Affected Platfo 2026-7-16 13:0:0 Author: feeds.fortinet.com(查看原文) 阅读量:14 收藏
Affected Platforms: Microsoft Windows
Impacted Users: Any organization
Impact: Attackers gain control of the infected systems or stolen data may be leveraged for follow-on attacks
Severity Level: High
Since late March, 2026, we have been observing large-scale campaigns that use a combination of fileless techniques and Lua-based loaders with low detection rates to deploy various malware families, including Agent Tesla, Remcos, XWorm, and Best Private LOGGER.
Figure 1: Lua-based loader on VirusTotal
In these attack campaigns, the threat actor impersonates several well-known companies, using the guise of business cooperation to launch phishing attacks. To evade detection, the actor employs multi-layered, highly obfuscated stages, including extensive junk code and an AutoIt/Lua loader masquerading as a TrueType Font (.ttf) file.
Figure 2: Attack flow
Initial Access
The attack campaign begins with a phishing email that either contains a malicious archive or links to download one, as illustrated in Figure 3. By impersonating a reputable brand, business, or corporation, or using payment-related lures, the attacker manipulates the recipient into opening the attachment by creating a sense of urgency.
Figure 3: The phishing e-mails
JScript
Within the archive, the JavaScript file is obfuscated and embedded in a substantial amount of junk code. Even after extraction and beautification, the code retains a complex structure typical of obfuscation tools, as shown in Figure 4.
Figure 4: The obfuscated script.
The script employs highly complex obfuscation techniques, including string array mapping, control flow flattening, and anti-tampering mechanisms, to evade both manual and AI-driven analysis.
Within the core logic, critical strings—such as the ActiveX object and the output file paths—are obfuscated using signature evasion. These delimiters are then removed at runtime using .split() and .join() methods.
Figure 5: Signature evasion in critical strings.
The execution flow begins by verifying two conditions: the absence of the next-stage files and whether a specific variable is set to 'YESSSSSSSS.' If both conditions are met, the script copies itself to the %PUBLIC%\Libraries folder and establishes persistence via a Scheduled Task.
To deploy the next stage, the script extracts hardcoded, encoded data and processes it through a series of steps: reversing the strings, removing junk delimiters, and decoding from Base64. The resulting data is then saved to the specified file path. These dropped files may include an executable for an AutoIt interpreter or LuaJIT, along with accompanying scripts and encoded data.
Figure 6: The routine used to extract the embedded payload to disk.
Finally, it instantiates a WScript.Shell object to launch the executable, passing the script as a parameter.
Figure 7: Running the deployed executable and providing the .ttf file as a parameter.
Lua Loader
Lua is a fast, lightweight, and simple scripting language ideal for game development, embedded systems, and automation due to its low memory footprint and ease of integration. Its just-in-time compiler, LuaJIT, features a Foreign Function Interface (FFI) that allows seamless interaction with C data structures and native system APIs.
In the campaign, the dropped .ttf file is actually a disguised Lua script. A review of the related executable's metadata confirms its LuaJIT version, as shown in Figure 8.
Figure 8: Strings found in the LuaJIT executable.
The script begins with an encrypted data block and numerous decimal-encoded strings to impede analysis.
Figure 9: The obfuscated Lua loader.
At the core, the loader employs a three-step method for parsing the encoded payload.
First, the hardcoded string is reversed, and a set of replacement rules is applied: symbols ~, @, #, :, &, *, >, and < are replaced with A, B, C, D, a, b, c, and d, respectively. Then, the resulting string is decoded from Base64.
Figure 10: Decryption routine: steps 1 and 2.
Subsequently, a custom ROT cipher is applied. The first byte of the encrypted string serves as the rotation key. Once the key's validity is verified, the rotation value is calculated using the formula: 94 – {first_byte} - 128. The remaining data is then processed with the ROT cipher, ensuring the output consists of printable ASCII characters, as illustrated in Figure 11.
Figure 11: Applying the custom ROT cipher.
In addition to the decryption routine, the sample employs several anti-analysis and evasion techniques. These include allocating decoy memory regions, patching key characteristics for subsequent layers, and implementing page guards. Furthermore, it performs an in-memory XOR encryption and decryption cycle on the shellcode using a consistent key to further hinder detection.
Figure 12: The core logic of the Lua loader.
Decoy Memory
It allocates a decoy memory and fills it with the suspicious string and randomly generated data, as shown in Figures 13 and 14.
Figure 13: Decoy memory with a suspicious string.
Figure 14: Decoy memory with random data.
PatchDonut64Header
The function scans for byte sequences and string signatures characteristic of Donut shellcode, then obfuscates them with a mask composed of 144, 204, and randomly generated uppercase characters to evade detection.
Figure 15: Function for Patching Donut characteristic.
In the final stage, the shellcode is executed via a protected call (pcall) using a memory address that has already been cast to a callable C function pointer.
Throughout our research, we tracked samples ranging from the earliest version, which appeared in October 2025, to the most recent, which appeared in June 2026. Their evolution is shown below.
October 2025
While this version retains characteristics similar to previous iterations, the execution flow has become clearer.
Figure 16: The earliest version of the Lua loader.
The sample initiates a legitimate process to serve as a host, allocates memory in the remote process, and writes the decrypted shellcode to the allocated region. Execution is then triggered via CreateRemoteThread. Notably, the decryption routine used here is simpler than in newer iterations. It involves string reversal, Base64 decoding, and a ROT14-like cipher, consistent with the techniques documented in the egfincirt blog.
Figure 17: The deobfuscated script.
June 2026
Although the initial characteristics appear identical to known patterns, the core logic is significantly more complex. It incorporates a wide array of anti-analysis techniques designed to thwart both Lua and native-level debuggers, including API unhooking and the neutralization of software and hardware breakpoints.
Figure 18: Core logic: the latest Lua loader.
To obfuscate shellcode execution and hinder analysis, the implementation employs a segmented encryption scheme. The shellcode is partitioned into page-sized segments, which are then encrypted and marked with PAGE_NOACCESS. To facilitate execution, a Vectored Exception Handler (VEH) is registered to intercept access violations. When the program attempts to execute a protected page, the resulting exception triggers the VEH, which decrypts the specific code block and restores the necessary execution permissions, allowing the process to continue.
Figure 19: An obfuscated shellcode execution routine.
AutoIt Loader
In a similar attack campaign, we observed the use of AutoIt as the loader stage rather than Lua. In this instance, three files are dropped: the AutoIt interpreter, an AutoIt script, and an encoded data file. The dropped executable can be easily identified by distinct strings associated with the AutoIt interpreter, as shown in Figure 20.
Figure 20: Strings found in the AutoIt Interpreter.
Initial analysis reveals that the script employs obfuscation techniques, including string encryption and the use of randomized, long-form variable names.
Figure 21: Obfuscated script and the string decoded routine
Once deobfuscated, the script's true behavior becomes clear. It first defines the necessary structures to launch C:\Windows\Syswow64\colorcpl.exe as a suspended process. It then locates a local data file, decrypts it using XOR, and finally uses low-level ntdll.dll functions to perform process injection and execute the payload. Similar AutoIt loaders were mentioned in G Data blog posts analyzing a Remcos campaign.
Figure 22: Deobfuscated AutoIt script.
The execution flow is similar to the earliest Lua sample we tracked. Additionally, it is noteworthy that the script employs the same evasion strategy—allocating a significantly larger memory region—to bypass detection.
Donut Shellcode and Payload
The malicious payload is wrapped using the Donut shellcode generator. Upon successful execution of the Donut shellcode, a built-in reflective loader maps and executes the payload directly in memory, achieving a fileless state to evade disk-based detection.
Throughout these campaigns, we observed the threat actor staging and deploying multiple Remote Access Trojans (RATs) and infostealers on victims' systems. The identified payloads include Remcos, Agent Tesla, XWorm, and Snake Keylogger variants. These payloads grant the attacker full remote administrative control and enable extensive data exfiltration from compromised systems.
Best Private LOGGER
Best Private LOGGER appears to be a modified version of an older Snake Keylogger. As shown in the entry point below, the malware uses a hardcoded signature—'Best Private LOGGER'—which is combined with the data it harvests from the victim.
Figure 23: Main function of Best Private LOGGER.
Additionally, we acquired a Snake VIP Keylogger builder and used it to generate both protected and unprotected versions of the payload for comparative analysis, shown in Figure 24.
Figure 24: Snake VIP Keylogger builder and a protected version program.
We subsequently conducted a comparative analysis of the data collection modules across the obfuscated Snake Keylogger, the unprotected VIP Keylogger (generated from the builder), and the Best Private LOGGER. As shown below, all three use the same collection module and coding style. The only observed differences are marginal modifications to the signature and slight variations in the data format.
Figure 25: Snake Keylogger(left), Snake VIP Keylogger (middle), and Best Private LOGGER (right).
A comparison of the two samples shows that the naming conventions in the unprotected Snake VIP Keylogger and Best Private LOGGER are identical. However, Snake VIP Keylogger has a more extensive feature set, including anti-analysis capabilities and Wi-Fi harvesting. Given these structural similarities, we have identified Best Private LOGGER as a variant of Snake Keylogger.
Figure 26: Unprotected Snake VIP Keylogger (left) and Best Private LOGGER(right).
Conclusion
Behind a seemingly harmless file extension lies real danger. In these campaigns, the dropped executable serves as an interpreter, while the core loader script is disguised as a .ttf extension. This disguised loader decrypts, loads, and executes the subsequent stage, which ultimately deploys the malware.
This article reveals a large-scale attack campaign involving heavily obfuscated JScript droppers. These droppers launch an AutoIt/Lua-based loader to deploy various popular RATs and infostealers, including a version of the Snake Keylogger. The infection chain exploits business email compromise by pretending to be trusted companies, causing a significant global impact. Additionally, our review of the loader's development shows it is regularly updated to avoid detection and make analysis more difficult.
Fortinet Protections
The malware described in this report are detected and blocked by FortiGuard Antivirus as:
PDF/Agent.A529!tr
JS/Formbook.PYN!tr
JS/Agent.UNU!tr
JS/Formbook.AK!tr
JS/Obfus.gen!tr
Data/Agent.DD19!tr
Data/Lua.9!tr
AutoIt/Autoit.OTS!tr
W64/Donut.E!tr
MSIL/AgentTesla.B!tr
W32/Rescomms.B!tr
MSIL/Agent.ECL!tr
MSIL/SnakeStealer.AVQ!tr.spy
FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard Antivirus Service. The FortiGuard antivirus engine is part of each of those solutions. As a result, customers who have these products with up-to-date protections are protected.
The FortiGuard CDR (content disarm and reconstruction) service can disarm the malicious macros within the document.
We also suggest that organizations take the free Fortinet Fortinet Certified Fundamentals (FCF) cybersecurity training. The training is designed to help users learn about today's threat landscape and introduces basic cybersecurity concepts and technology.
FortiGuard IP Reputation and Anti-Botnet Security Service proactively block malware attacks by aggregating malicious source IP data from the Fortinet distributed network of threat sensors, CERTs, MITRE, cooperative competitors, and other global sources that collaborate to provide up-to-date threat intelligence about hostile sources.
If you believe this or any other cybersecurity threat has impacted your organization, please contact the Global FortiGuard Incident Response Team.
IOCs
C2:
104[.]239.66.86[:]7004
46[.]183.223.21[:]2404
107[.]174.34.137[:]443
newremupdate[.]duckdns.org[:]2404
mail[.]teamengineersgroup.com
mail[.]allportcargoservice.com
mail[.]trimnt.com
mail[.]taikei-rmc-co.biz
URLs:
hxxps[:]//cdn[.]discordapp[.]com/attachments/1499192125093449759/1511147377979818074/F10097782_Request-9200090_0990[.]PDF[.]JS
PDF:
9674da676ee226ee456d35c774715d9b58655423806f281de19dc9ef899e9532
JScripts:
16f9692debe0d4e35d76b48312979e5a90a85ce066e7375269ce78f43da52769
417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b
619d2628dcf0c8e15a6febb0e562609556ca57f9f8216800ee77a39e336b8bf4
1c4419d687bf45bdc5474b6347e41e89459fc0f5115f0d012c46c57280b242bf
81edd5e740bea0fefb5c1bbd14a671bd1daff37bf3641e34f3a1f7e93559184a
1d9dd914cf623dcae4b88834744a005e5e3eae827ded1aafd23ed1d7be57b90a
6700e6d2a0c285d3ebf1a55aecec63b1e42d7d581f691331c667a8920dac7029
96e22da4d5c0ea4b0efde0ad3eaa8fdedc60228f84fb3c56899afbb9338da2a1
Lua Scripts:
05390dd0d2c84f77475c0c6aa082638e23977da591302e911cbcb071c42a9451
c7159e589e29f9c866cc9983839ae9c9a1457df542a2dcd5103baf38636e08fd
bbeb74e6af12536ecb6761a65ed893fbddd1b86a17cd4a61b616e5fc6106ec9a
b12b743d4ecc0fe7320b6c1533e2a60bb89f94ca39a5be37143e7af27daacf04
8c28bc87eb4f2613117d41a716e78f62d55c19edaeea573c2c96e787da055167
be4fcf88a287f783a3d199e889f9f088f77338eafe0dce70a38ade01192fb223
AutoIt Scripts:
1539468a21a439dd4f8d72a6c34ce503f0585281fc2e88535c3c33727bfdc717
4c001e107a42d65c1b1e6092e4aa6932dbd1544d097d1a432ba27e3b4bddfcc1
16516e3298278719123068bf0ed808ea4e00f73c970a8a83377066b4e3c3c950
Donuts:
fbf9a87d351ef702d87e0cd9e0148baa44c6d619f50fbf91d79a1c5e37719a77
5b271a1b1ffe2716ae420f8e9d40dbc8e9e682f6e4125d4f174a335bf070ac29
5409b3fa21dcc2f854697ec731f9574603dd0b6bdfd892e968a2b412ed85f52c
7df42fc54f053d1bb65f43d4386a75be02770f7923b66e713fb04631582e864e
e2a95dd038a153dfb463c94554912f992cd04cf0f420552a95f4aea3d6f31e18
775ae9a8c7363e2368cbb559f9c2d26a6c479d4e7998fe71d45830885ccde429
986d1d5270822af7d7744762ecd8fc4e9b2886c85b3660e9fdf0b5906d6c4117
EXEs:
ec494785f243f5f1b516b31d8455fadafe5495e11d47a5ce2bd50b1b3791fec6
41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be
3ace400380bd1fc51e83d008dbbe9ceb70b2572da95264be09d85979a6276a37
cc041def6013da331f025e12f21f43677cea08073018d6be037f15a343a9cc24
ca9639f7db6c3d1b37a004493f44aaa4e1282ea9333bc8ca5eac5d263d899e6a
c92740b6b90582a4bf73fef979ca047b9e6ae432e892a97f71e70b45c09e478e
2fe30eccd36f4346cb117af0cf626c2bca84b50c658b0c9af09110b9f86a53f4
2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279
如有侵权请联系:admin#unsafe.sh