Full Report
Get an inside look at how threat actors use phishing and social engineering tactics to target users and infiltrate organizations.
Analysis Summary
# Incident Report: Targeted Phishing via Obfuscated LNK and HTA Payloads
## Executive Summary
A targeted user within an organization was compromised through a sophisticated phishing attack that leveraged a malicious ZIP archive masquerading as business-related tax documents. The attack used an obfuscated Windows shortcut (LNK) to trigger a multi-stage infection process involving MSHTA, BITSAdmin, and PowerShell to deploy a decoy PDF while silently executing a malicious payload (`mail.com`). The incident was detected and contained by Huntress analysts before significant lateral movement or data exfiltration could occur.
## Incident Details
- **Discovery Date:** Circa August 2023
- **Incident Date:** August 2023
- **Affected Organization:** Not disclosed (Huntress Customer)
- **Sector:** Finance/Administrative (Handling tax and W2 forms)
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** August 2023
- **Vector:** Phishing Email
- **Details:** The user received a ZIP archive containing two files: a decoy video file (`my tax.mp4`) and a malicious Windows shortcut (`tax_file.lnk`).
### Lateral Movement
- **Status:** Not detailed in the report; the attack was identified during the initial execution and payload delivery phase.
### Data Exfiltration/Impact
- **Status:** Potential for full system compromise. The attacker deployed a decoy W2 PDF to distract the user while a background process (`mail.com`) established a foothold.
### Detection & Response
- **Detection:** Huntress MDR identified "MSHTA Downloading Remote Payload" and "Suspicious BITSAdmin" activity.
- **Response:** Analysts identified the malicious batch script and the `transfer.sh` activity, leading to containment of the affected endpoint.
## Attack Methodology
- **Initial Access:** Social Engineering/Phishing (Tax-themed lure).
- **Persistence:** Use of BITS (Background Intelligent Transfer Service) to manage downloads.
- **Privilege Escalation:** Not specified.
- **Defense Evasion:** Obfuscated LNK command lines; use of `mshta.exe` to execute remote HTA files; deployment of a decoy PDF (`W2.pdf`) to mask malicious activity.
- **Credential Access:** Not specified.
- **Discovery:** Not specified.
- **Lateral Movement:** Not specified.
- **Collection:** Not specified.
- **Exfiltration:** Not specified.
- **Impact:** Potential remote access and full endpoint compromise via the execution of `mail.com`.
## Impact Assessment
- **Financial:** Minimal (Prevented); potential for high cost if ransomware or wire fraud followed.
- **Data Breach:** None confirmed; however, the attacker targeted a user who handles sensitive tax/W2 information.
- **Operational:** Low; isolated to a single workstation.
- **Reputational:** Minimal; incident was contained internally.
## Indicators of Compromise
- **Network Indicators:**
- hxxps[:]//transfer[.]sh/get/RzbMK13oyI/p.hta
- hxxps[:]//transfer[.]sh//mail.zip
- hxxps[:]//transfer[.]sh//W2.pdf
- **File Indicators:**
- `tax_file.lnk` (LNK file)
- `p.hta` (HTA payload)
- `mail.zip` (Malicious archive)
- `mail.com` (Final executable payload)
- **Behavioral Indicators:**
- `mshta.exe` making external network connections to file-sharing sites.
- `bitsadmin.exe` used to download files to `%TEMP%` directories.
- PowerShell executed with `-WindowStyle Hidden` and obfuscated path variables.
## Response Actions
- **Containment:** Isolated the infected workstation from the network.
- **Eradication:** Terminated malicious processes and deleted temporary files in the `%TEMP%\mail` directory.
- **Recovery:** Restored user access after a clean OS re-image and credential reset.
## Lessons Learned
- **Context Matters:** Attackers are researching the job functions of their targets. Because the user regularly handled tax files, the lure was highly effective.
- **Evasion Evolution:** Modern phishing relies less on "broken English" and more on "living off the land" (LotL) binaries like `mshta.exe` and `bitsadmin.exe` to bypass traditional AV.
## Recommendations
- **Technical Controls:** Block or monitor execution of `mshta.exe` and `bitsadmin.exe` if not required for business operations.
- **Email Security:** Implement strict filtering for ZIP files containing LNK or HTA files.
- **Security Awareness:** Train employees to be wary of LNK files (shortcuts) inside ZIP archives, even if the filename appears relevant to their job.
- **Architecture:** Implement "Least Privilege" to ensure that if a user executes a malicious file, the damage is restricted.