EXECUTIVE SUMMARY
A malware campaign has been observed using Bitbucket, a legitimate code-hosting platform, to distribute malicious payloads. This attack involves the deployment of AsyncRAT, a powerful Remote Access Trojan (RAT) that has been gaining traction among. The attackers exploit Bitbucket’s public repositories to deliver their payloads, bypassing traditional security mechanisms due to the platform’s perceived legitimacy. The campaign follows a multi-stage process, starting with obfuscated scripts and progressing through several stages of execution to deploy the AsyncRAT malware.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
A malware campaign has been observed using Bitbucket, a legitimate code-hosting platform, to distribute malicious payloads. This attack involves the deployment of AsyncRAT, a powerful Remote Access Trojan (RAT) that has been gaining traction among. The attackers exploit Bitbucket’s public repositories to deliver their payloads, bypassing traditional security mechanisms due to the platform’s perceived legitimacy. The campaign follows a multi-stage process, starting with obfuscated scripts and progressing through several stages of execution to deploy the AsyncRAT malware.[emaillocker id="1283"]
The attack unfolds in three stages, beginning with an obfuscated VBScript file named "DEMANDA LABORAL.vbs." This file initiates the infection chain by executing a PowerShell command designed to download a .NET-based payload from a Bitbucket repository. The VBScript employs layered Base64 encoding and string manipulation to conceal its true intent. Once decoded, the PowerShell script retrieves a Base64-encoded file named "dllhope.txt" from Bitbucket. Decoding this file reveals a .NET DLL, ClassLibrary3.dll, which loads directly into memory to avoid detection. Within this DLL, methods are configured to perform tasks such as anti-virtualization checks, persistence setup using Registry Run keys and Startup Folder shortcuts, and eventually, download and execute AsyncRAT. AsyncRAT then provides the attackers with remote control capabilities, including file management, keylogging, remote desktop access, and process manipulation.
This attack demonstrates the evolving tactics who leverage trusted platforms like Bitbucket for malicious purposes, making it difficult for traditional security solutions to detect and block the threat. The use of obfuscation, in-memory execution, and advanced persistence mechanisms allows the attackers to maintain control over compromised systems and perform a wide range of malicious activities. It should implement enhanced monitoring, behavior-based detection, and restrictions on downloading from untrusted repositories to mitigate the risk of such attacks.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Execution | T1059 | Command and Scripting Interpreter |
| Persistence | T1547 | Boot or Logon Autostart Execution |
| Defense Evasion | T1027 | Obfuscated Files or Information |
| T1036 | Masquerading | |
| T1140 | Deobfuscate/Decode Files or Information | |
| T1055 | Process Injection | |
| T1497 | Virtualization/Sandbox Evasion | |
| Credential Access | T1003 | OS Credential Dumping |
| Lateral Movement | T1021 | Remote Services |
| Collection | T1056 | Input Capture |
| T1113 | Screen Capture | |
| Command and Control | T1219 | Remote Access Software |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
| Impact | T1486 | Data Encrypted for Impact |
REFERENCES:
The following reports contain further technical details:
https://cybersecuritynews.com/hackers-abusing-bitbucket-code-hosting-platform/