Microsoft Defender Experts identified two prevalent ClickFix-based intrusion chains delivering ACR Stealer, a MaaS information stealer rebranded from Amatera Stealer. Campaign 1 leverages rundll32-driven WebDAV DLL loading, obfuscated PowerShell, Python loaders, scheduled-task persistence, and Fiber-API in-memory shellcode execution, with a subset using blockchain RPC endpoints (EtherHiding) as dead-drop C2 resolvers. Campaign 2 achieves near-fully fileless execution via MSHTA/COM-launched PowerShell that retrieves a payload hidden in JPEG steganography and executes it reflectively in memory, with both chains ultimately harvesting browser credentials, DPAPI secrets, and sensitive documents for exfiltration.
Dead Drop Resolver
9 posts
ACR Stealer: Two observed intrusion chains amid increased threat activity Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories Operation Muck and Load is a supply chain attack campaign centered on a malicious Go module that impersonates a DNS scanner tool to deliver a multi-stage Windows malware loader. The campaign leverages 222 GitHub lure repositories across 190 accounts with automated commit-farming workflows to create false credibility, and uses public dead-drop resolvers across multiple platforms for resilient payload-location resolution. The final payload chain delivers AsyncRAT, Quasar, Remcos, Vidar infostealer, and cryptominers through password-protected 7z archives extracted into masqueraded Microsoft-themed directories.
Vidar Infostealer Being Spread through Phishing Emails Vidar, a C++-based MaaS infostealer active since 2018, is being distributed via phishing emails disguised as resumes and copyright infringement notices targeting Korean users. The malware uses a Go-based packer to evade detection and employs a Dead Drop Resolver technique via Telegram and Steam profile pages to retrieve C&C server addresses. Once executed, Vidar exfiltrates browser credentials, cryptocurrency wallets, Discord/Telegram/Steam data, Azure tokens, FTP credentials, and screenshots, with anti-debugging and anti-VM techniques to hinder analysis.
FSB’s matryoshka #3/3 – Gamaredon’s gifts that keeps unpacking – GammaSteel Gamaredon, an FSB-linked threat actor, has deployed a highly evasive, fileless stealer dubbed GammaSteel targeting Ukrainian entities. The malware leverages Windows DPAPI to encrypt and stage payloads within the registry, actively monitoring local, network, and USB drives for sensitive documents to exfiltrate via legitimate cloud services and dynamic C2 infrastructure.
FSB’s matryoshka #2/3 – Gamaredon’s gifts that keeps unpacking – GammaLoad Gamaredon, a Russia-nexus threat actor, utilizes a multi-stage VBScript loader framework named GammaLoad to establish persistent access and deploy subsequent payloads like GammaSteel. The infection chain leverages Dead Drop Resolvers on legitimate platforms, stores C2 configurations in the Windows Registry, and uses Alternate Data Streams (ADS) combined with Scheduled Tasks for stealthy execution.
FSB’s matryoshka #1/3 – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm Gamaredon (FSB) is conducting an ongoing cyberespionage campaign against Ukrainian targets using a modular, fileless infection chain. The attack leverages HTML smuggling and archive path traversal (CVE-2025-8088) for initial access, followed by the deployment of GammaWorm, which utilizes NTFS Alternate Data Streams (ADS) and Dead Drop Resolvers (DDRs) on legitimate platforms for persistence, propagation, and C2 communication.
Kamasers Analysis: A Multi-Vector DDoS Botnet Targeting Organizations Worldwide Kamasers is a sophisticated, multi-vector DDoS botnet and loader that leverages resilient Dead Drop Resolver (DDR) mechanisms via legitimate public services to maintain command-and-control communication. It poses significant enterprise risk by turning infected hosts into attack infrastructure and facilitating follow-on payload delivery, including potential ransomware deployment.
GlassWorm Sleeper Extensions Activate on Open VSX, Shift to GitHub-Hosted VSIX Malware The GlassWorm malware campaign has evolved to deploy 'sleeper' extensions on Open VSX that are subsequently weaponized to download malicious VSIX payloads hosted on GitHub. The malware employs sophisticated evasion techniques, including Russian geofencing, source-to-compiled code mismatches, and utilizing the Solana blockchain as a dead-drop resolver for command and control, ultimately leading to arbitrary Node.js code execution across multiple developer IDEs.
Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia A suspected China-nexus threat actor tracked as CL-STA-1087 has been conducting a persistent espionage campaign against Southeast Asian military targets since 2020. The attackers utilize custom malware, including the AppleChris and MemFun backdoors, leveraging Dead Drop Resolvers (DDR) like Pastebin and Dropbox for C2 resolution alongside advanced evasion techniques like process hollowing and DLL hijacking.
