PAPERMILL is the latest campaign from the Silver Fox threat group, deploying VenomRAT via spear-phishing with tax-themed lures. This is a classic, low-and-slow intrusion playbook targeting UK and EU organisations.
Technical Breakdown: – Initial Access: Spear-phishing emails with malicious Excel attachments (XLS) or links. The lures exploit tax season anxiety (HMRC, payroll deadlines). – Dropper: The Excel file uses obfuscated VBA macros to download the next stage. – Payload: VenomRAT (a .NET-based RAT). It establishes persistence via scheduled tasks and registry run keys. – C2: Uses HTTP/S communication with dynamic DNS domains. Observed C2 infrastructure often mimics legitimate financial services URLs. – Post-Exploitation: Standard RAT capabilities: keylogging, screen capture, file exfiltration, and the ability to drop additional payloads (e.g., Cobalt Strike). – Targets: Primarily finance, legal, and insurance sectors.
Defense: – Block macros from untrusted sources via GPO or ASR rules. – Deploy YARA rules for VenomRAT indicators (specific .NET assembly GUIDs and mutex names). – Monitor for rundll32.exe or regsvr32.exe executing from %APPDATA% or %TEMP% — a common Silver Fox staging technique.
Source: https://www.jumpsec.com/guides/emerging-silver-fox-papermill-death-taxes-and-venomrat/
Source: r/SecOpsDaily · by /u/falconupkid