Threat Spotlight: WarmCookie/BadSpace

Category	Details
Threat Actors	TA866 (also known as Asylum Ambuscade)
Campaign Overview	WarmCookie is distributed through malspam and malvertising campaigns since April 2024. It is used for initial access and persistence, enabling long-term access and malware deployment (e.g., CSharp-Streamer-RAT, Cobalt Strike).
Target Regions (Or Victims)	Victims targeted via malspam and malvertising campaigns, focusing on invoices and job-related themes to trick users.
Methodology	Malspam (emails with invoice/job themes), malvertising, malicious JavaScript downloaders, PowerShell commands, and use of compromised infrastructure (e.g., LandUpdates808).
Product Targeted	Primarily used for post-compromise malware delivery (CSharp-Streamer-RAT, Cobalt Strike), file manipulation, command execution, and persistence.
Malware Reference	WarmCookie (BadSpace), CSharp-Streamer-RAT, Cobalt Strike, Resident backdoor
Tools Used	PowerShell (Bitsadmin), JavaScript downloaders, ZIP archives, C2 infrastructure
Vulnerabilities Exploited	Malspam links, JavaScript-based exploits, PowerShell for execution
TTPs	Malspam with invoice/job lures, obfuscated JavaScript downloader, use of PowerShell commands for persistence and execution, C2 communication with updated user-agent and sandbox evasion techniques.
Attribution	Likely developed by TA866 (Asylum Ambuscade), with links to Resident backdoor
Recommendations	Network traffic inspection for detection (e.g., unusual user-agent strings), awareness of malspam techniques, monitoring for unusual PowerShell activity, and improving detection for obfuscated JavaScript and DLL payloads.
Source	Cisco Talos Blog

Read full article: https://blog.talosintelligence.com/warmcookie-analysis/

The above summary has been generated by an AI language model