Phantomdl

PhantomDL is a malicious software (malware) associated with the cybercriminal group known as Head Mare, which has been linked to targeted attacks on Russian organizations. This custom-made malware, along with PhantomCore, exploits a relatively new vulnerability, CVE-2023-38831, in phishing campaigns to infiltrate victims' infrastructure. The malware samples are disguised as business documents with double extensions, making them harder to detect. They establish communication with one of the attackers' command servers post-execution and attempt domain identification. Notably, all found samples of PhantomDL and PhantomCore were obfuscated, possibly using a popular obfuscator for Go called Garble. During our investigation, we discovered several PhantomDL and PhantomCore samples. However, it's uncertain if these belong to the same activity cluster as those used in Head Mare’s attacks. Our research also revealed that PhantomDL communicates with its Command and Control (C2) server through port 80 and performs domain identification using specific commands. In some instances, the PhantomDL sample was seen connecting to the C2 server 91.219.151[.]47. Our products have successfully detected PhantomDL samples, recognizing the malware as an exploit for CVE-2023-38831 among other things. Despite the sophistication of the malware and the tactics employed by the attackers, ongoing research and development efforts continue to improve detection rates and mitigate the impact of such threats. It is crucial for organizations to stay vigilant, regularly update their security measures, and educate employees about the risks of suspicious downloads and emails to prevent such attacks.