The threat is distributed through geo-targeted spear-phishing emails written in Korean, masquerading as tax invoices from a major logistics provider. The malicious payload is concealed within a compressed archive containing a weaponized document that appears visually blank to the user. This delivery method relies on social engineering to trick recipients into opening the file and approving a security prompt. The campaign specifically targets corporate users and accounting departments in South Korea, aiming to bypass initial suspicion by leveraging the reputation of the impersonated brand. The risk involves the execution of a multistage fileless campaign that delivers a previously undocumented backdoor variant, allowing attackers to establish persistent remote access without leaving traditional file artifacts on the victim system.
The infection chain utilizes a nested execution model where each stage decrypts and loads the next entirely in memory. The initial document triggers a hidden command interpreter that decrypts an encrypted and compressed data blob using symmetric cryptography. This data is loaded reflectively as a managed assembly, which then derives a key to decrypt further resources and reconstructs the next stage by removing interleaved junk data. The subsequent native injector proactively patches event tracing and hot-patching mechanisms to blind endpoint detection sensors. It then retrieves the final payload from a remote server and injects it into legitimate system processes using asynchronous procedure call injection. This technique hides the backdoor within trusted contexts, preventing the malware from touching the disk in an unencrypted state and evading memory scanners that look for standard executable headers.[/subscribe_to_unlock_form]
The threat is distributed through geo-targeted spear-phishing emails written in Korean, masquerading as tax invoices from a major logistics provider. The malicious payload is concealed within a compressed archive containing a weaponized document that appears visually blank to the user. This delivery method relies on social engineering to trick recipients into opening the file and approving a security prompt. The campaign specifically targets corporate users and accounting departments in South Korea, aiming to bypass initial suspicion by leveraging the reputation of the impersonated brand. The risk involves the execution of a multistage fileless campaign that delivers a previously undocumented backdoor variant, allowing attackers to establish persistent remote access without leaving traditional file artifacts on the victim system.
The infection chain utilizes a nested execution model where each stage decrypts and loads the next entirely in memory. The initial document triggers a hidden command interpreter that decrypts an encrypted and compressed data blob using symmetric cryptography. This data is loaded reflectively as a managed assembly, which then derives a key to decrypt further resources and reconstructs the next stage by removing interleaved junk data. The subsequent native injector proactively patches event tracing and hot-patching mechanisms to blind endpoint detection sensors. It then retrieves the final payload from a remote server and injects it into legitimate system processes using asynchronous procedure call injection. This technique hides the backdoor within trusted contexts, preventing the malware from touching the disk in an unencrypted state and evading memory scanners that look for standard executable headers.[emaillocker id="1283"]
The backdoor features extensive remote access capabilities, including screen capture and geofencing that validates the victim location against a list of supported countries. It establishes persistence through multiple vectors, including registry modifications, scheduled tasks, and provisioning packages that survive system resets. The actor demonstrates active development by implementing complex defense evasion techniques and flexible installation routines that adapt to privilege levels. Defensive implications suggest that organizations must monitor for unusual document execution and in-memory assembly loading. Additionally, endpoint solutions should prioritize detecting event tracing tampering and asynchronous procedure call injection to disrupt the stealthy execution chain before the final payload is deployed.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Execution | T1204.002 | User Execution | Malicious File |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Persistence | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Persistence | T1574.002 | Hijack Execution Flow | DLL Side-Loading |
| Persistence | T1547.004 | Boot or Logon Autostart Execution | Winlogon Helper DLL |
| Defense Evasion | T1140 | Obfuscated Files or Information | - |
| Defense Evasion | T1620 | Reflective Code Loading | - |
| Defense Evasion | T1055.005 | Process Injection | Dynamic Link Library Injection |
| Defense Evasion | T1562.008 | Impair Defenses | System Services |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
The following reports contain further technical details:
[/emaillocker]