Hunt.io researchers published a threat hunt report on Hunt.io attributing a sophisticated global spear-phishing campaign targeting CFOs and finance executives across Europe, North America, South America, Africa, and Asia to APT MuddyWater. The campaign impersonates a Rothschild & Co recruiter, uses Firebase-hosted phishing pages with French math-challenge CAPTCHA gates powered by AES-encrypted redirects (CryptoJS v4.1.1), and deploys a two-stage VBS downloader chain that silently installs NetBird and OpenSSH, creates a hidden local administrator account, enables RDP, and establishes dual scheduled-task persistence — all while concealing the backdoor by removing NetBird desktop shortcuts.
Multi-Stage Infection Chain: Firebase CAPTCHA to VBS to NetBird
Firebase-hosted pages (e.g., googl-6c11f.firebaseapp[.]com, googl-165a0.web[.]app) present a fake Google Drive or document verification interface with a French addition math challenge. A hardcoded AES passphrase (/71Elw->qJY@) decrypts a redirect URL client-side via decryptAndRedirect() upon correct answer — serving as both anti-bot verification and sandbox evasion (automated systems would not solve the CAPTCHA before the path-rotation timeout). The download delivers a ZIP archive containing a single VBS file (e.g., F-144822.vbs) that fetches a second-stage script (cis.vbs) from http://198.46.178[.]135/34564/cis.ico, saves it to C:\bin\, and opens a fake error page to distract the victim. cis.vbs downloads trm (renamed to trm.zip), silently installs netbird.msi and OpenSSH.msi, pauses 60 seconds for service initialization, then launches NetBird with the hardcoded setup key E48E4A70-4CF4-4A77-946B-C8E50A60855A.
Persistence: Hidden Admin Account, RDP, and Dual Scheduled Tasks
The second-stage VBS creates a local user account (user / Bs@202122), adds it to both Administrators and Administrateurs groups, disables password expiration, and hides it from the Windows login screen via registry modification. RDP is enabled with matching firewall rules and auto-start configuration. Two scheduled tasks guarantee NetBird persistence: one configures delayed automatic startup on boot, and a second (ForceNetbirdRestart) explicitly restarts NetBird one minute after boot. All NetBird shortcuts are deleted from all users' desktops to conceal the installed tool from casual victim observation.
Infrastructure Pivots: Four Shared Firebase Phishing Kit Domains
Hunt.io's HuntSQL crawler pivots on the distinctive French math-challenge string "Quel est le résultat de ${num1} + ${num2}" identified four additional Firebase/Web App domains sharing the same phishing kit: cloud-ed980.firebaseapp[.]com, cloud-ed980.web[.]app, cloud-233f9.firebaseapp[.]com, and cloud-233f9.web[.]app. The cloud-233f9 variants use AES-ECB mode with hardcoded key wkjnmT+yiL7mjhnu, while cloud-ed980 uses OpenSSL Salted__ format with passphrase w&}nmT+y_L7{} — indicating a shared phishing kit with per-deployment parameter variation. Infrastructure evolution from 192[.]3.95.152 to 198.46.178.135 as the C2 host is confirmed, with identical service names, admin credentials, and the same NetBird setup key across both observed infrastructure generations.
Attribution: Maltrail IP Flag, Gophish on Port 3333, and AteraAgent VBS Droppers
Attribution to MuddyWater rests on three pillars: Maltrail threat intelligence flagging 192[.]3.95.152 (HostPapa/AS36352) as a prior MuddyWater C2 (active March–October 2024) running Gophish on port 3333; the SharePoint-impersonating domain my-sharepoint-inc[.]com sharing /cloudshare/atr/ directory structure with the original C2 and hosting three VBS droppers (CERT_LOCT_C3860_012025.vbs, ATTESTATION_LETPOLC3860_13891333.vbs, VIN_SELECTION_C3860_102024.vbs) that deploy AteraAgent.exe — a legitimate RMM tool previously documented as a MuddyWater persistence mechanism; and consistent overlap with prior Trellix-documented Rothschild lure campaign TTPs including identical NetBird setup key, admin credentials, and payload paths.