Threat Actors Exploit Gophish Phishing Toolkit to Deliver PowerRAT and DCRAT Malware

A sophisticated cybercrime campaign has been uncovered where threat actors are abusing the open-source phishing toolkit, Gophish, to deliver powerful Remote Access Trojans (RATs) known as PowerRAT and DCRAT. The attack involves a complex, multi-modular infection chain that targets Russian-speaking users across several countries, including Russia, Ukraine, Belarus, and Kazakhstan. Leveraging malicious Microsoft Word documents and JavaScript-laden HTML files, the actors are using these tools to infiltrate systems and carry out extensive surveillance and control. Here’s an in-depth look into this emerging threat and how cybersecurity professionals can defend against it.

The Anatomy of the Attack:

Cisco Talos researchers recently uncovered this campaign where an unknown threat actor utilized the Gophish toolkit to send phishing emails containing malicious payloads. The campaign targets Russian-speaking users with phishing emails disguised as legitimate communications from popular platforms like Vkontakte (VK), Russia’s leading social media application. Once a victim interacts with the malicious email, the infection process begins, eventually leading to the deployment of PowerRAT and DCRAT malware.

Key Components of the Attack:

Initial Infection Vectors:
The attack uses two main methods to deliver malware:

• Malicious Microsoft Word documents with embedded macros.
• HTML files containing malicious JavaScript.
  These files trick users into enabling content or clicking links, which triggers the download of malware.

1. Malicious Domains and Infrastructure:
   The phishing emails contain hyperlinks that lead to attacker-controlled domains such as disk-yanbex[.]ru. Further analysis revealed that the threat actor is hosting the Gophish toolkit on an AWS EC2 instance. The same server (IP address: 34[.]236[.]234[.]165) was found delivering both PowerRAT and DCRAT, marking it as a critical hub for this campaign.
2. PowerRAT Deployment:
   Once the malicious Word document is opened, a Visual Basic macro embedded within it decodes hidden data that executes a PowerShell-based Remote Access Tool (PowerRAT). This tool not only grants attackers remote control but can also execute additional PowerShell commands, making the infection highly adaptable. The malware uses stealth techniques such as modifying Windows registry keys to persist on the infected system and continue operating undetected.
3. DCRAT Infection via JavaScript:
   The HTML-based attack vector uses JavaScript embedded in phishing emails to infect victims with DCRAT. Victims are tricked into downloading malicious SFXRAR executable files masquerading as legitimate applications like VK Messenger. Upon execution, these files deliver DCRAT, which allows attackers to exfiltrate sensitive data and perform reconnaissance on the infected systems.

Victim Profile and Targeting:

The threat actors seem to focus on Russian-speaking users, with phishing content specifically designed to appeal to this demographic. The emails are written in Russian, and the malicious HTML pages impersonate popular Russian websites like VK. This targeted approach suggests that the attackers are primarily focused on users in Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan, and Azerbaijan.

Advanced Capabilities of PowerRAT:

PowerRAT, an undocumented PowerShell-based RAT discovered by Talos, is one of the more concerning aspects of this campaign. Its ability to execute other PowerShell scripts on command, hide files, and maintain persistence on victim machines shows that the threat actors behind this tool are actively developing it. The malware’s ability to communicate with command-and-control (C2) servers in Russia, specifically via IP addresses tied to Hosting Technology LTD and MivoCloud SRL, enables attackers to monitor and control infected systems remotely.

Overlaps with Previous Attacks:

Interestingly, the techniques observed in this campaign bear similarities to an earlier attack involving SparkRAT. This overlap indicates that the same group may be behind multiple campaigns, continually refining their tools and tactics to stay ahead of detection efforts.

10 Tips to Defend Against Such Threats:

1. Educate Employees on Phishing Threats:
   Regularly train employees on recognizing phishing emails and the dangers of enabling macros or clicking on suspicious links.
2. Implement Email Security Gateways:
   Use advanced email filtering solutions to detect and block phishing emails before they reach users.
3. Disable Macros by Default:
   Ensure that macros are disabled in Microsoft Office applications unless absolutely necessary.
4. Regularly Update Software:
   Keep all software, especially antivirus and endpoint detection tools, up to date to prevent exploitation through known vulnerabilities.
5. Use Network Segmentation:
   Implement network segmentation to limit the spread of malware across your organization in case of an infection.
6. Monitor PowerShell Usage:
   Monitor the use of PowerShell within your environment, as this is a common tool leveraged by attackers in malware infections like PowerRAT.
7. Deploy Advanced Threat Protection:
   Use Endpoint Detection and Response (EDR) tools to detect malicious behavior, such as unauthorized registry changes or hidden file creation.
8. Conduct Regular Backups:
   Ensure that important data is regularly backed up and stored securely, making it possible to recover in case of a ransomware infection.
9. Harden System Configurations:
   Secure system configurations to prevent malware from exploiting startup keys like the Windows NT LOAD registry.
10. Establish Incident Response Protocols:
    Develop and test incident response protocols to quickly respond to and mitigate the impact of malware infections.

Conclusion:

The abuse of open-source tools like Gophish, combined with the delivery of powerful malware such as PowerRAT and DCRAT, highlights the evolving complexity of cyber threats. Organizations must remain vigilant by adopting proactive cybersecurity measures, staying informed on the latest attack vectors, and educating employees on phishing and social engineering techniques. The key to preventing such attacks lies in a combination of technological defenses and user awareness.

Want to stay on top of cybersecurity news? Follow us on Facebook, X (Twitter), Instagram, and LinkedIn for the latest threats, insights, and updates!