“Water Basilisk” Campaign Exploiting File Hosting Services to Deliver Multiple RAT Payloads

guest · Sep 21, 2021

“Water Basilisk” Campaign Exploiting File Hosting Services to Deliver Multiple RAT Payloads
September 21, 2021
https://www.technadu.com/water-basi...ervices-deliver-multiple-rat-payloads/302915/

A new campaign delivering a multitude of RATs on the victim relies on file-less techniques and online service abuse.

Named “Water Basilisk”, the campaign uses payloads that have been prepared with the HCrypt tool.

Obfuscation on every stage seems to be working well, while the choice of ISO files is likely done on the same basis.

Click to expand...

A campaign named “Water Basilisk” that peaked in activity in August 2021 has been detailed by researchers at Trend Micro, who found out that the actors behind it are very keen to abuse multiple file hosting services and a variety of “off the shelve” tools. The goal is equally quirky, as the hackers deliver an unusually large number of RATs (remote access tools) onto the target machine, including NjRat, BitRat, Nanocore RAT, QuasarRat, LimeRat, and Warzone.

The actors abused file hosting services like “archive.org”, “transfer.sh”, and “discord.com”, and they also hacked vulnerable WordPress websites where they hosted their phishing pages. The file that was stored on the services is an ISO image that was either dropped by the websites or came as an attachment on phishing emails.
Click to expand...

One of the tools that are widely used in “Water Basilisk” is HCrypt 7.8, which sells for $199 at the moment. HCrypt creates obfuscated VBScripts and PowerShell to help the payload evade detection.

For persistence, the VBS script is added onto the Startup path, so every time the infected machine boots up, the stager will download the latest payloads from the given URL.
Click to expand...

Trend Micro: Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads

In this blog entry we look into a fileless campaign that used a new HCrypt variant to distribute numerous remote access trojans (RATs) in victim systems. This new variant also uses an updated obfuscation mechanism which we detail.
Click to expand...

Log in or Sign up

“Water Basilisk” Campaign Exploiting File Hosting Services to Deliver Multiple RAT Payloads

guest Guest

Log in or Sign up

“Water Basilisk” Campaign Exploiting File Hosting Services to Deliver Multiple RAT Payloads

guest Guest

Useful Searches