Redtail Payload Analysis: Dissecting Recent Phishing Patterns

Phishing campaigns continue to evolve in sophistication, employing more subtle techniques and deceptive strategies. The Redtail payload offers a recent case study in cunning delivery and execution. Using a combination of specially crafted payloads and unique distribution methods, the campaign primarily targeted financial sector employees, leveraging social engineering and technical evasion strategies to maximize impact. While attribution remains tentative, initial indicators suggest a well-resourced criminal group adept at exploiting weaknesses in email security systems.

Campaign or TTP Overview

In July 2023, the Redtail campaign launched a targeted phishing attack against financial institutions across North America, focusing particularly on executives and IT staff. The campaign’s precision and timing indicate thorough reconnaissance and targeting. The attackers employed high-quality business email compromise (BEC) tactics, inserting themselves into ongoing email threads to bolster authenticity and diminish suspicion. According to the SANS Internet Storm Center, the phishing emails originated from domains that subtly mimicked known and trusted entities within the industry.

The Redtail campaign stands out due to its multi-vector approach, integrating not only email phishing but also leveraging compromised legitimate websites as part of its attack payload delivery mechanism. The campaign has been ongoing, with iterative refinements that have made detection increasingly challenging. Victims were chosen based on public facing information, such as LinkedIn profiles, allowing customized lures that resonated with their professional responsibilities.

How It Was Built

At the core of the Redtail campaign’s success was its infrastructure setup and distribution methods. By using a combination of subtly altered domains and real-time content adaptation, the attackers bypassed traditional defenses. The domains, though similar, featured character replacements like “exämplefinance.com,” capitalizing on Unicode homographs to deceive visual inspection.

Email Subject: Invoice #38723 - Urgent Review Required

From: billing@exämplefinance.com

To: target@example.com

Body: 

Dear [Executive Name],

Please review the attached invoice at your earliest convenience. This urgent billing issue requires your immediate attention to prevent service disruption.

Best,

[Real Employee Name]

[Real Company Address]

Attachment: invoice_38723.docm

Each email contained macro-loaded documents designed to perform reconnaissance and deliver subsequent stages of payloads, primarily focusing on credential theft and remote access trojans (RATs). Once opened, the documents requested permissions under the guise of enabling editing or content, triggering the hidden macros. Through the use of encoded PowerShell scripts, the payload proceeded to download additional components from compromised legitimate sites.

Why It Worked

The Redtail campaign exploited specific weaknesses at the intersection of human psychology and technical safeguards. First, the trust factor was significant, as emails appeared to arrive from known internal contacts, exploiting the natural trust humans place in familiar structures. Secondly, by embedding themselves into ongoing conversations, they minimized the anomaly factor, making the phishing attempt feel like a direct continuation of prior communication.

The campaign’s construction of homograph domains effectively bypassed domain filtering technologies that rely on exact string matching, rendering traditional email filtering tools less effective. The attackers’ choice of initialized macros as a delivery vector leveraged common user behavior: clicking “Enable Content” due to unintended consequences like disabled editing features in legitimate documents.

Operator Takeaways

For red team operatives looking to enhance their own engagements, the Redtail campaign underscores the importance of both technical precision and social engineering prowess. Leveraging Unicode in domain mimicry requires attention to detail but yields significant success in bypassing automated defenses. Additionally, persistence in legitimate email threads can dramatically increase engagement rates compared to cold-call phishing attempts.

Incorporating multi-stage payloads that adapt in real-time based on the environment can complicate defensive measures and reduce the likelihood of detection post-execution. Crafting lures that align with the business cycle of the target organization enhances realism, further improving engagement.

Good / Better / Best

Good: Deploying phishing emails with minimal personalization and technically sound payloads can achieve baseline success against less vigilant targets.

Better: Integrating into existing communication threads and employing Unicode domain techniques raises success significantly by leveraging established trust relationships.

Best: Dynamic payloads that adapt and continue to evolve as they interact with the victim’s system, paired with personalized lures based on extensive reconnaissance, epitomize top-tier phishing campaign success.