The report covers a modular, multi-stage malware campaign that begins with a Unicode-obfuscated VBS loader, transitions to a fileless PowerShell loader, and uses PNG files to hide a .NET assembly that is later executed in memory. From there, the campaign can deliver multiple payloads, including Remcos RAT, UAC bypass DLLs, and Python-based tools. The threat actor hosts the entire toolkit in openly accessible directories under a single .xyz domain and several Cloudflare-backed subdomains, allowing fast payload swaps and multiple delivery paths such as weaponized PDFs and malicious batch scripts.
LevelBlue’s MDR SOC detected the initial VBS artifact through SentinelOne, quarantined it, and decoded the script for analysis. Investigators found a Base64-encoded PowerShell command that downloaded PNG files containing embedded .NET assemblies, which were then loaded directly into memory via reflection. Broader infrastructure review exposed open directories serving not only additional VBS loaders, but also malicious batch files, ZIP archives, and Python payloads tied to the same campaign.
Recommended defenses include restricting execution of high-risk script types such as .vbs and .bat from user-writable paths, applying strict controls over PowerShell usage, and monitoring for suspicious in-memory .NET loading. Defenders should also block .xyz domains and closely inspect or restrict WebDAV traffic abused through Internet Shortcut files. At the network layer, filtering access to the known malicious infrastructure can help disrupt the campaign earlier.
If this activity is detected, isolate the impacted endpoint, block all associated domains and URLs, and hunt for the relevant VBS and PowerShell artifacts. Investigators should memory for the reflected .NET assembly and review the system for scheduled tasks or files created from the exposed directories. Detection content should be updated to identify PNG-based payload staging and any linked batch or Python components tied to the campaign.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
An adversary has obtained a PowerShell one‑liner that downloads a malicious payload from a remote HTTP server and executes it. To evade simple script‑file detection, the command is Base64‑encoded and executed via powershell.exe -EncodedCommand . The command line therefore contains the three strings the rule watches for: powershell , Base64 , and Net.WebClient .
The attacker crafts the PowerShell script:
The script is UTF‑16LE encoded and Base64‑encoded.
The attacker runs the encoded command from a Windows command prompt (or a scheduled task).
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
