TFF Trap Campaign Leverages Evasion Tactics for Business Email Compromise
A sophisticated phishing campaign dubbed 'The TFF Trap' is employing fileless techniques and disguised loaders to deliver multiple remote access Trojans and stealers, aiming to facilitate Business Email Compromise (BEC) attacks.
A widespread phishing campaign, identified by researchers as "The TFF Trap," is actively targeting Microsoft Windows systems by combining advanced evasion tactics to deliver a variety of remote access Trojans (RATs) and infostealers. The campaign, observed since late March, utilizes fileless techniques and custom Lua-based loaders with notably low detection rates. This sophisticated approach aims to bypass traditional endpoint defenses and ultimately facilitate Business Email Compromise (BEC) attacks.
The core of the TFF Trap's evasion strategy lies in its multi-stage delivery mechanism. Attackers disguise the malicious loader script as a TrueType Font (.ttf) file, a technique that gives the campaign its name. This disguised loader, often written in AutoIT or Lua, is then executed by a legitimate interpreter. The loader's primary function is to decrypt and load the subsequent stages of the attack directly into memory, significantly reducing the chances of static analysis and signature-based detection.
Initial compromise is achieved through Business Email Compromise (BEC) tactics, where attackers impersonate well-known companies, particularly in the shipping and logistics sector like FedEx. These emails are designed to appear as routine business communications, luring unsuspecting employees into opening malicious attachments. The initial attachment is typically a heavily obfuscated JavaScript file that establishes persistence on the victim's system before launching the second-stage loader.
Instead of dropping conventional executable files, the campaign leverages legitimate interpreters like LuaJIT or AutoIt. These interpreters are used to execute encrypted Lua bytecode hidden within the fake .ttf file. This method allows the malicious code to run directly in memory, bypassing file-based detection mechanisms. Furthermore, the malware employs techniques to unhook Windows APIs that might be monitored by security tools and uses reflective loading to inject the final payload without writing it to disk, leaving minimal forensic artifacts.
The malware families deployed in the TFF Trap campaign include prominent RATs and stealers such as Agent Tesla, Remcos, XWorm, and Best Private Logger. The ultimate goal is to gain control of compromised systems or to exfiltrate sensitive data for use in subsequent attacks. By combining obfuscation, the abuse of trusted interpreters, and memory-resident execution, attackers significantly enhance their ability to evade detection by antivirus software and even some behavioral security tools.
Security experts emphasize that while the technical evasion methods are advanced, the initial entry point remains the human element. The success of The TFF Trap hinges on an employee falling for a well-crafted phishing email. Therefore, organizations are advised to reinforce employee training on identifying and questioning urgent or unexpected business communications, even from seemingly legitimate sources.
To defend against this evolving threat, Fortinet has provided a comprehensive set of Indicators of Compromise (IoCs), including specific URLs, JavaScript and Lua scripts, and command-and-control (C2) network addresses. Beyond technical defenses, security leaders recommend implementing robust identity and access controls, enforcing the principle of least privilege, and monitoring for anomalous user behavior. These downstream controls can significantly limit the damage an attacker can inflict even if initial access is gained.
The TFF Trap campaign exemplifies the ongoing trend of threat actors combining multiple evasion techniques to create highly resilient and stealthy attack chains. The reliance on fileless execution, disguised payloads, and the abuse of legitimate system tools highlights the increasing sophistication of malware delivery and the persistent challenge for defenders in keeping pace with evolving threats.