MiniFast

For the first time, we observed the use of SEO poisoning as an additional malware delivery method... the actor abuses search engine optimization techniques by registering dozens of domains that link to the bogus domain, getsqldeveloper[.]com.

Check Point said Nimbus Manticore has shifted tactics in its most recent attacks... using search engine optimization (SEO) poisoning to impersonate the software Oracle SQL Developer and spread MiniFast... Keyword stuffing of phrases such as “download SQL Developer” and “SQL Developer free” was also used to help the fake website surface high in search results for engines such as Bing and DuckDuckGo.

Both waves of attacks utilized career-themed phishing lures for initial access... As in previous attacks, Nimbus Manticore used career-themed phishing lures to spread MiniFast during Operation Epic Fury, specifically impersonating a U.S. domestic airline. Victims were lured to install a trojanized version of the legitimate Zoom installer after clicking a fake meeting invitation link.

It's suspected that the activity was part of a phishing campaign using fake meeting invitations.

The installer was not a crude knockoff; it demonstrated detailed knowledge of the legitimate Zoom installation process, even monitoring for the creation of a specific scheduled task that Zoom normally generates during setup, then silently hijacking that task to establish persistence without triggering obvious alarms.

It then monitors for the creation of a scheduled task — a part of the legitimate Zoom installation process — and modifies this task to load the second-stage components... Prior to executing the payload, the loader ensures that the hosting process name is update.exe and the parent process is svchost.exe to maintain stealth and persistence via the scheduled task... The backdoor supports commands for a wide range of actions including... creation of an additional scheduled task.

The backdoor supports commands for a wide range of actions including file and folder management and exfiltration, file download from the C2, shell command execution...

Recent attack chains linked to the threat actor have witnessed a shift in tradecraft, as evidenced by the use of AppDomain hijacking

Launching a benign executable within the ZIP file leveraged a technique known as AppDomain hijacking to launch a rogue MiniJunk DLL.

The installer was not a crude knockoff; it demonstrated detailed knowledge of the legitimate Zoom installation process, even monitoring for the creation of a specific scheduled task that Zoom normally generates during setup, then silently hijacking that task to establish persistence without triggering obvious alarms.

It then monitors for the creation of a scheduled task — a part of the legitimate Zoom installation process — and modifies this task to load the second-stage components... Prior to executing the payload, the loader ensures that the hosting process name is update.exe and the parent process is svchost.exe to maintain stealth and persistence via the scheduled task... The backdoor supports commands for a wide range of actions including... creation of an additional scheduled task.

The installer was not a crude knockoff; it demonstrated detailed knowledge of the legitimate Zoom installation process, even monitoring for the creation of a specific scheduled task that Zoom normally generates during setup, then silently hijacking that task to establish persistence without triggering obvious alarms.

It then monitors for the creation of a scheduled task — a part of the legitimate Zoom installation process — and modifies this task to load the second-stage components... Prior to executing the payload, the loader ensures that the hosting process name is update.exe and the parent process is svchost.exe to maintain stealth and persistence via the scheduled task... The backdoor supports commands for a wide range of actions including... creation of an additional scheduled task.

Opcode 0xB0 Request UAC Elevation pathOrCommand Attempts to relaunch a process with elevated privileges using runas.

The loader itself is lightly obfuscated. Most readable strings are decrypted at runtime using a simple combination of ROT13 encoding and reversed-string transformations.

Victims were lured to install a trojanized version of the legitimate Zoom installer... AppDomain hijacking is again used to load the second-stage loader Updater.dll via the Setup.exe binary — now renamed to Update.exe... The malware impersonates a Chrome browser user agent to blend in with legitimate traffic.

At the beginning of its execution, the loader performs a simple anti-analysis validation intended to evade sandbox environments and automated dynamic analysis systems. The malware only continues execution if: The hosting process name is update.exe The parent process is svchost.exe

Recent attack chains linked to the threat actor have witnessed a shift in tradecraft, as evidenced by the use of AppDomain hijacking

Launching a benign executable within the ZIP file leveraged a technique known as AppDomain hijacking to launch a rogue MiniJunk DLL.

Many of the files used throughout the campaign had valid digital signatures via SSL.com, continuing the abuse of trusted signing infrastructure we previously documented.

Before entering its tasking loop, the malware performs basic host reconnaissance by collecting information such as the username, hostname, and domain info.

The commands supported by the backdoor are varied, enabling file operations, directory listings, process enumeration

MiniFast performs system reconnaissance and then awaits commands from the C2 server...

The commands supported by the backdoor are varied, enabling file operations, directory listings

At the beginning of its execution, the loader performs a simple anti-analysis validation intended to evade sandbox environments and automated dynamic analysis systems. The malware only continues execution if: The hosting process name is update.exe The parent process is svchost.exe

The commands supported by the backdoor are varied, enabling ... ZIP archive creation

MiniFast, the successor of MiniJunk, enables extensive control of the victim’s machine through API-based communications with the attacker’s command-and-control (C2) server... MiniFast performs system reconnaissance and then awaits commands from the C2 server, transmitting data in the JSON format. The malware impersonates a Chrome browser user agent to blend in with legitimate traffic.

NodeRabbit... connects to infrastructure hosted on Azure... PollCat starts running and begins talking to its command server the moment the application loads.

La variante Égypte prend en charge les proxys NTLM/Negotiate via curl.exe; cette délégation proxy est aussi citée comme similarité avec Retrograde/MiniFast.

It communicates with a remote server over HTTP requests to fetch tasks, upload command execution results, exfiltrate files, and download additional payload from the server.

This wave also introduced a previously unseen backdoor that Check Point has named MiniFast... it is a fully featured remote access trojan supporting file operations, process management, privilege escalation, and DLL loading.

The backdoor supports commands for a wide range of actions including file and folder management and exfiltration, file download from the C2, shell command execution...

The commands supported by the backdoor are varied, enabling ... process termination using its PID