Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis
Summary: Unit 42 uncovered in December 2024 a phishing campaign that sends emails posing as order release or payment confirmations with a 7z archive containing a .jse downloader, which pulls a PowerShell script that decodes a Base64 payload and drops either a .NET or AutoIt compiled executable. The .NET path decrypts with AES or Triple DES and injects into RegAsm.exe to deliver Agent Tesla or XLoader, while the AutoIt path loads shellcode that injects a .NET file into RegSvcs to run an Agent Tesla variant packed with .NET Reactor.
What you should know: The chain relies on stacked simple stages rather than heavy obfuscation, and the two execution paths mean blocking one dropper type still leaves the other delivering an infostealer into a trusted .NET process like RegAsm.exe or RegSvcs.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026