{"id":26146,"date":"2026-09-21T13:06:23","date_gmt":"2026-09-21T21:06:23","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader-3\/"},"modified":"2026-09-21T13:06:23","modified_gmt":"2026-09-21T21:06:23","slug":"the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader-3","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader-3\/","title":{"rendered":"The TTF Trap: A Global Campaign of a Low-Detection Lua Loader"},"content":{"rendered":"<div class=\"Table-Content aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"blog-toc\">\n<div class=\"b3-blog-list__row\">\n<div class=\"b3-blog-list__column-left table-content-wrapper automatic\">\n<ul class=\"table-of-content\">\n<li class=\"header\"><img decoding=\"async\" alt=\"\" class=\"toc-icon\" src=\"\/content\/dam\/fortinet\/images\/toc-icon.jpg\"\/>Article Contents<\/li>\n<\/ul>\n<\/div>\n<div class=\"aem-GridColumn aem-GridColumn--default--8 b3-blog-list__column-right scrolling-content automatic\">\n<div class=\"b15-blog-meta__container text-container\">\n<span>By <\/span><br \/>\n<span class=\"b15-blog-meta__author\"><br \/>\n<a href=\"\/blog\/search?author=Yurren+Wan\">Yurren Wan<\/a><br \/>\n<\/span><br \/>\n<span class=\"b15-blog-meta__\"><br \/>\n<\/span><br \/>\n<span class=\"b15-blog-meta__date\"> | July 16, 2026<\/span>\n<\/div>\n<div class=\"C875-Disclaimer\">\n<\/div>\n<div class=\"raw-import\">\n<div class=\"text-container\"><\/div>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p style=\"\tmargin-left: 80.0px;\n\"><b>Affected Platforms: <\/b>Microsoft Windows<br \/>\n<b>Impacted Users: <\/b>Any organization<br \/>\n<b>Impact: <\/b>Attackers gain control of the infected systems or stolen data may be leveraged for follow-on attacks<br \/>\n<b>Severity Level: <\/b>High<\/p>\n<p>Since late March, 2026, we have been observing large-scale campaigns that use a combination of fileless techniques and Lua-based loaders with low detection rates to deploy various malware families, including Agent Tesla, Remcos, XWorm, and Best Private LOGGER.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 1: Lua-based loader on VirusTotal<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>In these attack campaigns, the threat actor impersonates several well-known companies, using the guise of business cooperation to launch phishing attacks. To evade detection, the actor employs multi-layered, highly obfuscated stages, including extensive junk code and an AutoIt\/Lua loader masquerading as a TrueType Font (.ttf) file.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 2: Attack flow<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>Initial Access<\/h2>\n<p>The attack campaign begins with a phishing email that either contains a malicious archive or links to download one, as illustrated in Figure 3. By impersonating a reputable brand, business, or corporation, or using payment-related lures, the attacker manipulates the recipient into opening the attachment by creating a sense of urgency.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 3: The phishing e-mails<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>JScript<\/h2>\n<p>Within the archive, the JavaScript file is obfuscated and embedded in a substantial amount of junk code. Even after extraction and beautification, the code retains a complex structure typical of obfuscation tools, as shown in Figure 4.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 4: The obfuscated script.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The script employs highly complex obfuscation techniques, including string array mapping, control flow flattening, and anti-tampering mechanisms, to evade both manual and AI-driven analysis.<\/p>\n<p>Within the core logic, critical strings\u2014such as the ActiveX object and the output file paths\u2014are obfuscated using signature evasion. These delimiters are then removed at runtime using .split() and .join() methods.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 5: Signature evasion in critical strings.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The execution flow begins by verifying two conditions: the absence of the next-stage files and whether a specific variable is set to &#8216;YESSSSSSSS.&#8217; If both conditions are met, the script copies itself to the %PUBLIC%\\Libraries folder and establishes persistence via a Scheduled Task.<\/p>\n<p>To deploy the next stage, the script extracts hardcoded, encoded data and processes it through a series of steps: reversing the strings, removing junk delimiters, and decoding from Base64. The resulting data is then saved to the specified file path. These dropped files may include an executable for an AutoIt interpreter or LuaJIT, along with accompanying scripts and encoded data.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 6: The routine used to extract the embedded payload to disk.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>Finally, it instantiates a WScript.Shell object to launch the executable, passing the script as a parameter.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 7: Running the deployed executable and providing the .ttf file as a parameter.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>Lua Loader<\/h2>\n<p>Lua is a fast, lightweight, and simple scripting language ideal for game development, embedded systems, and automation due to its low memory footprint and ease of integration. Its just-in-time compiler, LuaJIT, features a Foreign Function Interface (FFI) that allows seamless interaction with C data structures and native system APIs.<\/p>\n<p>In the campaign, the dropped .ttf file is actually a disguised Lua script. A review of the related executable&#8217;s metadata confirms its LuaJIT version, as shown in Figure 8.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 8: Strings found in the LuaJIT executable.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The script begins with an encrypted data block and numerous decimal-encoded strings to impede analysis.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 9: The obfuscated Lua loader.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>At the core, the loader employs a three-step method for parsing the encoded payload.<\/p>\n<p>First, the hardcoded string is reversed, and a set of replacement rules is applied: symbols ~, @, #, :, &amp;, *, &gt;, and &lt; are replaced with A, B, C, D, a, b, c, and d, respectively. Then, the resulting string is decoded from Base64.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 10: Decryption routine: steps 1 and 2.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>Subsequently, a custom ROT cipher is applied. The first byte of the encrypted string serves as the rotation key. Once the key&#8217;s validity is verified, the rotation value is calculated using the formula: <b>94 \u2013 {first_byte} &#8211; 128<\/b>. The remaining data is then processed with the ROT cipher, ensuring the output consists of printable ASCII characters, as illustrated in Figure 11.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 11: Applying the custom ROT cipher.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>In addition to the decryption routine, the sample employs several anti-analysis and evasion techniques. These include allocating decoy memory regions, patching key characteristics for subsequent layers, and implementing page guards. Furthermore, it performs an in-memory XOR encryption and decryption cycle on the shellcode using a consistent key to further hinder detection.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 12: The core logic of the Lua loader.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>Decoy Memory<\/h2>\n<p>It allocates a decoy memory and fills it with the suspicious string and randomly generated data, as shown in Figures 13 and 14.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 13: Decoy memory with a suspicious string.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p class=\"cq-text-placeholder-ipe\" data-emptytext=\"Text\">\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 14: Decoy memory with random data.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>PatchDonut64Header<\/h2>\n<p>The function scans for byte sequences and string signatures characteristic of Donut shellcode, then obfuscates them with a mask composed of 144, 204, and randomly generated uppercase characters to evade detection.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 15: Function for Patching Donut characteristic.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>In the final stage, the shellcode is executed via a protected call (pcall) using a memory address that has already been cast to a callable C function pointer.<\/p>\n<p>Throughout our research, we tracked samples ranging from the earliest version, which appeared in October 2025, to the most recent, which appeared in June 2026. Their evolution is shown below.<\/p>\n<h2>October 2025<\/h2>\n<p>While this version retains characteristics similar to previous iterations, the execution flow has become clearer.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 16: The earliest version of the Lua loader.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The sample initiates a legitimate process to serve as a host, allocates memory in the remote process, and writes the decrypted shellcode to the allocated region. Execution is then triggered via CreateRemoteThread. Notably, the decryption routine used here is simpler than in newer iterations. It involves string reversal, Base64 decoding, and a ROT14-like cipher, consistent with the techniques documented in the <a aria-label=\"egfincirt\" href=\"https:\/\/www.egfincirt.org.eg\/remcos-rat-operations-how-attackers-gain-and-maintain-control\/\" rel=\"noopener noreferrer\" target=\"_blank\" title=\"egfincirt\">egfincirt <\/a>blog.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 17: The deobfuscated script.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>June 2026<\/h2>\n<p>Although the initial characteristics appear identical to known patterns, the core logic is significantly more complex. It incorporates a wide array of anti-analysis techniques designed to thwart both Lua and native-level debuggers, including API unhooking and the neutralization of software and hardware breakpoints.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 18: Core logic: the latest Lua loader.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>To obfuscate shellcode execution and hinder analysis, the implementation employs a segmented encryption scheme. The shellcode is partitioned into page-sized segments, which are then encrypted and marked with PAGE_NOACCESS. To facilitate execution, a Vectored Exception Handler (VEH) is registered to intercept access violations. When the program attempts to execute a protected page, the resulting exception triggers the VEH, which decrypts the specific code block and restores the necessary execution permissions, allowing the process to continue.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 19: An obfuscated shellcode execution routine.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>AutoIt Loader<\/h2>\n<p>In a similar attack campaign, we observed the use of AutoIt as the loader stage rather than Lua. In this instance, three files are dropped: the AutoIt interpreter, an AutoIt script, and an encoded data file. The dropped executable can be easily identified by distinct strings associated with the AutoIt interpreter, as shown in Figure 20.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 20: Strings found in the AutoIt Interpreter.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>Initial analysis reveals that the script employs obfuscation techniques, including string encryption and the use of randomized, long-form variable names.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 21: Obfuscated script and the string decoded routine<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>Once deobfuscated, the script&#8217;s true behavior becomes clear. It first defines the necessary structures to launch C:\\Windows\\Syswow64\\colorcpl.exe as a suspended process. It then locates a local data file, decrypts it using XOR, and finally uses low-level ntdll.dll functions to perform process injection and execute the payload. Similar AutoIt loaders were mentioned in <a aria-label=\"G Data\" href=\"https:\/\/blog.gdatasoftware.com\/2026\/05\/38426-donutloader-remcos-rat\" rel=\"noopener noreferrer\" target=\"_blank\" title=\"G Data\">G Data<\/a> blog posts analyzing a Remcos campaign.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 22: Deobfuscated AutoIt script.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>The execution flow is similar to the earliest Lua sample we tracked. Additionally, it is noteworthy that the script employs the same evasion strategy\u2014allocating a significantly larger memory region\u2014to bypass detection.<\/p>\n<h2>Donut Shellcode and Payload<\/h2>\n<p>The malicious payload is wrapped using the <a aria-label=\"Donut shellcode generator\" href=\"\/it\/blog\/threat-research\/purehvnc-deployed-via-python-multi-stage-loader\" title=\"Donut shellcode generator\">Donut shellcode generator<\/a>. Upon successful execution of the Donut shellcode, a built-in reflective loader maps and executes the payload directly in memory, achieving a fileless state to evade disk-based detection.<\/p>\n<p>Throughout these campaigns, we observed the threat actor staging and deploying multiple Remote Access Trojans (RATs) and infostealers on victims&#8217; systems. The identified payloads include Remcos, Agent Tesla, XWorm, and Snake Keylogger variants. These payloads grant the attacker full remote administrative control and enable extensive data exfiltration from compromised systems.<\/p>\n<h2>Best Private LOGGER<\/h2>\n<p>Best Private LOGGER appears to be a modified version of an older Snake Keylogger. As shown in the entry point below, the malware uses a hardcoded signature\u2014&#8217;Best Private LOGGER&#8217;\u2014which is combined with the data it harvests from the victim.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 23: Main function of Best Private LOGGER.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>Additionally, we acquired a Snake VIP Keylogger builder and used it to generate both protected and unprotected versions of the payload for comparative analysis, shown in Figure 24.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 24: Snake VIP Keylogger builder and a protected version program.<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>We subsequently conducted a comparative analysis of the data collection modules across the obfuscated\u00a0<a aria-label=\"Snake Keylogger\" href=\"\/blog\/threat-research\/deep-dive-into-a-fresh-variant-of-snake-keylogger-malware\" title=\"Snake Keylogger\">Snake Keylogger<\/a>, the unprotected VIP Keylogger (generated from the builder), and the Best Private LOGGER. As shown below, all three use the same collection module and coding style. The only observed differences are marginal modifications to the signature and slight variations in the data format.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 25: Snake Keylogger(left), Snake VIP Keylogger (middle), and Best Private LOGGER (right).<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<p>A comparison of the two samples shows that the naming conventions in the unprotected Snake VIP Keylogger and Best Private LOGGER are identical. However, Snake VIP Keylogger has a more extensive feature set, including anti-analysis capabilities and Wi-Fi harvesting. Given these structural similarities, we have identified Best Private LOGGER as a variant of Snake Keylogger.<\/p>\n<\/div>\n<div class=\"cmp cmp-image\">\n<p><!--\n\n<div class=\"enlarge-btn\" data-sly-test=\"\">\n\n<div class=\"gg-maximize-alt\"><\/div>\n\n \n\n<div>Click to Enlarge<\/div>\n\n<\/div>\n\n--><br \/>\n<span class=\"cmp-image--title\">Figure 26: Unprotected Snake VIP Keylogger (left) and Best Private LOGGER(right).<\/span>\n<\/div>\n<div class=\"cmp cmp-text\">\n<h2>Conclusion<\/h2>\n<p>Behind a seemingly harmless file extension lies real danger. In these campaigns, the dropped executable serves as an interpreter, while the core loader script is disguised as a .ttf extension. This disguised loader decrypts, loads, and executes the subsequent stage, which ultimately deploys the malware.<\/p>\n<p>This article reveals a large-scale attack campaign involving heavily obfuscated JScript droppers. These droppers launch an AutoIt\/Lua-based loader to deploy various popular RATs and infostealers, including a version of the Snake Keylogger. The infection chain exploits business email compromise by pretending to be trusted companies, causing a significant global impact. Additionally, our review of the loader&#8217;s development shows it is regularly updated to avoid detection and make analysis more difficult.<\/p>\n<h2>Fortinet Protections<\/h2>\n<p>The malware described in this report are detected and blocked by <a aria-label=\"FortiGuard Antivirus\" href=\"\/support\/support-services\/fortiguard-security-subscriptions\/antivirus\" title=\"FortiGuard Antivirus\">FortiGuard Antivirus<\/a> as:<\/p>\n<p style=\"\tmargin-left: 40.0px;\n\">PDF\/Agent.A529!tr<br \/>\nJS\/Formbook.PYN!tr<br \/>\nJS\/Agent.UNU!tr<br \/>\nJS\/Formbook.AK!tr<br \/>\nJS\/Obfus.gen!tr<br \/>\nData\/Agent.DD19!tr<br \/>\nData\/Lua.9!tr<br \/>\nAutoIt\/Autoit.OTS!tr<br \/>\nW64\/Donut.E!tr<br \/>\nMSIL\/AgentTesla.B!tr<br \/>\nW32\/Rescomms.B!tr<br \/>\nMSIL\/Agent.ECL!tr<br \/>\nMSIL\/SnakeStealer.AVQ!tr.spy<\/p>\n<p>FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard Antivirus Service. The FortiGuard antivirus engine is part of each of those solutions. As a result, customers who have these products with up-to-date protections are protected.<\/p>\n<p>The <a aria-label=\"FortiGuard CDR\" href=\"\/support\/support-services\/fortiguard-security-subscriptions\/content-disarm-reconstruction?utm_source=blog&amp;utm_medium=blog&amp;utm_campaign=fortiguard=cdr\" title=\"FortiGuard CDR\">FortiGuard CDR<\/a> (content disarm and reconstruction) service can disarm the malicious macros within the document.<\/p>\n<p>We also suggest that organizations take the free Fortinet <a aria-label=\"Fortinet Certified Fundamentals (FCF)\" href=\"\/nse-training?utm_source=blog&amp;utm_medium=blog&amp;utm_campaign=fortinet-fcf\" title=\"Fortinet Certified Fundamentals (FCF)\">Fortinet Certified Fundamentals (FCF)<\/a> cybersecurity training. The training is designed to help users learn about today&#8217;s threat landscape and introduces basic cybersecurity concepts and technology.<\/p>\n<p><a aria-label=\"FortiGuard IP Reputation\" href=\"\/support\/support-services\/fortiguard-security-subscriptions\/ipreputation-antibot?utm_source=blog&amp;utm_medium=blog&amp;utm_campaign=fortiguard-ip-rep\" title=\"FortiGuard IP Reputation\">FortiGuard IP Reputation<\/a> and <a aria-label=\"Anti-Botnet Security Service\" href=\"\/support\/support-services\/fortiguard-security-subscriptions\/ipreputation-antibot?utm_source=blog&amp;utm_medium=blog&amp;utm_campaign=fortiguard-ip-rep\" title=\"Anti-Botnet Security Service\">Anti-Botnet Security Service<\/a> proactively block malware attacks by aggregating malicious source IP data from the Fortinet distributed network of threat sensors, CERTs, MITRE, cooperative competitors, and other global sources that collaborate to provide up-to-date threat intelligence about hostile sources.<\/p>\n<p>If you believe this or any other cybersecurity threat has impacted your organization, please contact the Global <a aria-label=\"FortiGuard Incident Response Team\" href=\"\/corporate\/about-us\/contact-us\/experienced-a-breach?utm_source=blog&amp;utm_medium=blog&amp;utm_campaign=\" title=\"FortiGuard Incident Response Team\">FortiGuard Incident Response Team<\/a>.<\/p>\n<h2>IOCs<\/h2>\n<h3>C2:<\/h3>\n<p>104[.]239.66.86[:]7004<br \/>\n46[.]183.223.21[:]2404<br \/>\n107[.]174.34.137[:]443<br \/>\nnewremupdate[.]duckdns.org[:]2404<br \/>\nmail[.]teamengineersgroup.com<br \/>\nmail[.]allportcargoservice.com<br \/>\nmail[.]trimnt.com<br \/>\nmail[.]taikei-rmc-co.biz<\/p>\n<h3>URLs:<\/h3>\n<p>hxxps[:]\/\/cdn[.]discordapp[.]com\/attachments\/1499192125093449759\/1511147377979818074\/F10097782_Request-9200090_0990[.]PDF[.]JS<\/p>\n<h3>PDF:<\/h3>\n<p>9674da676ee226ee456d35c774715d9b58655423806f281de19dc9ef899e9532<\/p>\n<h3>JScripts:<\/h3>\n<p>16f9692debe0d4e35d76b48312979e5a90a85ce066e7375269ce78f43da52769<br \/>\n417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b<br \/>\n619d2628dcf0c8e15a6febb0e562609556ca57f9f8216800ee77a39e336b8bf4<br \/>\n1c4419d687bf45bdc5474b6347e41e89459fc0f5115f0d012c46c57280b242bf<br \/>\n81edd5e740bea0fefb5c1bbd14a671bd1daff37bf3641e34f3a1f7e93559184a<br \/>\n1d9dd914cf623dcae4b88834744a005e5e3eae827ded1aafd23ed1d7be57b90a<br \/>\n6700e6d2a0c285d3ebf1a55aecec63b1e42d7d581f691331c667a8920dac7029<br \/>\n96e22da4d5c0ea4b0efde0ad3eaa8fdedc60228f84fb3c56899afbb9338da2a1<\/p>\n<h3>Lua Scripts:<\/h3>\n<p>05390dd0d2c84f77475c0c6aa082638e23977da591302e911cbcb071c42a9451<br \/>\nc7159e589e29f9c866cc9983839ae9c9a1457df542a2dcd5103baf38636e08fd<br \/>\nbbeb74e6af12536ecb6761a65ed893fbddd1b86a17cd4a61b616e5fc6106ec9a<br \/>\nb12b743d4ecc0fe7320b6c1533e2a60bb89f94ca39a5be37143e7af27daacf04<br \/>\n8c28bc87eb4f2613117d41a716e78f62d55c19edaeea573c2c96e787da055167<br \/>\nbe4fcf88a287f783a3d199e889f9f088f77338eafe0dce70a38ade01192fb223<\/p>\n<h3>AutoIt Scripts:<\/h3>\n<p>1539468a21a439dd4f8d72a6c34ce503f0585281fc2e88535c3c33727bfdc717<br \/>\n4c001e107a42d65c1b1e6092e4aa6932dbd1544d097d1a432ba27e3b4bddfcc1<br \/>\n16516e3298278719123068bf0ed808ea4e00f73c970a8a83377066b4e3c3c950<\/p>\n<h3>Donuts:<\/h3>\n<p>fbf9a87d351ef702d87e0cd9e0148baa44c6d619f50fbf91d79a1c5e37719a77<br \/>\n5b271a1b1ffe2716ae420f8e9d40dbc8e9e682f6e4125d4f174a335bf070ac29<br \/>\n5409b3fa21dcc2f854697ec731f9574603dd0b6bdfd892e968a2b412ed85f52c<br \/>\n7df42fc54f053d1bb65f43d4386a75be02770f7923b66e713fb04631582e864e<br \/>\ne2a95dd038a153dfb463c94554912f992cd04cf0f420552a95f4aea3d6f31e18<br \/>\n775ae9a8c7363e2368cbb559f9c2d26a6c479d4e7998fe71d45830885ccde429<br \/>\n986d1d5270822af7d7744762ecd8fc4e9b2886c85b3660e9fdf0b5906d6c4117<\/p>\n<h3>EXEs:<\/h3>\n<p>ec494785f243f5f1b516b31d8455fadafe5495e11d47a5ce2bd50b1b3791fec6<br \/>\n41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be<br \/>\n3ace400380bd1fc51e83d008dbbe9ceb70b2572da95264be09d85979a6276a37<br \/>\ncc041def6013da331f025e12f21f43677cea08073018d6be037f15a343a9cc24<br \/>\nca9639f7db6c3d1b37a004493f44aaa4e1282ea9333bc8ca5eac5d263d899e6a<br \/>\nc92740b6b90582a4bf73fef979ca047b9e6ae432e892a97f71e70b45c09e478e<br \/>\n2fe30eccd36f4346cb117af0cf626c2bca84b50c658b0c9af09110b9f86a53f4<br \/>\n2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Affected Platforms: Microsoft Windows<br \/>\nImpacted Users: Any organization<br \/>\nImpact: Attackers gain control of the infected systems or stolen data may be leveraged for follow-on attacks<br \/>\nSeverity Level: High<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10424,10378,32774],"tags":[],"class_list":["post-26146","post","type-post","status-publish","format-standard","hentry","category-fortinet","category-security","category-threats"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26146"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26146\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26146"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}