DOUBLECUP Campaign: Exploring the Use of PNG Payloads

In early 2023, the cybersecurity community identified and analyzed a sophisticated phishing campaign dubbed DOUBLECUP, which leveraged PNG files to carry malicious payloads in a manner reminiscent of steganography. This method added a layer of complexity to the campaign, challenging traditional detection mechanisms. Targeting primarily corporate users, DOUBLECUP aimed to exploit human vulnerabilities, bypassing signature-based defenses to deliver its payload.

The actors behind DOUBLECUP used strategic social engineering tactics, honing in on users likely to engage with visual content — a demographic ranging from marketing professionals to tech enthusiasts. By embedding payloads within seemingly benign images, they maximized the deception element while maintaining operational stealth.

The campaign gained attention due to its clever manipulation of file formats to smuggle code within conventional visual data, prompting a reevaluation of conventional filter efficacy. The mechanics of this attack style demonstrated an evolving threat landscape, where attackers continuously innovate to outpace detection technologies. For further campaign insights, see the analysis from SANS Internet Storm Center.

How It Was Built

The core of DOUBLECUP’s operation lay in its infrastructure and the intricacies of its payload delivery. Attackers crafted emails designed to pass as legitimate correspondence, utilizing subject lines such as “Q1 Marketing Strategy – Visual Assets” to entice recipients into action. The emails originated from domains meticulously selected to mimic known entities, like

marketing-net.services

Once a target engaged with the email, they were urged to download attached PNG files, purportedly containing critical image assets. These files were embedded with scripts that executed when processed by certain applications. The image files retained original-looking metadata to avoid raising user suspicion or triggering automated analysis systems.


GET /assets/marcom/ReportQ1.png HTTP/1.1

Host: assets.visual-contents.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36

Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8

Connection: keep-alive

The crux of the attack’s efficacy hinged on leveraging a steganography-adjacent method, where malicious code was interlaced within the PNG’s data structure. This method relied on misconfigurations within graphic rendering libraries that unwittingly executed this code, bypassing many traditional security measures.

Why It Worked

The success of DOUBLECUP was largely due to three elements: strategic identity deception, visual-centric luring techniques, and robust payload concealment.

Identity Deception: By using domains with high perceived trust and familiarity, attackers exploited routine human oversight. These domains closely mimicked legitimate businesses, leveraging slight variances in spelling or character substitution to appear authentic.
Lure Framing: The contextualization of PNG files as business-critical visual assets specifically targeted professions where image handling is common. This smart targeting increased the likelihood of interaction.
Payload Concealment: The integration of malicious payloads into PNGs — a format usually deemed safe — facilitated evasion of filters. This layered the element of surprise against unsuspecting users and defensive tools alike, capitalizing on the PNG’s non-suspect status.

Operator Takeaways

For red team practitioners, DOUBLECUP offers a wealth of tactical takeaways:

Creative Payload Delivery: Utilize unconventional methods such as inside image formats to bypass typical security checks. PNGs and similar formats provide camouflage due to their mundane nature.
Precise Targeting: Craft lures that resonate with specific industry practices to increase the likelihood of engagement. Aligning attack scenarios with everyday professional activities elevates credibility.
Infrastructure Management: Maintain realistic domain and email headers that mirror established corporate entities, ensuring credibility while diminishing overt signs of illegitimacy.

Good / Better / Best

Good: Selecting generic image formats that mix in visually-centric attacks, taking advantage of familiarity.

Better: Crafting payloads that not only integrate with standard formats but are tailored to specific processing weaknesses in common software.

Best: Merging payloads into widely shared content types, refined through industry-target analysis, ensuring high engagement rates while preserving operational stealth.

References

SANS Internet Storm Center analysis on DOUBLECUP