Ptechhub
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
PtechHub
No Result
View All Result

Multi-Stage Malware Attack Uses .JSE and PowerShell to Deploy Agent Tesla and XLoader

The Hacker News by The Hacker News
April 18, 2025
Home Cybersecurity
Share on FacebookShare on Twitter


A new multi-stage attack has been observed delivering malware families like Agent Tesla variants, Remcos RAT, and XLoader.

“Attackers increasingly rely on such complex delivery mechanisms to evade detection, bypass traditional sandboxes, and ensure successful payload delivery and execution,” Palo Alto Networks Unit 42 researcher Saqib Khanzada said in a technical write-up of the campaign.

The starting point of the attack is a deceptive email that poses as an order request to deliver a malicious 7-zip archive attachment, which contains a JavaScript encoded (.JSE) file.

The phishing email, observed in December 2024, falsely claimed that a payment had been made and urged the recipient to review an attached order file. Launching the JavaScript payload triggers the infection sequence, with the file acting as a downloader for a PowerShell script from an external server.

Cybersecurity

The script, in turn, houses a Base64-encoded payload that’s subsequently deciphered, written to the Windows temporary directory, and executed. Here’s where something interesting happens: The attack leads to a next-stage dropper that is either compiled using .NET or AutoIt.

In case of a .NET executable, the encrypted embedded payload – an Agent Tesla variant suspected to be Snake Keylogger or XLoader – is decoded and injected into a running “RegAsm.exe” process, a technique observed in past Agent Tesla campaigns.

The AutoIt compiled executable, on the other hand, introduces an additional layer in an attempt to further complicate analysis efforts. The AutoIt script within the executable incorporates an encrypted payload that’s responsible for loading the final shellcode, causing .NET file to be injected into a “RegSvcs.exe” process, ultimately leading to Agent Tesla deployment.

Multi-Stage Malware Attack

“This suggests that the attacker employs multiple execution paths to increase resilience and evade detection,” Khanzada noted. “The attacker’s focus remains on a multi-layered attack chain rather than sophisticated obfuscation.”

“By stacking simple stages instead of focusing on highly sophisticated techniques, attackers can create resilient attack chains that complicate analysis and detection.”

IronHusky Delivers New Version of MysterySnail RAT

The disclosure comes as Kaspersky detailed a campaign that targets government organizations located in Mongolia and Russia with a new version of a malware called MysterySnail RAT. The activity has been attributed to a Chinese-speaking threat actor dubbed IronHusky.

IronHusky, assessed to be active since at least 2017, was previously documented by the Russian cybersecurity company in October 2021 in connection with the zero-day exploitation of CVE-2021-40449, a Win32k privilege escalation flaw, to deliver MysterySnail.

The infections originate from a malicious Microsoft Management Console (MMC) script that mimics a Word document from the National Land Agency of Mongolia (“co-financing letter_alamgac”). The script is designed to retrieve a ZIP archive with a lure document, a legitimate binary (“CiscoCollabHost.exe”), and a malicious DLL (“CiscoSparkLauncher.dll”).

It’s not exactly known how the MMC script is distributed to targets of interest, although the nature of the lure document suggests that it may have been via a phishing campaign.

As observed in many attacks, “CiscoCollabHost.exe” is used to sideload the DLL, an intermediary backdoor capable of communicating with attacker-controlled infrastructure by taking advantage of the open-source piping-server project.

Cybersecurity

The backdoor supports capabilities to run command shells, download/upload files, enumerate directory content, delete files, create new processes, and terminate itself. These commands are then used to sideload MysterySnail RAT.

The latest version of the malware is capable of accepting nearly 40 commands, allowing it to perform file management operations, execute commands via cmd.exe, spawn and kill processes, manage services, and connect to network resources via dedicated DLL modules.

Kasperksy said it observed the attackers dropping a “repurposed and more lightweight version” of MysterySnail codenamed MysteryMonoSnail after preventive actions were taken by the affected companies to block the intrusions.

“This version doesn’t have as many capabilities as the version of MysterySnail RAT,” the company noted. “It was programmed to have only 13 basic commands, used to list directory contents, write data to files, and launch processes and remote shells.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
The Hacker News

The Hacker News

Next Post
Andy Jassy: ‘Chips Are The Biggest Culprit’ In Expensive AI; AWS Will Fix It

Andy Jassy: ‘Chips Are The Biggest Culprit’ In Expensive AI; AWS Will Fix It

Recommended.

EZEE FIBER INVESTS OVER 0 MILLION TO EXPAND FIBER-TO-THE-PREMISES NETWORK INTO THE GREATER CHICAGOLAND AREA

EZEE FIBER INVESTS OVER $400 MILLION TO EXPAND FIBER-TO-THE-PREMISES NETWORK INTO THE GREATER CHICAGOLAND AREA

July 30, 2025
Huawei Cloud: tworzenie sprzyjających warunków dla obliczeń, wspieranie pionierów rozwiązań AI dla różnych branż

Huawei Cloud: tworzenie sprzyjających warunków dla obliczeń, wspieranie pionierów rozwiązań AI dla różnych branż

September 21, 2025

Trending.

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

October 6, 2025
Cloud Computing on the Rise: Market Projected to Reach .6 Trillion by 2030

Cloud Computing on the Rise: Market Projected to Reach $1.6 Trillion by 2030

August 1, 2025
Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

July 14, 2025
The Ultimate MSP Guide to Structuring and Selling vCISO Services

The Ultimate MSP Guide to Structuring and Selling vCISO Services

February 19, 2025
Translators’ Voices: China shares technological achievements with the world for mutual benefit

Translators’ Voices: China shares technological achievements with the world for mutual benefit

June 3, 2025

PTechHub

A tech news platform delivering fresh perspectives, critical insights, and in-depth reporting — beyond the buzz. We cover innovation, policy, and digital culture with clarity, independence, and a sharp editorial edge.

Follow Us

Industries

  • AI & ML
  • Cybersecurity
  • Enterprise IT
  • Finance
  • Telco

Navigation

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Subscribe to Our Newsletter

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Copyright © 2025 | Powered By Porpholio

No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs

Copyright © 2025 | Powered By Porpholio