Phishing-Delivered Remote Access Trojans and Backdoors Using Living-off-the-Land Execution

Multiple reporting described phishing-led intrusions that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters APT36/Transparent Tribe and SideCopy, using malicious attachments/links to deliver Windows and Linux payloads including Geta RAT, Ares RAT, and DeskRAT. One documented Windows chain used a malicious LNK that invoked mshta.exe to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms.

Separately, a newly reported CrashFix campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary Python implant plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and Active Directory targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new XWorm variant via a malicious Excel attachment exploiting CVE-2018-0802 to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into Msbuild.exe, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.