Drive-by TargetThe article maps fake browser-update delivery from compromised websites to Drive-By Target.
People
Malware
Cobalt StrikeSocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently,RansomHubvendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].SocGholishaccess to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.
Products
KeitaroEvent Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.Within milliseconds of the connection establishment, the user’s device initiated severalMicrosoft Windowsshares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can triggerWordPressThreat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates