MiniUpdate

Their infection chains begin with targeted spear phishing lures, leveraging DLL sideloading for execution.

Both malware families begin their infection chains through spear phishing. Victims receive what appears to be a recruitment portal or a video conferencing app installer.

Initial lure: Capitalizing on the precedent of legitimate links, the attacker delivered a lookalike domain to attempt to compromise the target.

For persistence, the malware used Windows Task Scheduler, creating a daily trigger at 09:30 local time.

Arbitrary command execution: Executes shell commands via cmd.exe /c

MiniUpdate stores all API names, C2 domains and endpoints in plaintext within the .rdata section.

The threat actor employed a .NET-specific code execution technique known as AppDomainManager hijacking. This method allows the attackers to hijack the execution flow of a legitimate application by manipulating its configuration file, granting them arbitrary code execution before the host application even starts.

For persistence, the malware used Windows Task Scheduler, creating a daily trigger at 09:30 local time.

For persistence, the malware used Windows Task Scheduler, creating a daily trigger at 09:30 local time.

Dynamic code execution: Loads arbitrary DLLs directly into memory to run specific exported functions

Privilege escalation: Requests User Account Control (UAC) elevation

Across all samples, the threat actor uses junk code and padding to artificially inflate the file size, successfully bypassing endpoint detection and scanning limits.

Attackers mimicked legitimate corporate job applications by including specific job IDs... The threat actor rotated the C2 domains to impersonate a health sector entity... and a financial sector entity.

Dynamic code execution: Loads arbitrary DLLs directly into memory to run specific exported functions

Persistence: Creates a logon-triggered scheduled task named WindowsSecurityUpdate, with built-in capabilities to remove or reinstall this task.

This effectively hollows out the legitimate Microsoft process, allowing the next payload, Updater.dll, to load into an unmonitored memory space.

Sandbox evasion: It checks if the parent process is svchost.exe. Because the malware relies on a scheduled task to launch, svchost is the natural parent. If a security analyst or automated sandbox executes the file directly, this check will fail and the malware will silently terminate.

Sandbox evasion: It checks if the parent process is svchost.exe . Because the malware relies on a scheduled task to launch, svchost is the natural parent. If a security analyst or automated sandbox executes the file directly, this check will fail and the malware will silently terminate.

The threat actor employed a .NET-specific code execution technique known as AppDomainManager hijacking. This method allows the attackers to hijack the execution flow of a legitimate application by manipulating its configuration file, granting them arbitrary code execution before the host application even starts.

Digital signature misuse: This payload is digitally signed under the name of a software company whose signature appears to have been stolen or impersonated.

They also bypass strong-name signature validation, ensuring that unsigned DLL files load without triggering security exceptions.

Process manipulation: Enumerates running processes and terminates them

The analyzed payload functions as a highly versatile backdoor, granting the attacker near-complete operational control over the compromised host's file system

Sandbox evasion: It checks if the parent process is svchost.exe. Because the malware relies on a scheduled task to launch, svchost is the natural parent. If a security analyst or automated sandbox executes the file directly, this check will fail and the malware will silently terminate.

Sandbox evasion: It checks if the parent process is svchost.exe . Because the malware relies on a scheduled task to launch, svchost is the natural parent. If a security analyst or automated sandbox executes the file directly, this check will fail and the malware will silently terminate.

The threat actor routes command and control (C2) traffic through a set of three to five unique domains, mostly hosted by Azure, dedicated to each target and variant. This technique prevents cross contamination to increase operational resiliency.

Command polling occurs via GET requests to the /agent/poll endpoint... The malware beacons to the primary C2 base URL via an HTTP POST request.

Depending on the parsed response, the malware will execute chunked uploads or downloads via specific transfer URLs or create additional threads for command execution.

Data exfiltration: Uploads files to the C2 server, including support for chunked uploads

By adding a few targeted XML lines to the application’s config file, attackers instruct the .NET runtime to disable its own security features. They turn off Event Tracing for Windows (ETW), the primary data source that modern endpoint detection and response (EDR) platforms rely on to monitor .NET activity.