12 Febuary 2025
Mimecast Threat Researchers have been monitoring and investigating an infostealer campaign targeting various organizations with focus towards Retail, Travel and hospitality industries (tracked internally as MCTO1023). The campaign sees threat actors impersonating well-known law firms contacting business with regards to a copyright infringement, to lure victims into downloading malicious files from Dropbox. The malicious files seek to deliver malware in the form of various InfoStealers.
Distributed through Mail Merge, which is a service that enables the distribution of personalized bulk email campaigns by integrating recipient-specific data into templates. Threat actors exploit free trial accounts from Mail Merge in conjunction with Gmail, to orchestrate and distribute large-scale email campaigns. By abusing legitimate platforms, they bypass certain DNS authentication, ensuring the successful delivery of their malicious campaigns.
Once the user downloads the files, the executable when run utilizes a GitHub repo belonging to LoneNone1807 which includes several malware files. The repository includes a recent campaign that begins with a highly obfuscated batch file, which, when executed, downloads and installs two types of malware: XWorm and RedLine. XWorm is a remote access trojan (RAT) that allows attackers to control infected systems, while RedLine is an information stealer designed to extract sensitive data from victims. The malware employs advanced obfuscation techniques, using highly encoded batch scripts with layers of nested commands and dynamically generating payloads to bypass traditional detection mechanisms.
Mimecast observed a steady stream of campaigns initially starting around July but picking up around August time with its biggest spike in December for this campaign.
There have been several analyses conducted on malware found on LoneNone1807 GitHub account including a recent malware campaign that begins with a highly obfuscated batch file. The full details of the malware’s capabilities can be read from SANS research.
T1566.002: Phishing - Spear phishing Link
T1102.001: Web Service - Dead Drop Resolver
T1071: Application Layer Protocol (Command and Control)
T1574.002: Hijack Execution Flow - DLL Search Order Hijacking
T1562.001: Impair Defenses - Disable or Modify Tools
T1497: Virtualization/Sandbox Evasion
T1056: Input Capture
T1010: Application Window Discovery
T1082: System Information Discovery
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
