Executive Summary
LevelBlue labs identified a sophisticated infection chain delivering the CrySome Remote Access Trojan (RAT) initiated by a spear-phishing email masquerading as a logistics freight rate confirmation. The attack is notable for its use of living-off-the-land techniques and the integration of open-source tools to systematically dismantle host defenses before deploying the final payload.
The technical workflow involves a batch file executing hidden PowerShell commands, which subsequently utilize the ICMLuaUtil COM interface for silent UAC bypass and in-memory AMSI patching. The attackers specifically utilize the open-source WinDefCtl utility to disable Microsoft Defender via registry manipulation and a kernel driver (kvckiller.sys). Once established, the CrySome RAT provides extensive capabilities including hidden VNC, credential theft from Chromium-based browsers, and persistence via scheduled tasks.
This threat highlights the increasing trend of adversaries repurposing legitimate security research and open-source tools to minimize custom development while ensuring high success rates in bypassing traditional signature-based detections. Organizations in the logistics and transport sectors should be particularly alert to this campaign.