MuddyWater-Linked Phishing Campaign Uses Fake Recruiter Lures to Install NetBird

Aug 20, 2025 · Original article ↗

Summary

Researchers detail a multi-stage phishing campaign targeting finance executives with fake recruiter and Google Drive lures. VBS payloads install NetBird and OpenSSH, create hidden administrator access, and enable RDP; infrastructure and tool overlaps suggest a MuddyW...

Key points

Phishing lures impersonated a Rothschild & Co recruiter or Google Drive and used Firebase-hosted pages with CAPTCHA-style challenges and encrypted redirects.
Victims were directed to ZIP files disguised as documents; VBS scripts then downloaded and executed further payloads from attacker-controlled infrastructure.
The payloads silently installed NetBird and OpenSSH, created a hidden local administrator account, enabled RDP, and configured scheduled tasks to maintain access.
Researchers found related Firebase and web.app domains using shared phishing-kit code, as well as changes in payload paths and hosting infrastructure.
Infrastructure, tools, and payload overlaps support a likely link to MuddyWater, though attribution is presented as probable rather than confirmed.
The article recommends blocking associated infrastructure, restricting unauthorized remote-access tools, and monitoring for suspicious VBS execution, administrator-account creation, and NetBird services.

Article Details

Attack Vectors: Spear-phishing emails impersonating a Rothschild & Co recruiter led targets to phishing pages hosted on Firebase or web.app, where CAPTCHA-style math challenges concealed redirects.
Phishing pages impersonating Google Drive prompted victims to download ZIP archives disguised as PDF files; the archives contained malicious VBS scripts.
The VBS scripts downloaded and executed additional payloads, installed NetBird and OpenSSH, created a hidden local administrator account, and enabled RDP.
Defensive Notes: Block the campaign's identified malicious IP addresses, domains, and URLs at network and endpoint perimeters.
Audit and restrict unauthorized use or installation of NetBird and AteraAgent; use application allowlisting.
Use phishing detection and sandboxing to inspect VBS downloaders, ZIP archives, and suspicious URLs.
Detect VBS execution from temporary directories, suspicious local administrator account creation, and unauthorized NetBird service creation.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cloud-233f9[.]firebaseapp[.]com`	Firebase-hosted math-gate phishing lure that redirects to a malicious domain.
DOMAIN	`cloud-233f9[.]web[.]app`	Variant of the campaign's math-gate phishing lure.
DOMAIN	`cloud-ed980[.]firebaseapp[.]com`	Firebase-hosted math-gate phishing lure that redirects to a malicious site.
DOMAIN	`cloud-ed980[.]web[.]app`	Phishing lure using the campaign's math-gate template and an encrypted redirect.
DOMAIN	`googl-165a0[.]web[.]app`	Phishing site impersonating Google Drive and delivering a malicious ZIP archive.
DOMAIN	`googl-6c11f[.]firebaseapp[.]com`	Firebase-hosted phishing page used as an initial attack vector.
DOMAIN	`googl-6c11f[.]web[.]app`	Phishing redirect infrastructure used after the CAPTCHA lure.
DOMAIN	`my-sharepoint-inc[.]com`	Phishing domain reported to host VBS droppers and linked to the campaign's infrastructure.
DOMAIN	`my1cloudlive[.]com`	Decrypted redirect target from a phishing kit's math-gate page.
DOMAIN	`my2cloudlive[.]com`	Decrypted redirect target from a phishing kit's math-gate page.
DOMAIN	`web-16fe[.]app`	Malicious redirect destination embedded in the cloud-ed980 phishing kit.
IPV4	`192[.]3[.]95[.]152`	Payload-hosting IP associated with the campaign; the article also reports a prior APT MuddyWater association.
IPV4	`198[.]46[.]178[.]135`	Updated attacker-controlled infrastructure hosting campaign payloads.
MD5	`0aa883cd659ef9957fded2516b70c341`	Hash of cis.vbs, the second-stage downloader.
MD5	`23dda825f91be93f5de415886f17ad4a`	Hash of the malicious F-144822.zip archive.
MD5	`2cddc7a31ea289e8c1e5469f094e975a`	Hash of a VBS dropper reported to deploy AteraAgent.exe.
MD5	`5325de5231458543349152f0ea1cc3df`	Hash of the malicious F-144822.vbs payload.
MD5	`7ddc947ce8999c8a4a36ac170dcd7505`	Hash of a VBS dropper reported to deploy AteraAgent.exe.
MD5	`f359f20dbd4b1cb578d521052a1b0e9f`	Hash of a VBS dropper reported to deploy AteraAgent.exe.
URL	`hxxp[:]//192[.]3[.]95[.]152/cloudshare/atr/pull[.]pdf`	Stage-1 payload URL hosted on campaign infrastructure.
URL	`hxxp[:]//192[.]3[.]95[.]152/cloudshare/atr/trm`	Stage-2 payload URL hosted on campaign infrastructure.
URL	`hxxp[:]//198[.]46[.]178[.]135/34564/cis[.]ico`	Stage-1 payload URL used by the malicious VBS script.
URL	`hxxp[:]//198[.]46[.]178[.]135/34564/files/001`	Stage-2 payload URL listed for the campaign.
URL	`hxxp[:]//cloud-ed980[.]firebaseapp[.]com/`	Firebase-hosted phishing infrastructure identified by the campaign pivot.
URL	`hxxp[:]//cloud-ed980[.]web[.]app/`	Phishing lure using the campaign's math-gate template.
URL	`hxxp[:]//googl-165a0[.]web[.]app/`	Phishing page impersonating Google Drive.
URL	`hxxps[:]//cloud-233f9[.]firebaseapp[.]com/`	Firebase-hosted math-gate phishing page.
URL	`hxxps[:]//cloud-233f9[.]web[.]app/`	Variant of the Firebase-hosted phishing lure.
URL	`hxxps[:]//googl-165a0[.]web[.]app/file/1rkh3Y-1rJ_d3jg0BZao-pGA5hey6H-qS-error`	Campaign URL opened by the VBS payload to display a fake error page.
URL	`hxxps[:]//googl-6c11f[.]firebaseapp[.]com/job/file-846873865383[.]html`	Reported Firebase-hosted Stage-0 phishing page.
URL	`hxxps[:]//googl-6c11f[.]firebaseapp[.]com/scan/file-846873865383[.]html`	Firebase-hosted phishing page identified during the investigation.
URL	`hxxps[:]//googl-6c11f[.]web[.]app/job/9867648797586_Scan_15052025-736574[.]html`	Reported decrypted redirect page hosted on web.app.
URL	`hxxps[:]//googl-6c11f[.]web[.]app/scan/9867648797586_Scan_15052025-736574[.]html`	Phishing redirect page hosted on web.app.
URL	`hxxps[:]//web-16fe[.]app/`	Redirect destination embedded in the cloud-ed980 phishing kit.