This report summarizes the multi-stage intrusion documented by Deception.pro regarding a campaign observed between May 19 and May 24, 2026.
### Executive Summary
The operation involved an adversary utilizing a Social Security Administration (SSA)-themed phishing campaign to compromise a target workstation. Once the initial foothold was established, the attacker deployed a suite of commodity Remote Access Trojans (RATs) and remote management tools to ensure persistence, maintain redundant control, and perform reconnaissance within a simulated healthcare environment.
### Target and Impact
* **Target:** A replica environment simulating a Healthcare organization. The environment comprised a Microsoft Active Directory structure with over 1,000 endpoints and 500+ users.
* **Persona:** The attack specifically targeted a "Clinical Quality Analyst" persona based in the United States.
### Technical Breakdown
The intrusion followed a sophisticated, multi-stage kill chain:
* **Initial Access:** Victims received a phishing email containing a link to a RAR archive hosted on a compromised WordPress site. The domain used was a typosquatted variant (`1omlinemailserver[.]work`).
* **Execution:** The malware used a Right-to-Left Override (RTLO) trick to disguise a `.exe` file as a PDF (e.g., `.fdp.exe`), enticing the user to execute it.
* **Staging:** The attacker utilized `certutil` to download secondary payloads from a malicious domain (`cloudpre-005[.]online`).
* **Persistence:** The threat actor achieved persistence by modifying Registry Run-keys, camouflaging malicious processes as legitimate software updaters (e.g., `JavaUpdater`, `PayloadService`).
* **C2 Frameworks & Tools:**
* **AdaptixC2:** Used as the primary C2 channel, beaconing over HTTPS on port 443 with a static `Firefox/20.0` user agent.
* **XWorm:** Used for redundant access and data exfiltration via Telegram. It beaconed to `gatuso[.]duckdns[.]org:5111`.
* **ScreenConnect:** Deployed via `msiexec` from external domains (`nextleveldigitalinnovationx[.]com` and `fragment-sales[.]store`) on port 8041 to provide interactive remote control.
### Security Implications
The primary implication is the adversary's ability to unify disparate commodity malware families (AdaptixC2, XWorm, and Phantom Stealer) under a shared Telegram infrastructure. This indicates a coordinated, "hands-on-keyboard" operator. The attacker successfully performed domain reconnaissance using SAMR/LSAD enumeration techniques, signaling an intent to move laterally within the network.
### Recommendations for Defenders
* **Prioritize Behavioral Detection:** Since commodity tools change rapidly, focus on behavioral and network patterns (e.g., specific beaconing profiles) rather than static file hashes.
* **Network Monitoring:** Monitor for suspicious HTTPS traffic associated with AdaptixC2, specifically POST requests to endpoints such as `/updates/check.php`, `/api/v1/status`, and `/content.html`.
* **Tooling Oversight:** Treat `msiexec` installations initiated from external URLs as high-signal alerts, particularly for remote access tools like ScreenConnect.
* **Reconnaissance Alerts:** Detect anomalous bursts of `Samr*` and `Lsar*` RPC calls, which indicate domain account and trust enumeration.
* **Registry Hygiene:** Regularly audit Registry Run-keys for suspicious entries, especially those masquerading as legitimate vendors or located in writable user directories like `C:\Users\Public\`.
【1】