THREAT OPS › Threat News › Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
<blockquote> <p>A follow-up publication will provide a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail.</p> </blockquote> <h2 id="preamble">Preamble</h2> <p>Elastic Security Labs has identified a novel social engineering campaign that abuses the popular note-taking application, <a href="https://obsidian.md
MITRE ATT&CK techniques
- Scheduled TaskT1053.005
- Screen CaptureT1113
- JavaScriptT1059.007
- Boot or Logon Autostart ExecutionT1547
- Malicious FileT1204.002
- System Information DiscoveryT1082
- Scheduled Task/JobT1053
- AppleScriptT1059.002
- Deobfuscate/Decode Files or InformationT1140
- Social EngineeringT1684
- MasqueradingT1036
- Process InjectionT1055
- Reflective Code LoadingT1620
- Abuse Elevation Control MechanismT1548
- Command and Scripting InterpreterT1059
- Virtualization/Sandbox EvasionT1497
- User ExecutionT1204
- PowerShellT1059.001
- PhishingT1566
- Input CaptureT1056
- CredentialsT1589.001
- Spearphishing via ServiceT1566.003
- Command and Scripting InterpreterAML.T0050
- MasqueradingAML.T0074
- Virtualization/Sandbox EvasionAML.T0097
Indicators of compromise
- 6a85736b64761a8b2aaeadc1c0087e1897d16cc5a9d49c6a6ea1164233bad206sha256
- 70bbb38b70fd836d66e8166ec27be9aa8535b3876596fc80c45e3de4ce327980sha256
- 9e3890d43366faec26523edaf91712640056ea2481cdefe2f5dfa6b2b642085dsha256
- 33dacf9f854f636216e5062ca252df8e5bed652efd78b86512f5b868b11ee70fsha256
- 6c0a1da746438d68f6c4ffbf9a10e873f3cf0499sha1
- ff73f1344671a50945c40c45af0ae0b6fc2ed840sha1
- c28c16baea1b0c9d2ebc63dfc1880635890fd91esha1
- a6fa4adfc20e8e6b77e2dd631dc8ff18md5
- f77c8e40dfc17be5e74d8679d5b35341md5
- dcf5a9b27cbeedb769ccc8635d204af9md5
- 346272f0582541ae5dd08429bb4dc4ffmd5
- 0xc117688c530b660e15085bF3A2B664117d8672aAeth
- 0x38796B8479fDAE0A72e5E7e326c87a637D0Cbc0Eeth
- https://obsidian.md/url
- https://publish.obsidian.md/shellcommands/Indexurl
- http://195.3.222.251/script1.ps1url
- http://195.3.222.251/syncobs.exe?q=%23OBSIDIANurl
- http://195.3.222.251/stuk-phaseurl
- https://panel.fefea22134.neturl
- https://thoroughly-publisher-troy-clara.trycloudflare.comurl
- 195.3.222.251ipv4
- 120.0.0.0ipv4
- 104.21.79.142ipv4
- 172.67.146.15ipv4
- 188.114.97.1ipv4
- 188.114.96.1ipv4
- static-www.elastic.codomain
- eth.blockscout.comdomain
- base.blockscout.comdomain
- optimism.blockscout.comdomain
- 0x666.infodomain
- t.medomain