A recent malware campaign has been identified, leveraging Visual Basic Script (VBS) and PowerShell to deploy remote access trojans (RATs) via multiple DuckDNS hosts. This method exploits built-in Windows scripting capabilities, making the malicious activity appear as routine system operations.
The attack initiates when a user executes a heavily obfuscated VBS file. Upon execution, this script decrypts an AES-256 encrypted PowerShell stage, which subsequently extracts a 64-bit payload. Utilizing a .NET helper, the malware employs process hollowing to inject its code into AppLaunch.exe, a legitimate process. This technique allows the malicious code to run under the guise of a trusted application, thereby evading basic security checks.
DuckDNS, a free dynamic DNS service, is exploited in this campaign to distribute the malware. By utilizing multiple DuckDNS subdomains, attackers can dynamically update IP addresses, complicating efforts to block malicious domains. Additionally, the malware can connect directly to an IP address, providing an alternative communication channel if a domain is disrupted.
Once established on a system, the RAT exhibits several concerning behaviors. It harvests browser credentials and cookies, enabling unauthorized access to personal accounts and sensitive information. The malware also records keystrokes and captures clipboard contents, potentially exposing passwords, messages, and financial data. To maintain persistence, it places itself in the Windows Startup folder under a misleading name and attempts to add exclusions in Microsoft Defender, reducing the likelihood of detection.
Organizations are advised to implement several defensive measures to mitigate this threat. Blocking known malicious DuckDNS subdomains at web, DNS, and network levels can prevent initial infection. Monitoring for unusual PowerShell activity, especially scripts that are encoded or hidden, is crucial. Users should be cautious of executing script files from untrusted sources, even if they appear as routine documents. Administrators can enhance security by restricting script execution where unnecessary and promptly investigating any changes to Defender exclusions.
This campaign underscores the evolving tactics of cybercriminals who exploit legitimate services and system features to distribute malware. The use of dynamic DNS services like DuckDNS for command-and-control infrastructure highlights the need for adaptive security measures. Organizations must remain vigilant, continuously updating their defense strategies to address these sophisticated threats.
