Threat hunting process

This investigation started with a cluster of generic malware detections on incoming .doc attachments. The real opening came when we looked past Trellix’s generic signature detection and checked the actual file structure. Every attachment was RTF despite carrying a .doc extension. That mismatch matters: a legitimate Word document is either Compound File Binary Format or OOXML. An RTF wearing a .doc extension is a pattern we associate specifically with OLE exploit delivery. The politically charged subjects going to government and defense recipients confirmed this was a coordinated APT operation, not a mass phishing run.

We extracted the embedded OLE objects from the RTF files and pulled the hardcoded WebDAV URLs. Pivoting on the code analysis pattern showed the overlap of the loader with previous APT28’s samples. Full payload analysis mapped both infection chains and revealed filen.io as the C2 channel, which is harder to take down and harder to detect than a traditional C2 server.

Our hunting methodology involved:

• File-type mismatch detection: Flagging .doc/.docx attachments where the actual structure is RTF, which is a reliable indicator for OLE exploit delivery that content filters tend to miss.

• Dynamic detonation of email attachments in the Trellix IVX sandbox, which surfaced the malicious WebDAV callback URLs embedded in the RTF files. Trellix Email Security automatically revoked the emails upon sandbox verdict.

• Subject line and sender correlation to tie together dispersed detections into a single coordinated campaign picture.

Remediation next steps

Block wellnesscaremed[.]com, wellnessmedcare[.]org, freefoodaid[.]com, and longsauce[.]com along with their associated IPs. Microsoft released an out-of-band patch for CVE-2026-21509; applying it is the single most impactful thing customers can do. 

On endpoints, hunt for the COM hijack registry key, look for EhStoreShell.dll, and SplashScreen.png under. For NotDoor, verify that %APPDATA%\Microsoft\Outlook\VbaProject.OTM has not been replaced, and alert on bulk outbound forwarding to other email addresses. Do not block filen.io at the domain level. Instead, write behavioral rules that alert when non-standard processes make high-frequency HTTPS calls to *.filen-*.net.

Threat hunting tips

The APT28 campaign offers several takeaways for threat-hunting teams.

• File-type mismatch detection belongs in your email pipeline: An RTF file disguised as a .doc combined with a generic detection hit. It is a deliberate choice to evade file-type filters, and it should trigger manual review regardless of what the content looks like.

• Lure themes that closely mirror a recipient's specific operational role are worth a second look during triage. Particularly when paired with an unexpected sender, an unusual attachment type, or a sandbox signal, the thematic relevance should raise your overall suspicion.

• RTF files with OLE objects frequently embed remote URLs that can be extracted statically. Pulling those URLs out of the file and pivoting on the infrastructure takes minutes and can surface the full campaign scope before any endpoint is touched.

Threat hunting process

While analyzing the email telemetry, we focus on targeted campaigns that might have been overlooked. We identify these campaigns by applying various filters, including the type of attached objects, the recipient email, and the subject line theme. In this case, these three elements caught our attention.

The "light-bulb moment" occurred when we observed the reuse of the command-and-control infrastructure, which was previously linked to a campaign against this same customer in October 2025. This historical context immediately signaled that the activity was not opportunistic spam but a calculated, sustained espionage effort utilizing the same established playbook.

Our hunting methodology involved:

• Email analysis, including the subject, the recipient, and the attachments, to detect targeted campaigns

• Malware detonation and analysis to verify its family, capabilities, and configuration

• Threat intelligence support to correlate this campaign with a previous one based on the employed command-and-control domain

Remediation next steps

To remediate and defend against this threat, prioritize blocking the compromised sender domain and the associated command-and-control infrastructure (bluevistaviewspa[.]com and hannahsgpsapp[.]com) across all security layers. Update email and endpoint block lists with the identified malicious file and attachment hashes, and implement stricter inspection policies for ZIP files containing containerized images like VHD or VHDX, as well as .lnk files that trigger PowerShell or command shells. 

Enhance detection capabilities by configuring alerts for scheduled tasks containing curl or cmd operations and monitor for conhost.exe instances running with the --headless flag. Finally, establish proactive hunting protocols for mswsrc.exe and script.vbs artifacts within %LOCALAPPDATA% and ensure staff are briefed on the risks of thread-hijacking tactics used in event-invitation spear-phishing campaigns.

Threat hunting tips

Based on the tactics and patterns observed in the report, here is advice for threat hunting teams to help detect similar activity:

• Scrutinize containerized attachments: Treat ZIP attachments containing VHD, VHDX, or ISO images with extra caution, as these formats are being leveraged to bypass standard security inspection.

• Flag suspicious shortcut behavior: Create detection rules for .lnk files that launch PowerShell or command-line strings, especially when they masquerade as common document types like PDFs.

• Monitor scheduled task creation: Alert on the creation of scheduled tasks that utilize curl, cmd, or other scripts to beacon out to external domains, as this is a common persistence mechanism.

• Detect execution evasion: Monitor for conhost.exe running with the --headless flag, as this is a specific technique used to maintain hidden command shells on compromised hosts.

• Correlate infrastructure across campaigns: Do not analyze C2 domains in isolation. Track and correlate infrastructure reuse over time; actors frequently recycle the same C2 domains and playbooks when targeting specific entities.

• Educate on thread-hijacking: Train staff to remain vigilant even when emails arrive within existing, legitimate conversation threads. Attackers are compromising legitimate accounts to hijack these discussions and lower user defenses.

Threat hunting process

This investigation was retroactive. A trusted partner shared an email address tied to a Russian threat actor. We took that and looked for it in our own telemetry. What we found was more than a single match: Every email in the wave had come from the same sending host, s1277447[.]smartape-vps[.]com, with each going to a different organization with a different sender domain and a different phishing URL. 

One Russian VPS, one process, four named targets across three countries, 66 minutes. That was enough to treat it as a coordinated campaign. The phishing pages were configured to serve a clean PDF to anything that looked like a scanner, and to serve the exploit only to real iPhones geolocated where they expected their targets. Further threat intelligence analysis corroborated the infrastructure and confirmed the attribution.

Our hunting methodology involved:

• Retroactive pivot from a partner-shared sender indicator into our email telemetry, then expanding from the sender to the sending infrastructure to find related emails across different organizations.

• Message-ID header correlation to identify the shared MTA hostname s1277447[.]smartape-vps[.]com and common process ID that tied all four emails into a single campaign.

• Cross-referencing public and private intelligence sources to correlate infrastructure IOCs and confirm attribution.

Remediation next steps

Block sending IP 188[.]127[.]227[.]111 and MTA hostname s1277447[.]smartape-vps[.]com in email gateway controls. Block phishing domains bridetvstreaming[.]org and motorbeylimited[.]com at network level. For organizations with senior or high-risk personnel, the most impactful action is iOS patching: All devices should be on iOS 26.3 or later, where all six DarkSword CVEs are patched. Personnel who cannot update immediately should have Lockdown Mode enabled, which blocks the class of browser exploits used here.

Threat hunting tips

The DarkSword campaign offers several takeaways for threat-hunting teams.

• Partner-shared indicators are worth acting on even after the fact. Retroactive hunting from a shared sender address can still surface undetected activity in your telemetry, particularly when the original delivery produced false negatives.

• A single sender indicator is a starting point, not a destination. Expand your search to the sending infrastructure. 

• Phishing pages that serve clean content to scanners while serving exploits to real users from expected geographies are a deliberate evasion technique. 

• For organizations whose personnel include senior officials, government employees, or defense industry figures, iPhone patching cadence is as important as endpoint patching. A one-click browser exploit requiring only a single link tap is a realistic threat for these users.

• When triage surfaces an email where the subject line is personalized with the recipient's full name and the sender is from an unusual or unfamiliar domain, treat the combination as worth a second look. Neither indicator alone is reliable, but together they suggest the sender had prior knowledge of the target rather than running bulk phishing.

Threat hunting process

The investigation was initiated by a suspicious encoded PowerShell activity on one of the hosts. These commands are quite common in development environments, but this time was different due to the process lineage; specifically, the spawning of a Node.js runtime from a non-standard, masquerading directory (OneDriveSoftwareInstallerTask-bx3ou, EdgeResourcesInstallerV1-jth3, OSVersionInstallerV12Task-cqimme3) to load decrypted, Brotli-compressed bytecode directly in memory.

Our methodology relied on rapid telemetry correlation to deconstruct this multistage attack. By mapping the full execution flow (powershell.exe -> node.exe -> preload.js -> app.js), we were able to identify the responsible binaries and reverse-engineer the in-memory decryption logic.

Our hunting methodology involved:

• Proactive PowerShell encoded commands hunting

• Process-genealogy analysis, which revealed that the PowerShell process spawned a Node.js instance from an anomalous, masquerading directory

• Reverse engineering the different stages to understand the execution chain and identify the sample behind the campaign

Remediation next steps

To remediate this threat, immediately isolate the affected host to prevent further network access and potential lateral movement. Eradicate all malicious files and identify and remove the Windows service established for persistence. Block the malicious identified domains at the network perimeter (firewall/proxy/DNS) and reset credentials for any accounts that logged into the infected host. 

Finally, to prevent future occurrences, enforce application allowlisting (e.g., WDAC or AppLocker), implement PowerShell security configurations such as Constrained Language Mode and enhanced logging, and conduct user awareness training on the dangers of executing untrusted applications.

Threat hunting tips

When investigating sophisticated multistage threats similar to the one identified in this report, consider these tips to improve your detection and response efficacy:

• Look beyond obfuscated commands: Attackers often use encoded PowerShell to hide their initial intent. Don't just focus on the decoding; pivot immediately to analyzing the resulting process lineage (e.g., PowerShell spawning unexpected binaries like node.exe).

• Audit non-standard execution paths: Be highly suspicious of legitimate binaries (like node.exe or winpty.exe) executing from unusual or masquerading directories, such as C:\Windows\System32\EdgeResourcesInstallerV1-jth3\.

• Correlation is key: Link events across the chain. If you see an unusual file creation (like .js files) followed by an outbound network connection to a suspicious domain, it is a high-confidence indicator of compromise.

• Analyze memory-resident logic: Attackers are increasingly using in-memory decryption (e.g., using AES-256-CBC) and execution (e.g., V8 bytecode loaders) to bypass disk-based antivirus. Focus your hunting on volatile artifacts and process memory when static file analysis is inconclusive.

• Baseline your environment: Establish a clear baseline of expected PowerShell activity and approved binaries. Deviations from this baseline, such as unexpected use of Invoke-WebRequest combined with Invoke-Expression, should trigger immediate investigation.

• Enforce hardening: Proactively restrict the attack surface by enforcing Constrained Language Mode for PowerShell, implementing application allowlisting (WDAC/AppLocker), and logging script block execution to gain critical visibility into "living-off-the-land" techniques.

Threat hunting process

This was an opportunistic hunt triggered by public threat intel reports. 

Our hunting methodology involved:

• Identifying key IOCs from public threat intel to conduct IOC-Sweep on Trellix telemetry

  • The domain name and IP address of the C2 server were identified as high-confidence IOCs (sfrclak[.]com -> 142[.]11.206.73)

• Identifying key TTPs from public threat intel to conduct TTP-based hunts on Trellix telemetry

  • Execution of malicious payloads via JavaScript identified as cross-platform TTP

  • Payload download via curl identified as cross-platform TTP

  • Execution of renamed copies of PowerShell interpreter identified as TTP (Windows)

• Once potential victims were identified, deeper analysis to reconstruct the attack chain (which led to identifying additional TTPs).

  • As part of the Trellix SecondSight hunting process, victims were notified.

Remediation next steps

• Establish continuous SBOM-backed visibility and rapid containment protocols: Organizations must maintain real-time, environment-level software bills of materials (SBOMs) to comprehensively map component presence across developer workstations, production servers, and ephemeral workloads. In the event of a suspected supply chain compromise, security teams must be empowered to immediately isolate affected systems, flush local and regional package caches, and enforce rigorous blocking of known outbound command and control (C2) indicators at both the firewall and DNS layers.

• Prioritize secret hygiene and rapid credential rotation: Any secrets present in an environment during a compromised installation window must be considered fully exposed. Security teams should immediately isolate affected devices and execute a systematic rotation of all accessible authentication tokens, including SSH keys, cloud provider credentials, database connection strings, and registry publishing tokens. To prevent re-compromise, this rotation must be performed exclusively from verified, secure systems.

• Strengthen build integrity through deterministic pinning and gated execution: To eliminate the risk of automated pipelines silently ingesting poisoned dependencies, organizations must transition away from flexible semantic versioning (such as ^ or ~) for critical components. By enforcing exact version pinning and mandating deterministic installation commands—such as npm ci or --frozen-lockfile—security teams can ensure build consistency. Furthermore, restricting ad-hoc runtime commands like npx prevents the dynamic registry resolutions that often bypass project lockfiles, thereby securing the environment against unvetted code execution.

• Implement release soak-times and strategic package cooldowns: Given that a vast majority of malicious registry packages are identified and purged by the security community within hours or days of publication, organizations should utilize package manager configurations to enforce a minimum release-age buffer (e.g., seven days). This "cooldown" period prevents development environments and automated pipelines from resolving bleeding-edge, unvetted updates, effectively establishing a critical time-delayed safety shield against nascent supply chain threats.

Threat hunting tips

This npm Supply Chain Attack campaign offers several takeaways for threat-hunting teams.

• Command/scripts interpreter binaries running from unexpected paths or running under unexpected file names are good candidates for hunting. 

• Remote payload execution involving Command/Script interpreters and utils like curl, wget, and certutil can help unveil all sorts of incidents.