A recent phishing campaign identified as PAPERMILL is leveraging a fraudulent tax audit notice to distribute VenomRAT through a signed version of Notepad++. This sophisticated operation utilizes email messages with disk-image attachments to disguise malicious files as legitimate.
Phishing Tactics and Techniques
The malicious emails employ tax audit-themed subjects and pass SPF, DKIM, and DMARC checks to evade detection. Upon opening the attachment, users unknowingly mount a local drive, initiating a harmful sequence without the usual security alerts associated with internet downloads.
JUMPSEC researchers uncovered this activity while investigating a client’s suspicious email, noting that PAPERMILL exhibits similarities to the Silver Fox ecosystem. However, they have not definitively linked it to any known group.
Exploitation of Trusted Applications
The attack involves directing recipients to a disk image that, once mounted, displays a signed application, a fake library, and an encrypted data file. This process removes internet-origin markers, reducing potential security warnings. The signed Notepad++ executable remains unmodified but is renamed to load the malicious library.
This DLL sideloading method allows harmful code to execute alongside trusted processes, a tactic observed in other recent campaigns. The rogue DLL reveals only the functions expected by the legitimate program, ensuring normal application operation while executing malicious activities in the background.
VenomRAT Deployment and Mitigation Strategies
After a delay and security checks, the loader seeks administrative permissions, establishes RunOnce persistence, and injects components into user-profile directories. Utilizing a Donut shellcode loader, it runs a .NET payload in memory. PAPERMILL’s method mirrors previous disk-image delivery techniques but incorporates a signed-program sideloading step.
The VenomRAT configuration identifies version 6.0.3, equipped with capabilities like hidden virtual network computing and data theft. Its servers are set up for remote commands, posing risks of account compromise and surveillance if the attachment is executed. The campaign appears to target Indian tax themes specifically.
Organizations are advised to treat unsolicited tax communications and unexpected disk-image files with caution, verifying any tax-related requests through established channels. Security teams should carefully inspect IMG and ISO files distributed via email and monitor mounted drives for unusual activity.
To counter such threats, defenders should focus on detecting signed applications loading unexpected DLLs from writable directories, unfamiliar persistence entries, and suspicious network connections. This approach complements existing security measures and helps uncover malicious behaviors that individual file hashes might miss.
Given PAPERMILL’s ability to create new containers, relying solely on hashes is insufficient for threat detection. Instead, tracking loader file relations, library naming conventions, persistence locations, and command traffic offers more robust detection and containment strategies.
