Genians Details NarwhalRAT Campaign Using Microsoft-Themed Phishing and Dead-Drop C2

Jun 14, 2026 · Original article ↗

Summary

Genians details a Korea-focused NarwhalRAT infection chain launched through Microsoft-themed phishing and malicious LNK files, with Python-based in-memory payloads, extensive surveillance capabilities, and relay/pCloud C2. Its TTPs resemble prior APT37-linked activity.

Key points

Phishing emails impersonating Microsoft security alerts delivered ZIP attachments containing malicious LNK files, which launched a multi-stage PowerShell and batch-script infection chain.
The chain downloaded an embedded Python runtime and a bytecode payload disguised as a .cat file, then established persistence with a scheduled task.
NarwhalRAT supports remote command execution, keylogging, screen and microphone capture, file transfer, and USB data collection; operators can selectively activate functions through C2 commands.
The malware uses obfuscation, legitimate Windows utilities, and in-memory payload execution to hinder detection and analysis.
C2 uses Korean website relays and pCloud as a secondary dead-drop channel, allowing the malware to retrieve communication details and maintain alternate routes.
Genians reports substantial TTP similarities to earlier APT37-associated activity, but presents this as an assessment rather than confirmed attribution.
The report recommends behavior-based monitoring for the LNK-to-script execution chain, scheduled task creation, suspicious memory execution, and abnormal pCloud communications.

Article Details

Attack Vectors: Spear-phishing messages impersonated the Microsoft Account Team and used an urgent OTP-abuse security advisory to induce attachment execution.
A ZIP archive delivered a malicious LNK disguised as a cybersecurity advisory. The LNK initiated a multi-stage CMD, PowerShell, and BAT execution chain.
Environment-variable substring substitution concealed commands in both the LNK and BAT stages.
The BAT stage downloaded an official Python embedded runtime separately from malicious Python bytecode disguised with a .cat extension.
A scheduled task executed the disguised Python payload every minute.
The subsequent loader decrypted a PE payload and executed it directly inside the current Python process without writing the final executable to disk.
Website-based C2 relays and a pCloud-based secondary channel supported remotely controlled collection and command execution.
Defensive Notes: Strengthen EDR policies for correlated LNK, CMD, BAT, and PowerShell execution rather than relying only on file-based detection.
Monitor environment-variable substring substitution, PowerShell execution-policy bypass, and external downloads performed by copied or renamed Windows utilities.
Detect suspicious scheduled-task creation and repeated execution of Python bytecode disguised as catalog files.
Monitor Python processes for RWX memory allocation, decrypted payload copying, and direct execution from allocated memory.
Correlate process trees, command lines, memory behavior, file creation, and network connections to reconstruct the infection chain.
Inspect abnormal pCloud communication alongside website-based C2 traffic; blocking only a primary relay may leave an alternative communication route available.
The source describes Genian Insights E capabilities for inspecting LnkTarget information, tracing deobfuscated commands, and reviewing scheduled-task execution and associated C2 connections.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`crwellfood[.]com`	Domain explicitly listed as C2 in the report's IOC section.
DOMAIN	`daehoat[.]com`	Website-based primary C2 relay used by NarwhalRAT.
DOMAIN	`fe01[.]co[.]kr`	Relay used to deliver the ZIP archive containing the malicious LNK; also listed as C2.
DOMAIN	`novel21[.]co[.]kr`	Domain explicitly listed as C2 in the report's IOC section.
DOMAIN	`webhostingkorea[.]com`	Relay delivering decoy and malicious files, and C2 contacted by the config.cat backdoor loader.
IPV4	`121[.]254[.]222[.]10`	IP address explicitly listed as C2 in the report's IOC section.
IPV4	`121[.]254[.]222[.]80`	IP address explicitly listed as C2 in the report's IOC section.
IPV4	`211[.]239[.]157[.]126`	IP address explicitly listed as C2 in the report's IOC section.
IPV4	`218[.]150[.]78[.]198`	IP address explicitly listed as C2 in the report's IOC section.
IPV4	`218[.]150[.]78[.]231`	IP address explicitly listed as C2 in the report's IOC section.
IPV4	`61[.]100[.]9[.]206`	IP address explicitly listed as C2 in the report's IOC section.
MD5	`3715092aa00f380cefe8b4d2eddb7d08`	Malicious artifact hash listed in the report's IOC section; individual file association is not disclosed.
MD5	`7cef19f9c4480adac0cd4702ff98f46c`	Malicious artifact hash listed in the report's IOC section; individual file association is not disclosed.
MD5	`7eb9cee1f696727752169f25cf79a338`	Malicious artifact hash listed in the report's IOC section; individual file association is not disclosed.
MD5	`b6b0602310bb2d4360c52685119aac1b`	Malicious artifact hash listed in the report's IOC section; individual file association is not disclosed.
URL	`hxxp[:]//www[.]daehoat[.]com/wp-content/uploads/2017/02/member[.]php`	Default C2 URL hardcoded inside NarwhalRAT.
URL	`hxxp[:]//www[.]novel21[.]co[.]kr/data/editor/2110/index[.]php`	Default C2 URL hardcoded inside NarwhalRAT.