10 minhigh
Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor
The Larva-24009 threat actor (aka HeptaX) continues phishing campaigns into 2026, using LNK files disguised as documents to deliver an obfuscated PowerShell backdoor. The attack chain involves downloading additional PowerShell scripts from C2 servers, establishing persistence via scheduled tasks, installing QuasarRAT and UltraVNC for remote control, and deploying NirSoft credential theft tools and a custom keylogger. A notable evolution is the use of the Telegram API for infection status reporting in the Notifier malware v2.1.
Sens:▲ 24hConf:
Showing defanged values
- domainaonexa[.]shopPrimary C2 server domain hosting PowerShell backdoor command endpoints (get-command.php, post_proc.php, index.php, new-upload.php)
- domainfinal[.]mainsec2[.]siteDownload server hosting NirSoft credential theft tools (ChromePass.exe, LastActivityView.exe, WebBrowserBookmarksView.exe, netpass.exe)
- domainmainsec[.]siteDomain associated with Larva-24009 infrastructure
- domainpozeny[.]shopDomain associated with Larva-24009 infrastructure
- domainserverdock[.]onlineDomain associated with Larva-24009 infrastructure
- ip217[.]77[.]6[.]50IP address associated with Larva-24009 infrastructure
- md510b40185106eb3760cb71c46117aa0bfMD5 hash of malware sample associated with Larva-24009 attack
- md51500fefcdda275b70e2051a3e7d9f794MD5 hash of malware sample associated with Larva-24009 attack
- md52973fda8d0d0fa0200a05889fce85df6MD5 hash of malware sample associated with Larva-24009 attack
- md5444fb3592cd1848660259a913684795bMD5 hash of malware sample associated with Larva-24009 attack
- md54ad28d0313549e98383144d82982be6eMD5 hash of malware sample associated with Larva-24009 attack
- urlhxxp://aonexa[.]shop/candy/res/get-command[.]phpC2 endpoint for downloading additional payloads onto infected systems
- urlhxxp://final[.]mainsec2[.]site/secsec/tool/ChromePass[.]exeDownload URL for ChromePassView credential theft tool
- urlhxxp://final[.]mainsec2[.]site/secsec/tool/LastActivityView[.]exeDownload URL for LastActivityView NirSoft tool used for user activity collection
- urlhxxp://final[.]mainsec2[.]site/secsec/tool/netpass[.]exeDownload URL for Network Password Recovery tool used to steal network passwords
- urlhxxp://final[.]mainsec2[.]site/secsec/tool/WebBrowserBookmarksView[.]exeDownload URL for WebBrowserBookmarksView tool used to extract browser bookmarks
Detection / Hunteropenrouter
What Happened
A hacking group called Larva-24009 has been sending phishing emails disguised as legitimate documents (like resumes, surveys, and project proposals) to trick people into opening them. When opened, these files secretly run malicious code that downloads more harmful software from the attacker's servers. The attackers then install remote control tools that let them see and control the victim's computer screen, record keystrokes, and steal saved passwords from web browsers. They also create a hidden backdoor account on the system to maintain access. Organizations and individuals, particularly in Korea but also globally, are at risk. People should be very cautious about opening email attachments, even if they appear to be documents, and ensure their antivirus software is up to date.
Key Takeaways
- Larva-24009 (aka HeptaX) continues phishing campaigns in 2026 using LNK malware disguised as document files with themes like hospital surveys, blockchain, project proposals, and resumes
- Attack chain uses obfuscated PowerShell via LNK to download additional scripts from C2, maintain persistence via scheduled tasks, and install remote control tools (QuasarRAT, UltraVNC)
- Notifier malware version 2.1 now abuses the Telegram API to send infection status reports to the threat actor, a shift from previous C2-only reporting
- Threat actor creates a backdoor local account named 'BootUEFI' via batch script for potential RDP access
- NirSoft tools (ChromePassView, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) are used for credential theft and information gathering alongside custom keylogger malware
Affected Systems
- Windows systems (general)
- Enterprise users in Korea and globally
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email delivers LNK malware disguised as document files (e.g., resumes, surveys, project proposals)
- Execution: LNK file executes obfuscated PowerShell that creates a decoy document in %TEMP% and downloads additional PowerShell scripts from C2
- Persistence: PowerShell scripts register scheduled tasks with disguised names (e.g., GoogleUpdate, Intel Ethernet) and create a backdoor account named BootUEFI
- C2 Communication: Notifier malware v2.1 uses Telegram API to report infection status; C2 endpoints on aonexa.shop handle command dispatch and screenshot uploads
- Remote Control: QuasarRAT and UltraVNC Server installed for system control; UltraVNC opens ports 5800/5900 for remote screen access
- Collection: NirSoft tools (ChromePassView, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) and custom keylogger deployed to steal credentials and user data
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any detection rules, queries, or signatures. It is an analytical report with IOCs and TTP descriptions only.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR should detect PowerShell execution from LNK files, scheduled task creation with suspicious names, and NirSoft tool execution. However, the use of legitimate tools like UltraVNC and NirSoft utilities may blend in with normal admin activity. |
| Network Visibility | Medium | C2 communication occurs over HTTP to specific domains. Telegram API usage for C2 reporting may appear as legitimate Telegram traffic. UltraVNC on ports 5800/5900 is detectable but could be mistaken for legitimate VNC usage. |
| Detection Difficulty | Moderate | The attack uses a mix of custom malware and legitimate tools. LNK-to-PowerShell execution and suspicious scheduled task names are relatively easy to detect. However, the abuse of NirSoft tools and UltraVNC as legitimate software requires behavioral context to distinguish from admin activity. |
Required Log Sources
- Windows Event Logs (Security, System, Application)
- PowerShell Script Block Logging (Event ID 4104)
- Process Creation logs (Event ID 4688)
- Scheduled Task creation logs
- DNS resolution logs
- HTTP proxy logs
- EDR telemetry
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for LNK files executing PowerShell with obfuscated or encoded commands, particularly when the LNK filename contains document-like extensions such as .Docx.Lnk | Process creation events showing PowerShell spawned by explorer.exe or wscript.exe after LNK execution; EDR process ancestry chains | Execution | Low — LNK files triggering obfuscated PowerShell is uncommon in normal enterprise environments |
| Consider hunting for scheduled task creation with names mimicking legitimate software updates (e.g., GoogleUpdate) but containing unusual GUID-like suffixes or non-standard naming patterns | Windows Task Scheduler operational logs (Event ID 106), EDR scheduled task creation events | Persistence | Medium — legitimate Google Update tasks exist; compare against known-good task names and signing context |
| Consider hunting for local account creation with unusual names such as BootUEFI or accounts created outside of standard IT provisioning workflows | Windows Security Event ID 4720 (user account creation), EDR account creation alerts | Persistence | Low — backdoor account names with underscore prefixes are atypical for enterprise provisioning |
| Consider hunting for processes making HTTP requests to domains with .shop or .site TLDs that are not known business-related, especially when combined with PowerShell or script execution | DNS logs, HTTP proxy logs, EDR network connection events | Command and Control | Medium — some legitimate services use .shop or .site domains; correlate with process context |
| Consider hunting for NirSoft tools (ChromePassView, Network Password Recovery, LastActivityView, WebBrowserBookmarksView) executing from non-standard directories or temp paths | Process creation logs, EDR process execution events with file path and hash correlation | Collection | Medium — NirSoft tools may be used by legitimate IT administrators; correlate with user context and execution path |
Control Gaps
- Standard AV may not flag legitimate tools like UltraVNC and NirSoft utilities when used out of context
- Telegram API traffic for C2 reporting may bypass network filtering if Telegram is not blocked or monitored
- LNK files disguised with double extensions (.Docx.Lnk) may bypass email gateway filtering that focuses on traditional macro-enabled documents
- RDP access via backdoor account may not trigger alerts if RDP is permitted in the environment
Key Behavioral Indicators
- PowerShell process spawned from LNK file execution with obfuscated command line arguments
- Scheduled task names containing 'GoogleUpdateTaskMachineCoreUA' followed by numeric suffix and GUID-like strings
- Scheduled task name 'Intel(R) Ethernet3 Connection 1219-LM' registered as a task rather than appearing as a driver/device name
- Local user account named 'BootUEFI' created via net.exe or batch script
- UltraVNC Server listening on ports 5800 or 5900 on systems where VNC is not an approved tool
- NirSoft credential recovery tools executing from %TEMP% or non-standard download paths
- Keylogger writing to %ALLUSERSPROFILE%\Microsoft\OneDrive\log.Log or logv.Log
- HTTP requests to C2 paths matching /Res/get-command.php, /Res/post_proc.php, /Res/index.php, /Res/new-upload.php
False Positive Assessment
Medium — The attack leverages legitimate tools (UltraVNC, NirSoft utilities, PowerShell, scheduled tasks) that may be used by IT administrators. Detection should focus on behavioral context such as execution paths, process ancestry, and unusual account creation rather than tool names alone.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 domains (aonexa.shop, final.mainsec2.site, mainsec.site, pozeny.shop, serverdock.online) and IP (217.77.6.50) at your firewall, proxy, and DNS filtering layers.
- Consider searching endpoint telemetry for the listed MD5 hashes and LNK filenames to identify potentially compromised hosts.
- If your EDR supports host isolation, consider isolating any confirmed infected systems to prevent lateral movement via RDP or UltraVNC.
- Consider auditing local user accounts for the presence of 'BootUEFI' or similarly suspicious accounts and removing them if found.
Infrastructure Hardening
- Evaluate whether your email gateway can detect and block LNK files with double extensions (e.g., .Docx.Lnk) in attachments.
- Consider restricting outbound Telegram API traffic if Telegram is not a business requirement, as it is being abused for C2 communication.
- If applicable to your environment, consider blocking or alerting on UltraVNC traffic on ports 5800 and 5900 where VNC is not an approved remote support tool.
- Consider implementing network segmentation to limit RDP access to jump boxes or specific management subnets.
User Protection
- Consider ensuring all endpoints have updated antivirus definitions (the article references AhnLab V3 specifically).
- Evaluate whether your EDR can detect PowerShell execution originating from LNK files and alert on this behavior.
- Consider deploying application control to restrict execution of NirSoft tools and UltraVNC from non-standard paths.
Security Awareness
- Consider reinforcing phishing awareness training with examples of LNK files disguised as documents, emphasizing that file extensions matter.
- Consider reminding users to verify unexpected email attachments, particularly those related to surveys, resumes, project proposals, and blockchain topics.
- Where supported by your awareness program, consider educating users on the risks of opening attachments with unusual double extensions.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Domains:
mainsec[.]site- Domain associated with Larva-24009 infrastructurepozeny[.]shop- Domain associated with Larva-24009 infrastructureserverdock[.]online- Domain associated with Larva-24009 infrastructure
- Urls:
hxxp://final[.]mainsec2[.]site/secsec/tool/LastActivityView.exe- Download URL for LastActivityView NirSoft tool used for user activity collectionhxxp://final[.]mainsec2[.]site/secsec/tool/WebBrowserBookmarksView.exe- Download URL for WebBrowserBookmarksView tool used to extract browser bookmarkshxxp://final[.]mainsec2[.]site/secsec/tool/netpass.exe- Download URL for Network Password Recovery tool used to steal network passwords
- File Paths:
%ALLUSERSPROFILE%\Microsoft\OneDrive\log.Log- Keylogger data storage path used by custom keylogger malware%ALLUSERSPROFILE%\Microsoft\OneDrive\logv.Log- Secondary keylogger data storage path used by custom keylogger malware
- Command Lines:
- Purpose: Register scheduled tasks for persistence using disguised task names mimicking legitimate software | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /tn <taskname> /tr - Purpose: Create a backdoor local account named BootUEFI for RDP access | Tools:
net.exe,batch script| Stage: Persistence |net user <username> <password> /add
- Purpose: Register scheduled tasks for persistence using disguised task names mimicking legitimate software | Tools:
- Other:
Intel(R) Ethernet3 Connection 1219-LM- Scheduled task name used for persistence, disguised as a network adapter componentGoogleUpdateTaskMachineCoreUA2{F84AE75F-E9CE-4FC0-9BC8-998371F0931}- Scheduled task name used for persistence, disguised as a Google Update taskGoogleUpdateTaskMachineCoreUA6{F84AE75F-E9CE-4FC0-9BC8-998371F0931}- Scheduled task name used for persistence, disguised as a Google Update task_BootUEFI_- Backdoor local account name created via batch script for RDP accessNovaCX_Agency_Updated_2026047_091100_version_1_8.Docx.Lnk- LNK malware filename disguised as a document, used in phishing emailsNovaCX_Agency_Updated_2026047_091100_version_3_2.Docx.Lnk- LNK malware filename disguised as a document, used in phishing emailsNovaCX_Interview_QA+Updated_20260420_162448_version_4_4.Docx.Lnk- LNK malware filename disguised as a document, used in phishing emails