Morphisec, through its breach prevention with Moving Target Defense technology, has identified a new, sophisticated campaign delivery which has been successfully evading the radar of many security vendors. Through a simple email phishing tactic with an html attachment, threat attackers are delivering AsyncRAT (a remote access trojan) designed to remotely monitor and control its infected computers through a secure, encrypted connection. This campaign has been in effect for a period of 4 to 5 months, with the lowest detection rates as presented through VirusTotal.
Morphisec backtraced the campaign to September 12, 2021. This campaign continued its evolution while delivering formally known crypter as a service, such as HCrypt and Alosh. This blog post explains the campaign delivery vector in detail.
In many cases, victims received an email message with an html attachment in the form of a receipt: Receipt-<digits>.html.
Below is an example of such an email message:
Figure 1: Fake receipt
When the victim decides to open the receipt, they see the following webpage that requests them to save a downloaded ISO file. They believe it’s a regular file download that will go through all the channels of gateway and network security scanners. Surprisingly, that’s not