Analyzing the Evil MSI Background Phishing Campaign: Techniques and Impacts

The Evil MSI Background campaign has demonstrated a sophisticated approach to phishing, relying on innovative techniques to deceive targets. Such campaigns are crucial to study, as they present new challenges and opportunities for attackers and defenders alike. By examining how malicious content within images is employed and the statistical methods used for detection, we can dissect the operating principles behind the campaign.

Campaign or TTP Overview

In late 2023, the cybersecurity community identified a novel phishing campaign termed “Evil MSI Background,” targeting various industries globally. The campaign was notable for utilizing Microsoft Installer (MSI) packages disguised within seemingly benign image files to deliver malware. This was first observed in large-scale attacks aiming predominantly at financial institutions and governmental bodies, indicating a methodical and targeted approach.

Attributed to a potentially state-sponsored group, the campaign exhibited a high level of sophistication in blending traditional file formats with innovative evasion techniques. As analyzed by the Internet Storm Center (ISC), this operation underscores how threat actors continue evolving to bypass conventional security measures and infiltrate secure networks across different sectors effectively.

How It Was Built

The Evil MSI Background campaign involved a layered attack methodology, leveraging compromised websites or spear-phishing emails to deliver the initial payload. Attackers embedded an MSI package within an image file using a technique known as steganography, where malicious code was hidden in the least suspected file types. The delivery mechanism involved carefully crafted emails with subject lines such as “Year-End Financial Report – Confidential” to entice unsuspecting users.

The email body typically appeared as follows:

Subject: Year-End Financial Report - Confidential

From: finance@legitcompany.com

To: [Recipient]

-------------------------------------------------------

Dear [Recipient Name],

Please review the attached document detailing our year-end financial results. Your prompt feedback is appreciated.

Best Regards,

John Doe

Chief Financial Officer

The lure content was polished, mimicking genuine business communications complete with plausible sender identities, such as “finance@legitcompany.com”. The user, upon opening the image file with embedded malicious content, unwittingly activated the MSI payload that initiated the malware installation process on their system.

Why It Worked

The Evil MSI Background campaign’s effectiveness hinged on several key factors:

Realistic Sender Identity: Utilizing domain patterns that closely mimic legitimate domains fooled recipients into believing the emails were genuine. By crafting senders like “finance@legitcompany.com” instead of obvious spoofs, attackers maintained high credibility.
Innovative Use of Steganography: The embedding of MSI files within images effectively bypassed traditional malware detection tools. Security systems typically scan for known malicious file signatures, not benign-looking images, which allowed the threat to go unnoticed during initial scans.
Lure Framing: Timely and relevant subject lines, especially related to financial or report-related matters, evoked urgency and ensured a higher engagement rate. This tactic efficiently captured the interest of key industry personnel who are often inundated with report requests.

The ability to seamlessly integrate malicious code in innocuous formats elevates the threat level of phishing campaigns.

Operator Takeaways

As a red teamer, there is much to glean from the Evil MSI Background campaign.

Exploit Familiar Formats: Consider leveraging file types that recipients regularly interact with, such as images or PDFs, to conceal malicious components.
Mimic Real-world Communication: Crafting believable sender identities and contextually relevant email content can significantly enhance the likelihood of successful phishing attempts.
Utilize Advanced Techniques: Incorporate innovative methods like steganography to obfuscate payloads, making detection by conventional scans more difficult.
Time Your Attack: Launch campaigns during periods of high email traffic when recipients may be less vigilant, increasing the chances of success.

Good / Better / Best

Good: Deploy phishing emails using generic attention-grabbing lines.
Better: Customize messages with industry-specific language to enhance legitimacy.
Best: Integrate cutting-edge obfuscation techniques within commonplace file types, combined with personalized messaging directed at specific user roles.