SocGhoulish
SocGhoulish is malware used for initial access activity in intrusions attributed by Varonis to affiliates of the RansomHub ransomware group. In the described incident, the infection began when a user downloaded and executed a fake browser update delivered as a malicious JavaScript file. After execution, the malware immediately performed reconnaissance, including enumeration of Active Directory users and computers, collection of local system information, and searching memory for credentials. Within minutes, the attackers established persistence via a recurring Scheduled Task and deployed second-stage malware consisting of a legitimate Python distribution placed in %LOCALAPPDATA%\ConnectedDevicesPlatform and an encrypted Python script that functioned as a SOCKS proxy, allowing the compromised host to be used as an Internet-accessible pivot into the corporate network. The Python component reportedly used a 10-layer multi-stage encryption and unpacking routine, randomized variable names, and anti-analysis checks including VM detection, debug detection, and process tracing detection. During the intrusion, the operators also modified Outlook email signatures under $env:APPDATA\Microsoft\Signatures to embed a malicious image reference, which Varonis assessed could coerce NTLM authentication on vulnerable clients for credential harvesting. Follow-on activity included searching network shares for credential material such as RDP files, OVPN files, and KeePass vaults, and attempting to decrypt stored Chrome and Edge credentials via DPAPI. The broader intrusion progressed rapidly to high privilege, with Varonis assessing likely abuse of a misconfigured Active Directory Certificate Services ESC1 path to obtain Domain Admin-level access, followed by enabling RDP on targeted administrator systems, creating scheduled tasks for credential and information gathering, and using AzCopy for data exfiltration. The observed targeting was an enterprise Windows/Active Directory environment.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Our analysis of the tactics, techniques, and procedures (TTPs) and the relevant Indicators of Compromise (IOCs) tied this intrusion to affiliates of the RansomHub group utilizing SocGhoulish malware for initial access activities.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
3 techniquesWithin minutes, second-stage malware was deployed as a recurring Scheduled Task for persistence.
The incident started when a user downloaded and subsequently executed a file that they were led to believe was a legitimate browser update. In this case, it was a malicious JavaScript payload.
The incident started when a user downloaded and subsequently executed a file that they were led to believe was a legitimate browser update. In this case, it was a malicious JavaScript payload.
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueCredential Access
1 techniqueThe download kicked off a chain of automated reconnaissance and initial command and control activity, including enumerating Active Directory users and computers, querying key local system information, hunting for credentials in memory...
Discovery
4 techniquesThe download kicked off a chain of automated reconnaissance and initial command and control activity, including enumerating Active Directory users and computers, querying key local system information, hunting for credentials in memory, and various other discovery techniques.
The above command was launched against all network shares attached to the device as part of an automatic recon stage by the malware.
The download kicked off a chain of automated reconnaissance and initial command and control activity, including enumerating Active Directory users and computers...
Command and Control
1 techniqueThe final payload was a SOCKS proxy designed to facilitate communication between attacker endpoints and internal network infrastructure using the compromised host as a transport pivot.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SocGhoulish was used for initial access after a user executed a fake browser update delivered as a malicious JavaScript payload. It initiated reconnaissance, credential hunting, persistence via Scheduled Task, and deployment of a legitimate Python distribution plus an encrypted multi-layer Python SOCKS proxy used to tunnel attacker traffic into the internal network.
SocGhoulish is a malware used for initial access, typically delivered via malicious browser update lures. It executes a JavaScript payload that initiates automated reconnaissance, command and control, and deployment of second-stage malware for persistence and network tunneling.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.