Threat Actors Leverage Cascading Shadows Attack Chain to Evade Detection and Hinder Analysis

A sophisticated multi-layered phishing campaign was uncovered, employing a complex attack chain known as “Cascading Shadows” to deliver various malware, including Agent Tesla, XLoader, and Remcos RAT.

The attackers’ strategy hinges on using multiple, seemingly simple but strategically layered stages, which not only evade traditional sandbox environments but also complicates analysis by cybersecurity experts.

The Deceptive Prelude

The campaign begins with phishing emails disguised as official communications, typically claiming a new payment has been made.

These emails contain a compressed file named “doc00290320092.7z”, directing the victim to review an ‘order file’.

Once opened, the .7z file reveals a JavaScript encoded (.jse) file. This initial file acts as a downloader, fetching a PowerShell script from a remote server, initiating the infection chain.

Unraveling the Layers

The PowerShell script, devoid of heavy obfuscation, hosts a Base64-encoded payload which is decoded, saved to disk, and executed.

Interestingly, subsequent analysis has revealed that the payload varies, choosing between either a .NET or an AutoIt compiled executable.

According to the Report, this bifurcation in the attack chain allows the malware to adapt, choosing between paths to increase infection success.

The .NET executable decrypts the payload, either with AES or Triple DES, before injecting it into a running RegAsm.exe process.

Similarities found in multiple .NET samples from this campaign indicate a deliberate design to inject different malware families, like Agent Tesla or XLoader, into running processes, leveraging the same underlying infection method.

On the other alternative path, AutoIt executables introduce an additional layer of complexity.

They contain encrypted payloads that load shellcode, which, once decrypted, injects the final malware into a RegSvcs process.

This AutoIt script’s role also includes running malicious code through DLLCALLADDRESS references, posing challenges for analysis.

Despite the attackers’ intricate strategies, security solutions like Advanced WildFire can detect each stage of the Cascading Shadows attack chain.

Palo Alto Networks’ Advanced URL Filtering, Advanced DNS Security, and Cortex XDR with XSIAM provide layered defenses against these threats.

For organizations potentially compromised, immediate contact with Unit 42 Incident Response is recommended.

This attack chain highlights a continuing trend in cyber threats, where attackers rely on complexity and variety rather than sophisticated obfuscation to evade detection.

The analyzed techniques offer crucial insights for enhancing threat hunting capabilities, particularly in dealing with AutoIt-based malware and debugging shellcode.

This analysis underscores the perpetual cat-and-mouse game between cyber defenders and attackers, showcasing the need for constant vigilance and advanced detection capabilities.

Indicators of Compromise

AutoIt Infection Chain 1

AutoIt Infection Chain 2

Agent Tesla (Variant) Configuration

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!