A multi-stage phishing campaign delivers the Amnesia remote access Trojan (RAT) via macro-enabled Office and PDF lures targeting users in Russia, establishing command-and-control and culminating in ransomware deployment.
Users and organizations in Russia receiving business-themed phishing documents.
Macro-enabled lures bypass filtering and grant attackers remote control, data theft, and follow-on ransomware encryption of critical files.
- Block macros originating from the internet and restrict Office macro execution.
- Filter and detonate inbound Word/PDF attachments in a sandbox.
- Hunt for Office applications spawning script hosts or making network connections.
- Inspect outbound traffic for anomalous C2 over application-layer protocols.
Key Technical Findings
Phishing campaign delivering the Amnesia RAT, leading to ransomware.
Windows endpoints of targeted users in Russia.
Phishing emails carrying malicious Word or PDF attachments.
Macro enablement triggers execution of the Amnesia RAT (T1203).
The RAT establishes a backdoor for continuous access.
Not specified in the source material.
Documents are crafted to appear routine; additional evasion is Potential – requires validation.
Not specified in the source material.
Attackers may move laterally using the foothold (Potential – requires validation).
The RAT enables remote command execution and data theft; ransom is demanded in cryptocurrency.
High – remote control followed by ransomware encryption.
Technical Background
The campaign is multi-stage: weaponized Office/PDF documents lure recipients into enabling macros, which downloads and executes the Amnesia RAT. The RAT then connects to a command-and-control server, giving operators remote control to run commands, steal data, and deploy additional payloads.
The final stage deploys ransomware that encrypts victim files, with ransom demanded in cryptocurrency to preserve attacker anonymity. The macro-enablement step is the critical control point where most user-driven compromises can be prevented.
Attack Chain Analysis
-
Initial Access
ActivitySend business-themed phishing emails with malicious attachments.
EvidenceInbound mail with macro-bearing Office/PDF files.
TelemetryEmail gateway logs, attachment detonation.
Detection opportunityFlag documents requesting macro enablement from external senders.
-
Execution
ActivityVictim enables macros, triggering RAT execution (T1203).
Evidencewinword.exe spawning script hosts or downloaders.
TelemetrySysmon EID 1, EDR.
Detection opportunityAlert on Office apps launching PowerShell/wscript or network I/O.
-
Persistence
ActivityRAT installs a backdoor for ongoing access.
EvidenceNew autostart/service/task artifacts.
TelemetrySecurity 7045/4698, Sysmon.
Detection opportunityHunt for persistence created immediately after document execution.
-
Command and Control
ActivityRAT beacons to C2 over application-layer protocols (T1071).
EvidenceOutbound connections to rare destinations.
TelemetryProxy, firewall, DNS logs.
Detection opportunityDetect low-jitter beaconing to newly seen domains/IPs.
-
Impact
ActivityDeploy ransomware to encrypt files (T1486).
EvidenceMass file modification and ransom notes.
TelemetryEDR/FIM, file-audit logs.
Detection opportunityAlert on rapid mass file changes to uncommon extensions.
Deep Technical Behavior Analysis
Amnesia is a remote access Trojan that, once macros are enabled, establishes a persistent C2 channel for command execution, data theft, and payload delivery, with ransomware as the terminal objective. The highest-leverage defensive boundaries are the macro-enablement step and the outbound C2 beacon.
Specific C2 indicators, RAT hashes, and the exact ransomware family are not specified in the source material and should be treated as Potential – requires validation.
Indicators of Compromise
Indicators of Behavior
Behavioral indicators to hunt for even when atomic IoCs are limited (Potential — validate against your baseline).
| Behavioral Indicator | Description | Data Source | Confidence |
|---|---|---|---|
| Anomalous PowerShell execution | Encoded/obfuscated commands, download cradles, or unusual parent-child process lineage. | Sysmon EID 1, PowerShell 4104 | Potential |
| Suspicious child process lineage | Office or web/service processes spawning script hosts or shells. | Sysmon EID 1, EDR | Potential |
| Security log clearing | Event log cleared or audit policy changed to hinder visibility. | Windows Security 1102, 4719 | Potential |
| New service / scheduled task creation | Unexpected persistence via services or tasks. | Security 7045, 4698; Sysmon | Potential |
| Beaconing to rare destinations | Periodic outbound connections to newly-seen domains/IPs or direct-IP C2. | Proxy, firewall, DNS logs | Potential |
| Unusual DNS queries | High-entropy or rare domains; possible tunneling. | DNS resolver logs | Potential |
| Authentication anomalies | Spraying/stuffing, impossible travel, or MFA fatigue patterns. | IdP/VPN logs, Azure AD/Okta sign-ins | Potential |
Detection Engineering Guidance
Defensive detection logic (Potential — tune to your environment). No exploit code is included; logic is for hunting and alerting only.
pseudo: periodic outbound (low jitter) to newly-seen domain/IP
with small uniform payloads => alert(level=medium)Recommended Log Sources
| Platform | Log Source | What to Look For | Priority |
|---|---|---|---|
| Windows | Security Event Log | Logon (4624/4625), service (7045), task (4698), log clear (1102) | High |
| Windows | Sysmon | Process creation (1), network (3), image load (7), LSASS access (10) | High |
| Windows | PowerShell Operational | Script block logging (4104), module logging | High |
| Endpoint | EDR / Defender telemetry | Process tree, persistence, tamper attempts | High |
| Identity | IdP / VPN logs | Impossible travel, spraying, MFA fatigue | High |
| Network | DNS resolver logs | Rare/high-entropy domains, tunneling | Medium |
| Network | Proxy / firewall logs | Beaconing, direct-IP C2, exfil volume | High |
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Relevance | Detection Opportunity | Confidence |
|---|---|---|---|---|---|
| Execution | T1203 | Exploitation for Client Execution | Malicious document execution triggered via macro enablement. | Monitor for suspicious macro activity in Office applications. | Reported |
| Command and Control | T1071 | Application Layer Protocol | Communication with C2 servers for payload delivery. | Inspect network traffic for unusual outbound connections. | Reported |
Incident Response Guidance
- Validate exposure and confirm whether the issue applies to your environment.
- Preserve evidence (memory, disk, relevant logs) before remediation.
- Isolate affected hosts/accounts if compromise is suspected.
- Collect volatile data and review the log sources listed above.
- Hunt for the indicators of behavior and any related atomic indicators.
- Rotate potentially exposed credentials, keys, and session tokens.
- Remove persistence (tasks, services, keys, web shells, cron, OAuth grants).
- Patch affected systems; reimage where integrity cannot be assured.
- Run post-remediation validation and a BAS/security-validation retest.
Remediation and Hardening
- Patch affected systems and reduce internet-exposed services.
- Enforce MFA and least-privilege for privileged and remote access.
- Improve endpoint telemetry (Sysmon/EDR) and PowerShell logging.
- Restrict script execution and constrain LOLBins where feasible.
- Monitor persistence locations and disable unnecessary services.
- Segment critical assets and review privileged accounts.
- Rotate secrets and remove credentials from configuration files.
- Tune SIEM/EDR detections, then validate controls after changes.
Business Risk
- Service disruption: degraded or unavailable systems during compromise or recovery.
- Data exposure: risk to sensitive, regulated, or customer data depending on scope.
- Regulatory exposure: potential breach-notification and compliance obligations.
- Financial impact: incident response, downtime, and potential extortion costs.
- Brand and trust impact: reputational damage with customers and partners.
- Operational continuity: ransomware can halt critical business processes until restored.
- Identity blast radius: compromised accounts can expand access across cloud and SaaS.
Executive Takeaway
What leadership needs to know: Macro-enabled lures bypass filtering and grant attackers remote control, data theft, and follow-on ransomware encryption of critical files. Current assessed risk: High.
Prioritise: patching/exposure reduction, identity hardening (MFA, least privilege), and detection coverage for the techniques above.
Validate after remediation: re-test controls with breach & attack simulation to confirm the relevant techniques are now prevented or detected.
Validating Your Defenses with Valitrix
The Valitrix Breach and Attack Simulation (BAS) platform offers organizations a powerful tool for continuously validating their security controls against real-world threats. By emulating specific techniques associated with the Amnesia RAT phishing campaign, Valitrix allows security teams to ascertain whether their defenses effectively detect and respond to these sophisticated attacks.
This proactive validation approach enhances incident response readiness by identifying gaps in detection capabilities before a real attack occurs. Additionally, Valitrix enables teams to simulate various scenarios tailored to their unique environments, ensuring that security measures evolve alongside emerging threats.
Key Takeaways
- The Amnesia RAT phishing campaign exemplifies sophisticated multi-stage attacks leveraging social engineering tactics.
- Understanding the complete attack chain is crucial for effective threat detection and response strategies.
- User education plays a pivotal role in mitigating phishing risks and enhancing organizational resilience.
- Continuous validation of security controls with tools like Valitrix ensures preparedness against evolving threats.
Frequently Asked Questions
What is Amnesia RAT?
The Amnesia RAT is a remote access Trojan that allows attackers complete control over infected systems, facilitating data theft and additional malware deployment.
How can I recognize phishing emails?
Phishing emails typically exhibit generic greetings, spelling errors, and suspicious links or attachments. Always verify the sender’s email address before clicking on links or opening attachments.
What should I do if I fall victim to a phishing attack?
If you suspect you’ve been compromised, disconnect from the internet immediately, change your passwords, and run a security scan on your devices. Report the incident to your IT department or a cybersecurity professional.
How to test your defenses against this campaign
The attack chain described above — phishing delivery via macro-enabled Office and PDF lures, payload execution, command-and-control establishment, and ransomware deployment — maps directly to controls you can validate continuously rather than assume:
- Email gateway controls — can your secure email gateway detect and block macro-enabled lures and PDF-based phishing attachments before they reach users?
- Endpoint controls — does your EDR/AV detect the execution of the dropped payload and the RAT’s persistence mechanisms?
- Network controls — would command-and-control traffic to the infrastructure described here be detected or blocked by egress filtering?
- SIEM detection — do your detection rules correlate the phishing delivery, execution, and C2 stages into an actionable alert?
Continuous breach and attack simulation replays these exact stages safely against your own environment — see email security validation, endpoint security validation, and SIEM validation for how each control layer is tested.
