Phantomcore

PhantomCore is a sophisticated malware, which is part of a suite of custom-made malicious software that includes PhantomDL. This malware has been used in targeted phishing campaigns to infiltrate victim infrastructure by exploiting a relatively new vulnerability, CVE-2023-38831. Once executed, the malware establishes a connection with a Command and Control (C2) server, as evidenced by sample detonations in the Kaspersky Sandbox. These connections were observed to IP 5.252.178[.]92 among others. The attackers have shown advanced obfuscation techniques, possibly using a popular Go obfuscator named Garble, making detection and mitigation more challenging. The malware has been used to deliver multiple payloads, including the Havoc and Brute Ratel post-exploitation frameworks and a new variant of the PhantomCore remote access trojan (RAT). Moreover, the attackers cleverly disguised their malware, naming the samples to resemble business documents and using double extensions to further trick victims into executing them. One notable feature of PhantomCore is its ability to create a scheduled task named MicrosoftUpdateCore, which launches the malicious $appdata\Microsoft\Windows\srvhost.exe each time the user logs in, ensuring persistence on the infected system. However, there remains some uncertainty regarding the full extent of PhantomCore and PhantomDL's activities. Despite finding several samples of these malwares, it is unclear if they all belong to the same activity cluster as those used in Head Mare’s attacks. This suggests the possible existence of other threat actors or campaigns utilizing similar tools, thereby underscoring the need for continued vigilance and robust cybersecurity measures.