EXECUTIVE SUMMARY
Researchers have identified a new phishing campaign utilizing Discord’s Content Delivery Network (CDN) to deliver malicious payloads. This campaign was uncovered following a phishing incident where an MDR client received a malicious zip file. Upon detection of the malicious activity chain, the endpoint was isolated, and a thorough analysis was conducted to understand the nature and impact of the attack.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
Researchers have identified a new phishing campaign utilizing Discord’s Content Delivery Network (CDN) to deliver malicious payloads. This campaign was uncovered following a phishing incident where an MDR client received a malicious zip file. Upon detection of the malicious activity chain, the endpoint was isolated, and a thorough analysis was conducted to understand the nature and impact of the attack.[emaillocker id="1283"]
The attack begins with an email containing a zip file named DOCUMENT-12545403-8265-5454-434354-430854546.zip. This zip file includes a shortcut file .lnk designed to appear as a PDF. When the user executes this shortcut, it triggers a PowerShell command that downloads and executes additional malicious code from a remote text file. The PowerShell script executes a command that fetches and runs a file hosted on Discord’s CDN. Specifically, the malicious script downloads a text file containing further instructions for fetching and executing two payloads: a malicious executable named ByelongBound.exe, and a PDF file named FASF240110.pdf. The use of Discord’s CDN allows the attackers to leverage its robust and distributed infrastructure to deliver these payloads quickly and reliably, bypassing traditional security measures due to the trusted nature of the CDN. This approach takes advantage of the CDN’s reputation and performance to evade detection and facilitate the delivery of malicious content.
This campaign demonstrates how attackers can misuse legitimate CDN services like Discord’s to deliver malware while leveraging the CDN’s trusted reputation. Organizations should consider blocking Discord if it is not used within their network to prevent such phishing attacks. Vigilance and immediate action in response to suspicious emails and attachments are essential to defend against these advanced threats.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Initial Access | T1566 | Phishing |
| Execution | T1059 | Command and Scripting Interpreter |
| T1203 | Exploitation for Client Execution | |
| Defense Evasion | T1036 | Masquerading |
| Collection | T1074 | Data Staged |
| Command and Control | T1105 | Ingress Tool Transfer |
REFERENCES:
The following reports contain further technical details:
https://www.threatdown.com/blog/new-phishing-campaign-uses-discord-for-payload-delivery/