Cybersecurity professionals have flagged a disturbing shift in the malware domain, with cybercriminals increasingly relying on fileless attack strategies to bypass conventional defense systems.
One of the latest threats to surface is a sophisticated PowerShell-based loader that deploys the Remcos Remote Access Trojan (RAT). This evolving tactic highlights how attackers are refining their methods to stay hidden within compromised environments.
The assault kicks off with deceptive ZIP files containing malicious LNK files. Upon activation, these files trigger a series of actions meant to minimize the trail left behind. Through exploiting proxy execution via trusted system binaries, the attack achieves persistence while remaining almost entirely in memory, thereby sidestepping file-scanning security measures.
Discovered during routine threat detection efforts by Qualys researchers, this attack demonstrates an advanced ability to elude traditional endpoint defense systems.
“This new wave of fileless attacks demonstrates a marked leap in sophistication,” said Prashant Pawar, Lead Threat Research Engineer at Qualys.
“By executing malicious code directly in memory and leveraging legitimate Windows components, this threat goes unnoticed by standard security software.”
The consequences of such an attack are far-reaching. Beyond the initial breach, Remcos RAT grants attackers a wide range of capabilities, including screen capture, keylogging, browser-based credential theft, and automated data theft.
Attack Chain Overview (Source – Qualys)
Due to its covert characteristics, this malware can remain active within systems for prolonged periods, allowing attackers to work undetected while defenders struggle to identify the intrusion.
The primary method of delivery is through email attachments that appear to be harmless tax documents.
Once accessed, these attachments initiate a complex series of actions, leading to the direct injection of the Remcos RAT into system memory, completely bypassing disk storage and leaving no trace on the hard drive.
Detection and Mitigation by Qualys EPP (Source – Qualys)
The initial LNK file was swiftly identified and removed by Qualys EPP, preventing the malware from taking hold and blocking the threat before it could spread.
Techniques for Evasion and Persistence
The attack employs a variety of sophisticated methods to avoid detection. At the heart of the operation is PowerShell’s capacity to run code directly within the system’s memory, circumventing traditional file-based security measures.
To further evade analysis, the attackers have layered multiple obfuscation techniques within their PowerShell scripts. These include the use of encrypted strings, dynamic API calls, and padding, all designed to hinder automated detection and analysis systems.
The malicious chain begins when a user clicks on a compromised LNK file, which launches MSHTA with specially crafted command parameters.
This action initiates the download of an HTA file (labeled xlab22.hta, hash: 1b26f7e369e39312e4fcbc993d483b17) from C2 servers such as mytaxclientcopy[.]com.
Following this, the HTA file triggers PowerShell to deploy the final malicious payload.
Attack Process Flow (Source – Qualys)
The process tree analyzed by Qualys EDR highlights the intricate parent-child process relationships inherent to this attack.
This detailed visualization demonstrates how the attackers exploit trusted Windows processes to run malicious code, forming a convoluted chain that complicates detection and forensic analysis for security teams.
To ensure longevity, the malware modifies registry keys associated with system startup, enabling it to persist across reboots without generating any obvious traces on the disk.
It further uses techniques to bypass User Account Control (UAC), granting elevated privileges that allow the malware to execute high-risk actions without triggering standard security defenses.
Security experts recommend implementing thorough PowerShell logging, activating Antimalware Scan Interface (AMSI) monitoring, and using advanced EDR solutions designed to detect behavioral patterns, instead of solely relying on traditional file signature detection.
Proactive and early identification of these threats is essential to prevent them from establishing a foothold in organizational networks.
