Full Report
The analysis of phishing campaigns carried out by a new threat actor
Analysis Summary
Based on the technical report provided, here is the structured summary of the threat actor’s activity.
# Threat Actor: [Unidentified / New Phishing Actor]
## Attribution & Identity
* **Identification:** A "new threat actor" identified by Group-IB researchers following the analysis of recent phishing campaigns.
* **Aliases:** No specific moniker was assigned in this excerpt, though infrastructure suggests links to the **DuckDNS** dynamic DNS service.
* **Known Associations:** The actor utilizes common commodity malware (AsyncRAT) and public file-sharing services, indicating they may be a mid-tier cybercriminal group rather than an APT.
## Activity Summary
The actor has recently conducted phishing campaigns utilizing malicious Microsoft Word documents. These documents leverage high-impact, legacy vulnerabilities to automate the infection process. The campaigns appear to have a global reach with specific localized lures in Eastern Europe.
## Tactics, Techniques & Procedures
* **Phishing:** Delivery of malicious attachments via email lures (e.g., "New Order," "June documents").
* **Exploitation:** Use of **CVE-2017-11882** (Microsoft Office Memory Corruption vulnerability) to execute code via OLE objects (specifically `wd32PrvSE.wmf`).
* **Scripting:** Execution of HTA (HTML Application) files containing Visual Basic scripts.
* **PowerShell:** Use of Base64-encoded PowerShell commands to download secondary payloads.
* **Persistence/Staging:** Use of public file-sharing and paste sites to host payloads and configuration data.
* **MITRE ATT&CK IDs:**
* T1566.001 (Phishing: Malicious Attachment)
* T1203 (Exploitation for Client Execution)
* T1059.001 (PowerShell)
* T1059.005 (Visual Basic)
* T1105 (Ingress Tool Transfer)
## Targeting
* **Sectors:** Not explicitly limited; "New Order" lures suggest general corporate/commercial targeting.
* **Geography:** Ukraine (indicated by lures in the Ukrainian language: "таблиці.doc") and potentially Spanish-speaking regions ("Estos son los documentos adjuntos...").
* **Victims:** General organizations susceptible to business-themed phishing lures.
## Tools & Infrastructure
* **Malware Families:**
* **AsyncRAT:** A remote access trojan used for data exfiltration and remote control.
* **Infrastructure:**
* **C2:** kizzoyi.duckdns[.]org (Port 8808)
* **IP Addresses:** 68.235.38[.]157
* **Hosting/Staging:**
* hxxp://68.235.38[.]157/oyii.hta
* hxxps://m.put[.]re/Qm8He5E4.exe
* hxxps://paste[.]ee/r/rSrae
* kingtexs-tvv[.]com
* **Filenames:** `avantfirewall.exe`, `таблиці.doc`, `New Order.doc`
## Implications
The actor demonstrates a proficient use of n-day vulnerabilities (CVE-2017-11882) which, despite being years old, remain highly effective against organizations with lagging patch management. By using commodity malware like AsyncRAT and dynamic DNS/public paste sites, the actor maintains a low-cost operation that is difficult to attribute definitively while remaining highly effective at compromising workstations.
## Mitigations
* **Patch Management:** Urgently apply updates for Microsoft Office to remediate **CVE-2017-11882**.
* **Email Security:** Implement robust Business Email Protection to identify and quarantine documents containing OLE objects or malicious macros.
* **Network Filtering:** Block access to known dynamic DNS providers (like DuckDNS) and public paste sites (paste[.]ee) if there is no legitimate business need.
* **Endpoint Defense:** Deploy XDR/EDR solutions to detect the execution of PowerShell with Base64-encoded strings and HTA file execution.