LausivLoader: Unpacking a New Multi-Stage Malware via Malspam

LausivLoader, a novel piece of multi-stage malware, recently emerged in the cyber threat landscape. This sophisticated threat was launched via a malspam campaign targeting corporate users attempting to exploit typical business workflows. Initially detected by researchers in a wave of malicious emails, this campaign utilized cleverly disguised communications to infiltrate networks, spread additional payloads, and evade detection.

Reported by threat analysts tracking malspam activities, the campaign predominantly targeted financial companies and IT firms, starting mid-2023. Although the specific actors behind LausivLoader haven’t been conclusively identified, the operation demonstrates a high level of technical acumen and social engineering prowess. This analysis will deconstruct the LausivLoader’s infection vector, payload delivery, and post-exploitation processes, providing insights into its deceptive tactics.

How It Was Built

The LausivLoader campaign employed a multifaceted approach, leveraging both technical and social engineering strategies to achieve its objectives. The initial vector was an email impersonating a legitimate shipping company, such as “FedEx” or “DHL,” with subject lines like “Shipment Notification: Tracking Number #123456789.” These emails were crafted to mimic authentic company communications, complete with logos and official-sounding language.

The emails contained attachments or embedded links leading to compromised domains mimicking legitimate courier websites. Once a user engaged with the attachment or link, a downloader executed, initiating the LausivLoader’s multi-stage process. Here’s a breakdown of the elements used:


Sender: alerts@fedex-shipment.com

Subject: Shipment Notification: Tracking Number #123456789

Body: "Dear Customer, your package is on its way! Follow the link to track your shipment: [malicious URL]"

Attachment: FedEx_Invoice_123456789.pdf (embedded macro)

The technical flow commenced with the delivery mechanism relying on HTML smuggling, which bypassed some email gateways by creating JavaScript blobs that constructed malware binaries on the fly. This approach masked the true intent from static email scanners, allowing the initial infection stage to thrive.

Why It Worked

The LausivLoader campaign’s success hinged on several key elements:

Realistic Impersonation: The decision to mimic well-known shipping brands created an immediate sense of urgency and legitimacy. Users encountering such emails, especially in professional environments where package deliveries are frequent, might not question the authenticity.
Dynamic Delivery Mechanism: The use of HTML smuggling permitted execution without direct file transfer initially, eliminating suspicious file downloads. This dynamically accommodates a broader range of targets without alerting network security protocols.
Insidious Payload Evolution: The multi-stage payload capability allowed the malware to adapt and escalate post-infection. Initial stages collected system data and ensured the environment was suitable before deploying the most intrusive aspects of the malware, evading premature detection and removal.

The strategic aspects of caller identity in phishing campaigns can deepen perceived authenticity, leveraging social proof from familiar brands to enhance interaction rates.

Operator Takeaways

Red team operators can glean numerous insights from LausivLoader’s operation for use in realistic security assessments:

Replicate brand impersonation techniques in phishing simulations to test awareness and response protocols more effectively.
Explore HTML smuggling tactics to bypass traditional email security systems, thereby assessing deeper network and endpoint defenses.
Develop multi-stage payloads that adapt based on environment analysis, helping refine post-exploitation playbooks.

Good / Better / Best

Good: Construct emails with branded assets and familiar language to exploit users’ trust in common business interactions.
Better: Utilize multi-stage payload design to ensure that subsequent actions occur only in optimal conditions, maximizing stealth.
Best: Implement dynamic payload delivery to evade standard detection processes, ensuring the initial compromise path remains undetected by altering typical file delivery mechanisms.

References

For further reading on LausivLoader, see the detailed analysis at the SANS Internet Storm Center and additional cybersecurity insights from Threatpost.