From a VHDX File to Remcos RAT: Exploring Recent Phishing Techniques

In a recent campaign analyzed by threat intelligence researchers, attackers leveraged a unique delivery method using a Virtual Hard Disk (VHDX) file to deploy the Remcos RAT on target systems. This campaign demonstrates an innovative use of the automatic mounting capabilities of VHDX files in modern Windows operating systems, circumventing traditional email security measures by embedding a malicious JavaScript payload within a ZIP archive containing the VHDX file. The campaign primarily targeted sectors with advanced cyber defenses, illustrating the persistent evolution of phishing tactics aimed at exploiting emerging technological functionalities.

Initial observations indicate that this campaign specifically targeted users of updated Windows machines, taking advantage of their systems’ default settings to execute the attack. While the precise attribution of the campaign remains unclear, the sophistication level suggests a well-resourced threat actor with operational knowledge of both common security postures and the nuances of Windows OS functionalities.

How It Was Built

At the heart of this phishing campaign was the engineering of the lure and the intelligent use of file formats to bypass initial detection and execute the payload. The attack involved sending a phishing email that contained a ZIP file attachment. Within this ZIP file was a VHDX file, which modern Windows systems automatically mount when opened—a significant vector previously overlooked in typical security setups.

The email subject line typically read something like “Invoice #10293 Due Payment”. The sender’s address often spoofed well-known suppliers’ email formats to increase authenticity, such as

billing@globalinvoicing.com

. Once the enclosed VHDX file is automatically mounted, it executed a script that launched a JavaScript payload. The JavaScript file was designed to establish a connection to the attacker’s command and control (C2) server, subsequently downloading and executing the Remcos RAT onto the compromised machine.


Subject: Invoice #10293 Due Payment

From: billing@globalinvoicing.com

Attachment: invoice_draft.zip



Dear [Recipient Name],



Please find attached the draft for invoice #10293. Kindly review and complete the payment by the due date to avoid penalties.



Best regards,

The Billing Team

The C2 infrastructure was masked behind several layers of redirection, utilizing compromised domain hosting services to impede traceability. The campaign also employed SSL certificates obtained through Let’s Encrypt to provide HTTPS assurance, which helped to build trust and evaded some heuristic security detections that might flag non-encrypted communications.

Why It Worked

The most critical factor in the success of this campaign was its exploit of Windows’ automatic mounting feature. Because VHDX files are not traditionally scrutinized by email security solutions, they presented a viable workaround for conventional executable filtering, allowing the malicious payload to execute with minimal intervention from the user.

Additionally, the realistic spoofing of the sender identity exploited inherent trust relationships. By mimicking familiar business partners with high email volumes, the attackers increased their chances of the malicious email being opened and executed without suspicion. This authenticity was compounded by the strategic use of SSL encryption on the C2 server, effectively disguising malicious communications as legitimate traffic and evading traditional & heuristics-based detections.

Finally, by embedding a JavaScript payload within a VHDX file, the attackers creatively used file association and execution defaults, effectively masking the attack’s nature until execution was underway, by which point—control had shifted.

Operator Takeaways

For red team operators aiming to replicate or learn from this campaign, key aspects include the application of unconventional file formats and leveraging trusted communication channels. Emulate the folding of the payload into non-suspected file types like VHDX to study detection bypass capabilities within client environments. Further adaptation could involve fine-tuning the initial payload to continually evade updated defender detection methods, ensuring adaptability.

Creative infrastructure setup can also be a point of study, particularly focusing on layered C2 redirection techniques that incorporate encrypted communication channels to test robustness against modern security solutions focused on traffic analysis and anomaly detection.

Good / Better / Best

Good: Delivering payloads through unconventional but engaging formats like ZIPs with VHDX for baseline phishing testing.
Better: Spoofing known contacts and leveraging SSL certificates to encrypt malicious traffic for mid-tier engagement.
Best: Crafting multi-layered campaigns that combine unconventional delivery mechanisms with trusted infrastructure elements to bypass even high-security environments.

References

For more details on this campaign, refer to the detailed report from SANS Internet Storm Center.

Explore further phishing insights and trends at SANS Security Awareness.