Aid groups involved in Ukraine’s war relief efforts and Ukrainian regional government administrations were targeted by a single-day spear phishing attack, a SentinelOne report has revealed.
The campaign, dubbed PhantomCaptcha, was conducted on October 8 and delivered a WebSocket remote access Trojan (RAT) hosted on Russian-owned infrastructure that enables arbitrary remote command execution, data exfiltration and potential deployment of additional malware.
Targets included individual members of the International Red Cross, Norwegian Refugee Council, UNICEF, Council of Europe’s Register of Damage for Ukraine and Ukrainian government administrations in the Donetsk, Dnipropetrovsk, Poltava and Mikolaevsk regions, according to the SentinelOne report published on October 22.
Threat actors used emails impersonating the Ukrainian President’s Office carrying weaponized PDFs, luring victims into executing malware via a ClickFix-style fake Cloudflare CAPTCHA page.
Read more: What is ClickFix and How to Prevent It
Clickfix-Style CAPTCHA Lure
Researchers at SentinelOne’s SentinelLabs investigated the PhantomCaptcha campaign after they received intelligence from Ukraine’s Digital Security Lab.
They found a sophisticated multi-stage spear phishing operation that took six months of preparation.
The initial access lure was an 8-page PDF document that appeared to be a legitimate governmental communique.
VirusTotal submissions on October 8 showed the malicious file uploaded from multiple locations including Ukraine, India, Italy and Slovakia, suggesting widespread targeting and potential victim interaction with the campaign.
When they opened the weaponized PDF and clicked on the embedded link, the victims were directed to a domain masquerading as a legitimate Zoom site but hosting a virtual private server (VPS) located in Finland and owned by Russian provider KVMKA.
This domain led to a fake Cloudflare DDoS protection gateway asking them to click on an “I’m not a robot” reCAPTCHA checkbox.
The SentinelLabs investigation found that the malicious domain stopped resolving on the same day the attack attempt took place, indicating a single day operation.
Three-Stage Attack Chain
Clicking the checkbox triggered a popup with instructions in Ukrainian, directing users to
- Click the “Copy token” button in the popup
- Press Windows + R to open the Run dialog
- Paste and execute the command
The button ran a function copyToken() containing a PowerShell commandlet (cmdlet) designed to run invisibly. The code downloads and executes the next stage PowerShell script from hxxps://zoomconference[.]app/cptch/${clientId}.
“This social engineering technique is particularly effective because the malicious code is executed by the user themselves, evading endpoint security controls that focus solely on detecting malicious files,” noted the SentinelLabs researchers.
The malware delivery campaign that followed was a three-stage attack chain designed to evade detection and establish persistent remote access:
- The initial payload was a heavily obfuscated PowerShell downloader that fetched and executed the next payload from hxxps://bsnowcommunications[.]com/maintenance. The excessive obfuscation served to bypass signature-based defenses and hinder analysis
- The second-stage payload performed system reconnaissance, collecting various user data, such as computer name, username, hardware identifiers and domain information
- This data was XOR-encrypted with a hardcoded key and sent to hxxps://bsnowcommunications[.]com/maintenance/ via HTTP GET requests
- The final payload is a lightweight PowerShell backdoor that connects and repeatedly reconnects to a remote WebSocket server at wss://bsnowcommunications[.]com:80
Overlaps with Recent Coldriver Campaigns
The SentinelLabs researchers concluded that the PhantomCaptcha campaign reflects “a highly capable adversary, demonstrating extensive operational planning, compartmentalized infrastructure and deliberate exposure control.”
“The six-month period between initial infrastructure registration and attack execution, followed by the swift takedown of user-facing domains while maintaining backend command-and-control, underscores an operator well-versed in both offensive tradecraft and defensive detection evasion,” the researchers wrote.
They also identified overlaps between this campaign’s attack chain and recently-reported activity attributed to Coldriver, threat group with reported links to the Russian FSB.
Read now: Russian Coldriver Hackers Deploy Malware to Target Western Officials