EXECUTIVE SUMMARY
Researchers found a multi-stage ClickFix campaign that aimed at people linked to Russian civil society. The attackers used a fake checkbox on a webpage to trick users into copying a command to the clipboard and pasting it into the Windows Run box. When run, the command launched a downloader DLL called BAITSWITCH. The webpage also showed a decoy document with content meant to look relevant and trustworthy, which likely helped convince targets to follow the on-screen steps. The campaign used checks on the server side to only deliver malicious content to systems that matched specific traits, making the attacks selective rather than broad.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
Researchers found a multi-stage ClickFix campaign that aimed at people linked to Russian civil society. The attackers used a fake checkbox on a webpage to trick users into copying a command to the clipboard and pasting it into the Windows Run box. When run, the command launched a downloader DLL called BAITSWITCH. The webpage also showed a decoy document with content meant to look relevant and trustworthy, which likely helped convince targets to follow the on-screen steps. The campaign used checks on the server side to only deliver malicious content to systems that matched specific traits, making the attacks selective rather than broad.[emaillocker id="1283"]
The choice of content and the social setup around the fake checkbox show the campaign relied heavily on tricking people rather than on highly complex code. The infection chain begins when the user executes a command that runs machinerie.dll, the BAITSWITCH downloader. BAITSWITCH makes several web requests to a threat-controlled domain using a hardcoded browser-like user-agent. Based on responses it receives, it runs commands to set persistence, store encrypted data in the registry, download a PowerShell stager to the user profile, and erase traces from the RunMRU list. On the next login the stager runs and uses basic string hiding and Base64 decoding to reconstruct the full script.
That script then launches SIMPLEFIX, a PowerShell backdoor that wakes every few minutes, builds a custom user-agent from local system data, checks in with a remote server for tasks, executes received commands, and reports back when tasks finish. The campaign also split decryption data across different delivery methods so the final payload could not be trivially extracted from a single place. This campaign shows that social tricks plus light-weight tools can still succeed at gaining access and running commands on target machines. The attackers focused on convincing users to take a single action that triggered the whole chain, then used small, scripted tools to keep control and run tasks from afar. The selective delivery and simple hiding steps helped reduce noise and made the operation harder to spot at a glance While the tools used are not highly complex, the overall design – a convincing lure, staged downloads, and periodic checks – made the campaign effective against the chosen targets. The main takeaway is that human-focused traps remain a powerful route for attackers, and even modest malware can do a lot when combined with carefully crafted social engineering.
THREAT PROFILE:
| Tactic | Technique ID | Technique | Sub-technique |
|---|---|---|---|
| Resource Development | T1583.001 | Acquire Infrastructure | Domains |
| Resource Development | T1583.006 | Acquire Infrastructure | Web Services |
| Resource Development | T1585.002 | Establish Accounts | Email Accounts |
| Resource Development | T1585.003 | Establish Accounts | Cloud Accounts |
| Resource Development | T1587.001 | Develop Capabilities | Malware |
| Resource Development | T1608.001 | Stage Capabilities | Upload Malware |
| Resource Development | T1608.003 | Stage Capabilities | Install Digital Certificate |
| Resource Development | T1608.005 | Stage Capabilities | Link Target |
| Execution | T1204.004 | User Execution | Malicious Copy and Paste |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Execution | T1059.003 | Command and Scripting Interpreter | Windows Command Shell |
| Persistence | T1037.001 | Boot or Logon Initialization Scripts | Logon Script (Windows) |
| Persistence | T1112 | Modify Registry | Modify Registry |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information | – |
| Defense Evasion | T1564.003 | Hide Artifacts | Hidden Window |
| Defense Evasion | T1218.011 | System Binary Proxy Execution | Rundll32 |
| Defense Evasion | T1205 | TrafficSignaling | – |
| Defense Evasion | T1070.003 | Indicator Removal | Clear Command History |
| Defense Evasion | T1027.011 | Obfuscated Files or Information | Fileless Storage |
| Defense Evasion | T1027.013 | Obfuscated Files or Information | Encrypted/Encoded File |
| Discovery | T1033 | System Owner/User Discovery | – |
| Discovery | T1082 | System Information Discovery | – |
| Discovery | T1135 | Network Share Discovery | – |
| Discovery | T1016 | System Network Configuration Discovery | – |
| Discovery | T1016.001 | System Network Configuration Discovery | Internet Connection Discovery |
| Discovery | T1087.001 | Account Discovery | Local Account |
| Discovery | T1083 | File and Directory Discovery | – |
| Discovery | T1049 | System Network Connections Discovery | – |
| Discovery | T1057 | Process Discovery | – |
| Discovery | T1018 | Remote System Discovery | – |
| Discovery | T1046 | Network Service Discovery | – |
| Discovery | T1124 | System Time Discovery | – |
| Collection | T1005 | Data from Local System | – |
| Collection | T1530 | Data from Cloud Storage | – |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Command and Control | T1104 | Multi‐Stage Channels | – |
| Command and Control | T1001.003 | Data Obfuscation | Protocol or Service Impersonation |
| Command and Control | T1105 | Ingress Tool Transfer | – |
| Command and Control | T1132.001 | Data Encoding | Standard Encoding |
| Command and Control | T1573.002 | Encrypted Channel | Asymmetric Cryptography |
REFERENCES:
The following reports contain further technical details:
https://cybersecuritynews.com/coldriver-apt-group-uses-clickfix/
https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix