According to Elastic Security Labs’ cybersecurity experts, they identified a highly advanced sophistication ClickFix campaign using legitimate websites to be able to distribute the MIMICRAT (also known as AstarionRAT) remote access tool (RAT) written in C++ and never documented before.
The ClickFix campaign has demonstrated operational anti-security. The click fixes attackers compromised high volume target web sites from multiple industries and geographically distributed to be able to include malicious JavaScript as well as successfully compromise a computer's security defenses by means of a multi-step PowerShell process before dropping the final malicious payload on the target system.
Infection Chain Breakdown
1. The victim goes to a website that may have been compromised that looks legitimate. For example, in this case, bincheck[.]io was used on this campaign and has been utilized as a legitimate BIN validator prior to being compromised.
2. Injected JavaScript runs an external code that retrieves an external PHP script to display a fake Cloudflare validation page on the user's screen.
3. The page advises the user to copy a command and paste it in the Windows Run (Win + R) to "fix" the issue shown as a result of the supposed failure.
4. PowerShell Stager 1 : runs a PowerShell script to retrieve Stager 2 from the C2 server.
5. Bypassing ETW and AMSI : Stager 2 modifies Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) for logging purposes in order to avoid being detected by AV software.
6. Lua Loader : executes decrypted shell code which then deploys MIMICRAT.
7. C2 Communication : Uses HTTPS over Port 443 with HTTP traffic typical of legitimate web analytics sites such that AV wont detect C&C communication.
MIMICRAT is a robust C++ based RAT that offers the following functionality:
1) Windows token impersonation
2) SOCKS5 Proxy tunneling
3) 22 various commands used for post exploitation purposes (e.g., manipulating a process, accessing the file system, running an interactive shell, running shellcode injections, etc.)
Since the campaign supports 17 different languages, lure content is dynamically localized based on browser language settings for the greatest effect. The victims of this campaign are worldwide with reported instances in the U.S. (via college students) and users that speak Chinese (individuals that have posted self-reports of being infected on public forums).
Tactical Overlaps & Goals
Elastic notes tactical and infrastructure similarities with another ClickFix campaign (documented by Huntress) that deploys Matanbuchus 3.0 loader → same MIMICRAT payload. The final goal will most likely be to deploy ransomware or exfiltrate data.
Key Takeaways
1. ClickFix is still a very effective social engineering method. Users execute commands provided by the attacker under the impression that they are fixing a legitimate problem.
2. True sites that are compromised give attackers a trusted delivery infrastructure with which to avoid reputation-based blocking.
3. The use of multiple steps for evasion (ETW/AMSI bypass + Lua Shellcode + HTTPS impersonation) demonstrates increased sophistication with commodity malware.
4. Widespread targeting indicates that attackers are abusing these methods and making opportunistic rather than strictly targeted operations.
Recommendations:
1. Do not copy and paste any command from the website and run it in Run, PowerShell or Terminal. Verify the accuracy of the command independently.
2. Your organization should train their team to treat prompts for "verification" or "fix your browser" as high risk and indicate that this is an example of phishing.
3. Monitor for unexpected PowerShell child processes, for any localhost:port activity that appears suspicious; and for HTTPS traffic with abnormal analytic type headers.
4. Prepare endpoint defenses for the possibility of tampering thru ETW/AMSI and also in-memory execution methods.
5. Periodically audit browser extensions; and examine software that has been installed for any signs of compromise.
This campaign provides a clear example of how attackers are continuing to develop ClickFix and using the trust users have in legitimate sites and simple instructions to create a reliable initial access vector.
Source: The Hacker News
