REF7707 targeted a South American foreign ministry using novel malware families. Inconsistent evasion tactics and operational security missteps exposed additional adversary-owned infrastructure.

REF7707 summarized

Key takeaways

Campaign Overview 

Campaign layout (the diamond model)

Execution Flow

Primary execution chain

WinrsHost.exe

FontDrvHost.exe

Connectivity checks

Reconnaissance / enumeration / credential harvesting

Persistence

FINALDRAFT Analysis

PATHLOADER and GUIDLOADER

FINALDRAFT bridging OS’

Infrastructure Analysis

Service banner hashes

Hobiter and VMphere

ICTNSC

Autodiscovar

D-links and VM-clouds

Fortineat

Checkponit

Third-party infrastructure

REF7707 timeline

Conclusion

REF7707 through MITRE ATT&CK

Detecting REF7707

YARA

Observations

References

About Elastic Security Labs

From South America to Southeast Asia: The Fragile Web of REF7707

Elastic Security Labs observed new PIKABOT campaigns, including an updated version. PIKABOT is a widely deployed loader malicious actors utilize to distribute additional payloads.

PIKABOT at a glance

PIKABOT campaign overview

PIKABOT loader

Loader stage 1

Loader stage 2

Anti-debugging

Execution

PIKABOT core

Obfuscation 

String Decryption

Initial Collection

Config

Network

Bot Functionality

Malware and MITRE ATT&CK

Tactics

Techniques

Detecting malware

Prevention

Appendix

PIKABOT, I choose you!

Explore JOKERSPY, a recently discovered campaign that targets financial institutions with Python backdoors. This article covers reconnaissance, attack patterns, and methods of identifying JOKERSPY in your network.

Preamble

Overview

Analysis

The xcc binary

XCode artifacts

Abusing TCC

Initial access

Deployed cryptographic libraries

The sh.py backdoor

Swiftbelt

Diamond Model

Observed tactics and techniques

MITRE ATT&CK Tactics

MITRE ATT&CK Techniques / Sub techniques

Detection logic

An overview of JOKERSPY, discovered in June 2023, which deployed custom and open source macOS tools to exploit a cryptocurrency exchange located in Japan.

Initial research exposing JOKERSPY

Elastic Security Labs has discovered the P8LOADER, POWERSEAL, and SPECTRALVIPER malware families targeting a national Vietnamese agribusiness. REF2754 shares malware and motivational elements of the REF4322 and APT32 activity groups.

Execution flow

SPECTRALVIPER code analysis

Launch

Pipe mode

HTTP mode

Commands

Defense evasion

Code obfuscation

String obfuscation

Summary

P8LOADER

Discovery

POWERSEAL code analysis

Launch PowerShell

Campaign and adversary modeling

Victimology

Campaign analysis

Campaign associations

Diamond model

Observed adversary tactics and techniques

Techniques / Sub techniques

Preventions

Elastic Security Labs has discovered the SPECTRALVIPER malware targeting a national Vietnamese agribusiness.

Elastic charms SPECTRALVIPER

Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

What is the threat?

What is the impact?

What is Elastic doing about it?

Investigation Details

Adversary Assessment Justification

YARA Rules

Defensive Recommendations

Observables

Artifacts

PHOREAL Malware Targets the Southeast Asian Financial Sector

The Elastic Security Labs team has been tracking REF2731, an 5-stage intrusion set involving the PARALLAX loader and the NETWIRE RAT.

Key Takeaways

Execution Flow (PARALLAX loader)

First Stage (lure/macro)

Second Stage (MsiDb.exe)

Third Stage (shellcode)

Fourth Stage

Fifth Stage

Campaign Analysis

Campaign 1

Lure Documents

Macro

Network Infrastructure

Campaign 1 Indicators

Campaign 2

Campaign 2 Indicators

Campaign Intersections

The Pyramid of Pain

The SEPTTON Domain

marketforce666

gaza666

Observed Adversary Tactics and Techniques

Detection

Detection Logic

PARALLAX Payload Extractor

Indicators

REF2731 intrusion set, campaigns, and malware observations

Exploring the REF2731 Intrusion Set

Elastic Security verifies new destructive malware targeting Ukraine: Operation Bleeding Bear

Stage 1: WhisperGate MBR payload

Malware analysis breakdown (Stages 1-4)

Stage 2/3: Discord downloader and injector

Final stage: File corruptor

MBR protection with Elastic Security

Observing WhisperGate in Elastic Security

Alert breakdown and defensive recommendations

Endpoint Security Integration Alerts

Stage 1 - MBR Wiper

Stage 2 - Downloader

Stage 3 + Stage 4 - Injector/File Corruptor

Prebuilt Detection Engine Alerts

Hunting queries

MITRE ATT&CK

Operation Bleeding Bear

Elastic Security observed a ransomware and extortion campaign leveraging a combination of offensive security tools, LOLBAS, and exploits to deliver the CUBA ransomware malware.

Initial Access

Access Broker

Remotely Exploitable Vulnerability

Establish Foothold

afk.ttf

add2.exe

Remote Access Tools

SystemBC

GoToAssist

NetSupport

Cobalt Strike

BUGHATCH

Credential Harvesting, Internal Reconnaissance, and Lateral Movement

Meterpreter

Mimikatz

Zerologon Exploit

PsExec

Using LOLBAS

Data Exfiltration

Defense Evasion and Actions on the Objective

DefenderControl.exe

CUBA Ransomware

Techniques / Sub Techniques

CUBA Ransomware Campaign Analysis

Our Elastic Security research team has focused on advanced techniques used in a Malaysian-focused APT campaign. Learn who’s behind it, how the attack works, observed MITRE attack® techniques, and indicators of compromise.

Anatomy of the attack

Embedded DLLs

DLL side-loading a backdoor

Second stage backdoor

Possible APT40/Leviathan connection

MITRE ATT&CK® techniques

Indicators of Compromise (IOCs)

File names and paths

Registry keys

URLs

HTTPS certificate

Hashes

A close look at the advanced techniques used in a Malaysian-focused APT campaign

トピック

キャンペーン

13 2月2025日

南アメリカから東南アジアへ:REF7707の脆弱な網

PIKABOT、君に決めた！

初期研究がJOKERSPYを暴露する

SPECTRALVIPERを誘うElastic

PHOREALマルウェアの標的は東南アジアの金融セクター

REF2731 侵入セットの調査

ブリーディング・ベア作戦

CUBAランサムウェアキャンペーンの分析

マレーシアに焦点を当てたAPTキャンペーンで使用されている高度な手法を詳しく見る

FORMBOOKはCABレスアプローチを採用

ランサムウェアの中断:Sodinokibiとサプライチェーン