AI tools as campaign infrastructure

Mimecast Threat Research has observed threat actors distributing malicious PDF files masquerading as HTML email attachments. Multiple campaigns were observed using the same PDF attachment masquerading as an HTML file named “Contract_document.html” 18th and 27th March 2024.

The attachments have a .html attachment, but have a PDF MIME type which if opened in a modern web browser will still be rendered as a PDF. The attachments observed were sent via multiple malspam campaigns with similar themes targeting numerous organisations and contained malicious URLs. The total volume observed reached just under 380,000 emails across 18th, 20th, and 27th March.

Each campaign generally attempted to impersonate internal HR teams distributing updates on employee performance appraisals, annual leave policies or mandatory training. In some cases, with expressions of urgency or expenses paid trips abroad. A similar theme was observed as each contained specific elements relating to the targeted recipients including the organisations name and recipients email address.

The first example uses the lure of staff appraisals and is encouraging recipients to click to view who has received an award.

 
In the second example, an annual leave policy was used as a theme and threatens the recipient with financial penalties if they fail to comply with the request.

 
The third example uses staff allocated training as a theme with the additional lure of expenses paid travel abroad.

 
These campaigns all followed similar themes that are common across most industry targeted phishing campaigns. Using a combination of the fear and curiosity to encourage recipients to click the links. Each campaign displayed a false link pretending to be to an internal destination, however hovering over the link in example 3 we can see the actual URL redirects to a “replit.app” host.

Replit is another tool that threat actors have been abusing to stage resources and redirect victims through. The chart below displays the number of malicious emails detected containing a Replit URL like the examples shown above.

 
Attack pattern

Summary of methodologies used by the threat actor for this attack:

Targets

Global, all industries

IOCs

TTPs

T1608.005 - Stage Capabilities: Link Target
T1586.002 - Compromise Accounts: Email Accounts
T1566.002 - Phishing: Spearphishing Link
T1566.001 - Phishing: Spearphishing Attachment
T1036.008 - Masquerading: Masquerade File Type