Full Report
FortiGuard Labs analysis of a multi-stage Windows malware campaign that abuses trusted platforms to disable defenses, deploy RATs, and deliver ransomware.
Analysis Summary
# Tool/Technique: Multi-Stage Windows Malware Campaign (Defendnot Abuse/Amnesia RAT/Ransomware)
## Overview
A multi-stage attack campaign primarily targeting Windows users, noteworthy for its social engineering initiation, heavy reliance on abusing trusted platforms (GitHub, Dropbox) for hosting, repurposing of the **Defendnot** research tool to disable Microsoft Defender, and culminating in the deployment of the **Amnesia RAT** followed by ransomware.
## Technical Details
- Type: Malware Campaign (Multi-stage Loader, RAT, Ransomware)
- Platform: Microsoft Windows
- Capabilities: Security control bypass (Defender disabling), surveillance (screen capture, clipboard monitoring), credential theft, remote access via RAT, and mass data encryption (Ransomware).
- First Seen: January 20, 2026 (Based on article date)
## MITRE ATT&CK Mapping
This summary aggregates techniques from the entire chain described in the article:
- [TA0001 - Initial Access]
- [T1566.001 - Phishing: Spearphishing Attachment]
- [TA0002 - Execution]
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [TA0005 - Defense Evasion]
- [T1218 - Signed Binary Proxy Execution] (Specifically abusing Defendnot via trusted binary injection)
- [T1027.002 - Obfuscated Files or Information: Software Discovery] (Obfuscation techniques used)
- [TA0004 - Privilege Escalation]
- [T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control]
- [TA0003 - Persistence]
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys]
- [T1547.001 - Boot or Logon Autostart Execution: Startup Folder]
- [TA0007 - Discovery]
- [T1082 - System Information Discovery]
- [T1057 - Process Discovery]
- [TA0009 - Collection]
- [T1113 - Screen Capture]
- [T1056.001 - Input Capture: Clipboard Data]
- [TA0006 - Credential Access]
- [T1555 - Credentials from Password Stores]
- [T1539 - Steal Web Session Cookie]
- [T1098 - Account Manipulation] (Telegram session hijacking)
- [TA0011 - Command and Control]
- [T1102.002 - Web Service: External Web Services] (Telegram Bot API used)
- [T1071.001 - Application Layer Protocol: Web Protocols] (HTTPS)
- [TA0010 - Exfiltration]
- [T1041 - Exfiltration Over C2 Channel] (Via Telegram API)
- [T1567.002 - Exfiltration Over Web Service] (Using services like GoFile)
- [TA0012 - Impact]
- [T1486 - Data Encrypted for Impact] (Ransomware)
- [T1490 - Inhibit System Recovery]
- [T1489 - Service Stop]
- [T1491.001 - Defacement: Internal Wallpaper Replacement]
- [T1499 - Endpoint Denial of Service] (WinLocker deployment)
- [T1565.001 - Stored Data Manipulation] (Clipboard replacement)
## Functionality
### Core Capabilities
- **Initial Access:** Execution via LNK file leading to PowerShell download/execution of a remote script (`kira.ps1`).
- **Defense Bypass:** Active disabling of Microsoft Defender using the repurposed **Defendnot** tool injected into a trusted signed binary (`Taskmgr.exe`).
- **Surveillance & Data Collection:** Periodic screen capturing and monitoring of clipboard contents (targeting cryptocurrency seed phrases/addresses).
- **Credential Theft:** Targeting browser credentials secured via DPAPI and stealing active session cookies/tokens.
### Advanced Features
- **Abuse of Trusted Platforms:** Hosting scripts on GitHub and binaries on Dropbox to facilitate download and increase the legitimacy of outbound traffic.
- **UAC Bypass:** Repeated use of ShellExecute "runas" invocation to force User Account Control elevation.
- **RAT Deployment:** Deployment of the **Amnesia RAT** for persistent remote access and control.
- **Ransomware Strain:** Deployment of a Hakuna Matata-derived ransomware variant for file encryption and system disruption.
- **C2 Communications:** Utilizing the **Telegram Bot API** for Command and Control, data exfiltration, and session hijacking of Telegram Desktop clients.
## Indicators of Compromise
- File Hashes: *(Not provided in the truncated text)*
- File Names: `Задание_для_бухгалтера_02отдела.txt.lnk`, `kira.ps1`
- Registry Keys: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (For persistence)
- Network Indicators:
- GitHub Download Source: `hxxps://github[.]com/Mafin111/MafinREP111/raw/refs/heads/main/ps1/kira[.]ps1`
- C2/Exfiltration: Telegram Bot API endpoints, Dropbox hosted binaries, GoFile service usage.
- Behavioral Indicators: PowerShell execution with `-ExecutionPolicy Bypass`, process injection into `Taskmgr.exe`, attempts to delete Volume Shadow Copies, and suspicious network connections to Telegram infrastructure.
## Associated Threat Actors
- The article does not explicitly name a specific APT group, but the campaign is noted to primarily target users in Russia.
## Detection Methods
- Signature-based detection: Signatures targeting the known file hashes (if available) and specific strings or structure of the malicious LNK file or PowerShell payload.
- Behavioral detection: Monitoring for processes attempting to bypass PowerShell execution policies (`-ExecutionPolicy Bypass`), process injection into system utilities like `Taskmgr.exe`, the use of `Defendnot` behavior, and anomalous network activity directed at Telegram APIs or file-hosting services for payload delivery/exfiltration.
- YARA rules: Rules targeting the known structure of the PowerShell loader or the Hakuna Matata-derived ransomware payload components.
## Mitigation Strategies
- **Prevention:** Implement strict application whitelisting; restrict PowerShell execution policies (though this campaign bypasses it, reduced scope helps).
- **Hardening:** Employ multi-factor authentication (MFA) to protect against stolen session tokens; disable or restrict LNK file execution via policies if possible (though LNKs are often legitimate); carefully restrict access to system tools often abused (like those used for UAC elevation checks).
- **Security Control:** Ensure Microsoft Defender/EDR remains optimally configured and updated, recognizing that this campaign specifically targets its disabling.
## Related Tools/Techniques
- **Amnesia RAT:** The Remote Access Trojan deployed during the intermediate stage.
- **Defendnot:** A research tool repurposed to exploit trust mechanisms in Windows Security Center for disabling Defender.
- **Hakuna Matata (Derived):** The ransomware strain used in the final stage.
- **Telegram Bot API:** Used as an unconventional but effective C2 channel.