Hackers Distribute VBS/PowerShell RAT Chain Via DuckDNS Hosts
A new malware campaign leverages VBS and PowerShell scripts, distributed through multiple DuckDNS hosts, to deliver a remote access tool capable of stealing sensitive data.
A sophisticated malware campaign has emerged, utilizing readily available Windows scripting tools, Visual Basic Script (VBS) and PowerShell, to deploy a potent remote access trojan (RAT). Attackers are employing a multi-stage delivery chain that relies on numerous DuckDNS hosts, making it challenging for security defenses to block all communication channels. The initial VBS files, observed to be identical, are heavily obfuscated to evade immediate scrutiny. Upon execution, these scripts decrypt an AES-256 encrypted PowerShell stage.
The PowerShell component then extracts a 64-bit payload and utilizes a .NET helper to perform process hollowing. This technique involves injecting malicious code into a seemingly legitimate process, such as AppLaunch.exe, to mask its true nature and bypass basic security checks. The use of process hollowing, combined with the familiar appearance of VBS and PowerShell scripts, allows the malware to blend in with normal system activity, potentially going unnoticed by users and less vigilant security monitoring.
The campaign's reliance on multiple DuckDNS domains and even a direct IP address for command and control (C2) infrastructure presents a dynamic target for defenders. If one domain or IP is blocked, the malware can pivot to another, ensuring continued operation. This distributed approach complicates takedown efforts and prolongs the campaign's lifespan. The RAT itself is designed for stealth and data exfiltration, capable of stealing browser credentials and cookies, logging keystrokes, and capturing clipboard contents.
Beyond its data-stealing capabilities, the malware actively attempts to subvert security measures. It installs itself in the Windows Startup folder under a deceptive name, ensuring persistence across reboots. Furthermore, it tries to create exclusions within Microsoft Defender, aiming to disable or reduce the effectiveness of the endpoint protection software. This combination of persistence, evasion, and data theft makes the RAT a significant threat to both individual users and corporate networks.
The stolen data, including browser session cookies, can grant attackers direct access to email accounts, business portals, and other sensitive services without needing to crack passwords. Keystroke logging and clipboard monitoring further increase the risk, potentially capturing one-time authentication codes, private messages, or payment details as they are entered or copied. The malware stores this sensitive information locally before exfiltration, and its C2 communications have been observed on port 4577.
Security researchers recommend blocking the identified DuckDNS infrastructure and the associated IP address at network and DNS controls. Endpoint hunting should focus on unusual PowerShell activity, encoded scripts, and unexpected child processes. Users are advised to exercise extreme caution with unsolicited script files, and administrators should review their script execution policies, maintain robust endpoint protection, and promptly investigate any changes to Microsoft Defender exclusions.
Given the potential for compromised browser sessions and active malware, affected systems should be isolated and thoroughly investigated. Resetting passwords alone may not be sufficient if session cookies have been exfiltrated. A comprehensive incident response plan should include reviewing and invalidating all potentially compromised accounts and sessions to mitigate further risk. The campaign highlights the ongoing threat posed by script-based malware and the importance of layered security defenses.