Multi-Stage Phishing Campaign Targets Russian Users with Amnesia RAT and Ransomware

This phishing campaign primarily targets users in Russia, employing a sophisticated multi-stage approach that utilizes social engineering to deliver ransomware and the Amnesia RAT. The attack was detailed by Fortinet’s Cara Lin, highlighting how attackers use seemingly benign business documents to lure victims into executing malicious scripts. The campaign is notable for its use of multiple cloud services, with GitHub hosting scripts and Dropbox serving binary payloads, complicating takedown efforts.

A key feature of this campaign is the operational abuse of a tool named defendnot, which disables Microsoft Defender, allowing the malware to operate without detection. This tool was released last year by a security researcher and is designed to trick Windows into believing another antivirus is installed, effectively neutralizing Defender’s protective measures.

The attack begins with compressed archives containing decoy documents and a malicious Windows shortcut with Russian-language filenames. When executed, the shortcut runs a PowerShell command that retrieves further instructions from a GitHub repository. This initial loader suppresses visible execution and creates a decoy document to distract the user while malicious activities occur in the background.

Once the decoy document is opened, the script communicates with the attacker via the Telegram Bot API, confirming successful execution. The campaign’s final stages involve deploying the Amnesia RAT, which can steal sensitive information from various applications and devices, and a ransomware variant that encrypts files and monitors clipboard contents for cryptocurrency transactions.

Implications for Users and Organizations

This multi-stage phishing campaign illustrates the evolving tactics of cybercriminals, who are increasingly using legitimate tools and services to bypass security measures. Users and organizations must remain vigilant against such threats, particularly those that exploit social engineering tactics.

It is crucial for users to verify the authenticity of documents and links before opening them, especially if they appear to be from unknown sources. Organizations should enhance their security protocols, including employee training on recognizing phishing attempts and implementing robust endpoint protection measures.

Monitoring for unusual activity, such as unexpected changes in security settings or unauthorized access attempts, can help detect potential compromises early. Additionally, enabling features like Tamper Protection in Microsoft Defender can provide an extra layer of security against tools like defendnot.