PassiveNeuron Campaign with APT Implants and Cobalt Strike

Free, Unbiased, and Open threat intelligence

PassiveNeuron Campaign with APT Implants and Cobalt Strike

threat Profile

HIGH

Description

A complex cyberespionage campaign targeting government, financial and industrial organizations in Asia, Africa, and Latin America. The campaign involves compromising Windows Server machines through SQL server exploitation, deploying custom APT implants (Neursite and NeuralExecutor) and Cobalt Strike framework. The attack uses sophisticated multi-stage DLL loading chains with MAC address-based targeting and Phantom DLL Hijacking for persistence.

MITRE ATT&CK Techniques

T1574.001 - DLL Side-Loading (Phantom DLL Hijacking) T1055 - Process Injection T1027 - Obfuscated Files or Information T1082 - System Information Discovery T1057 - Process Discovery T1090 - Proxy T1059.001 - PowerShell T1059.005 - Visual Basic T1505.003 - Web Shell T1071.001 - Web Protocols (HTTP/HTTPS) T1573 - Encrypted Channel T1102.001 - Dead Drop Resolver T1569.002 - Service Execution T1083 - File and Directory Discovery T1584.006 - Web Services (GitHub for C2)

Related Entities

Threat Actors

APT27 APT41 APT31

Malware

Neursite Cobalt Strike NeuralExecutor ShadowPad ASPX Web Shell