HP WOLF SECURITY

Threat Insights Report January 2025

Threat Insights Report - January 2025 2

Threats delivered in archives in Q3

34%

Email threats that evaded gateway security

11%

Threat Landscape Welcome to the January 2025 edition of the HP Wolf Security Threat Insights Report

Each quarter our security experts highlight notable malware campaigns, trends and techniques identified by HP Wolf Security. By isolating threats that have evaded detection tools and made it to endpoints, HP Wolf Security gives an insight into the latest techniques used by cybercriminals, equipping security teams with the knowledge to combat emerging threats and improve their security postures.1 This edition of the report describes notable threats seen in the wild in Q3 2024.

Executive Summary • In Q3, HP Sure Click caught campaigns spreading VIP Keylogger and 0bj3ctivityStealer malware that relied on the same techniques and loaders to infect PCs.2 3 In both campaigns, attackers hid malicious code in images (T1027.009) they uploaded to archive.org, a file hosting website, and used the same .NET loader to install their final payloads.4 By hiding malicous code in images and hosting them on legitimate websites (T1102), the attackers were more likely to bypass network security like web proxies that rely on reputation checks.5

• One of the techniques we see threat actors using to infect PCs is HTML smuggling (T1027.006), where victims are tricked into opening HTML files containing malware.6 In Q3, HP Sure Click stopped an HTML smuggling campaign delivering the XWorm remote access trojan (RAT).7 The activity resembled campaigns delivering AsyncRAT seen in Q2 2024.8 Notably, the HTML files bore hallmarks suggesting that they had been written with the help of GenAI. The activity points to the growing use of GenAI in the initial access and malware delivery stages of the attack chain. Indeed, threat actors stand to gain numerous benefits from GenAI, from scaling attacks and creating variations that could increase their infection rates, to making attribution by network defenders more difficult.

• In Q3, the HP Threat Research team identified a campaign stopped by HP Sure Click where threat actors uploaded information-stealing malware to code repositories on GitHub for video game cheat and modification tools. The malware, Lumma Stealer, scrapes victims’ passwords, cryptocurrency wallets and browser data.9

Threat Insights Report - Q3-2022 3Threat Insights Report - January 2025 3

In Q3, the HP threat research team uncovered large malware campaigns spreading VIP Keylogger that were caught by HP Sure Click. The threat actors behind this campaign sent emails posing as invoices and purchase orders to victims, suggesting that businesses rather than individuals were likely the target. The emails contained malicious attachments, including archive files, such as Z and GZ, as well as Excel spreadsheets.

The archives contain a .NET executable and relies on the target being tricked into running the file. If opened, the file acts as an initial stager, unpacking and executing VIP Keylogger.

The infection chain for Excel spreadsheets (Figure 1) is different. When opened, it uses template injection to download a Rich Text File (RTF) document from an attacker-controlled website. The RTF document tries to exploit a vulnerability in Office’s Equation Editor, CVE- 2017-11882 (T1203).10 11 If successful, it connects to the domain of a URL shortener, which redirects the request to download a malicious VBScript file. The VBScript, stored in the AppData folder, is run using wscript.exe (T1059.005), continuing the infection chain.12

Figure 1 – Malicious spreadsheet that exploits CVE-2017-11882

Notable Threats

Malware lurking in images hosted on legitimate websites spread VIP Keylogger

Threat Insights Report - January 2025 4

Much of the code in the script belongs to a legitimate XML parsing library. This code is used to obfuscate the malware and is not executed. The malicious code decodes and runs a PowerShell script (T1059.001).13 Like the VBScript, the PowerShell script is obfuscated, containing lots of encoded text. It downloads an image from archive.org, a legitimate file hosting website, and stores it in a text variable. Next, the PowerShell script extracts embedded Base64 code from the image, decodes it to an executable and runs it through built in .NET functionality (Figure 2). This allows PowerShell to run a custom function within the .NET executable and pass arguments to it. In this case, the malware passes a URL and strings used by the malware loader. The loader downloads VIP Keylogger from a given URL, then unpacks and runs it. For persistence, it creates a Registry run key (T1547.001) to start the malware each time the user logs on.14

VIP Keylogger is a comprehensive keylogger and data stealer, capable of recording keystrokes, extracting credentials from applications, clipboard data and taking screenshots. It shares many similarities with Snake Keylogger, and the even older 404 Keylogger. To trace the development of Snake Keylogger and the many infostealers related to it, we suggest reading our article on HP Threat Research blog on this topic.15

Our investigation uncovered multiple malicious images uploaded by the threat actor to archive.org. Since these files are publicly accessible, it was possible to gauge the scale of the campaigns. The most accessed malicious image had been viewed about 29,000 times, suggesting that these campaigns were large (Figure 3).

Figure 3 – Examples of malicious images and view counts hosted archive.org

Figure 2 – PowerShell that downloads and extracts malicious code from image

Threat Insights Report - January 2025 5

Q3 saw another campaign, caught by HP Sure Click, that shared many similarities with the VIP Keylogger activity. Threat actors began by sending malicious archive files to targets by email, posing as requests for quotations.

The archives contained a JavaScript file that mixes legitimate and malicious code (Figure 4). The legitimate part appears to be from PortMgr, a tool for managing TCP/IP printer port configurations.16 Running the JavaScript (T1059.007) decodes a Base64 encoded PowerShell script and executes it through an ActiveXObject.17 This script then downloads an image from a web server and reads the image as UTF-8 text. Embedded in the image is Base64 encoded malicious code (T1027.009).4 The malware then extracts the text between the two delimiters that mark where the code begins and ends (Figure 5).

Afterwards, it decodes the text, resulting in a .NET executable, then loads it into PowerShell. The script identifies the type "dnlib.IO.Home" and executes a function called "VAI" with multiple method arguments (Figure 6).

The .NET executable is the same as the loader used in the VIP Keylogger campaign and is responsible for downloading and running the payload, 0bj3ctivity Stealer.3 This infostealer is capable of exfiltrating information such as passwords and credit card details through Telegram, HTTP or SMTP.

0bj3ctivityStealer campaign highlights how malware kits are boosting attack efficiency

Figure 4 – Malicious JavaScript file posing as a request for quotation form

Figure 5 – Malicious code appended to image, encoded in Base64

Threat Insights Report - January 2025 6

Figures 6 & 7 – Code excerpts from .NET executable showing how the payload is downloaded and run

Though both campaigns distribute different malware families, they share many similarities, including:

• Hiding malicious code within legitimate scripting libraries (T1027.009).4

• Using images uploaded to a legitimate website to transport malicious code onto endpoints (T1102).5

• Using the same loader to install the final payload.

The activity highlights how threat actors are repurposing and stitching together attack components to improve the efficiency of their campaigns. Such tools are reducing the time and skill needed to create infection chains, enabling attackers to focus on experimenting with techniques to bypass detection, such as embedding malicious code inside images.

Threat Insights Report - January 2025 7

HTML smuggling threat delivering XWorm bears hallmarks of GenAI

Figures 8 & 9 – HTML file used in campaign spreading XWorm (left) and output from ChatGPT 4o after prompting it to generate an HTML page offering a file download (right)

One of the techniques we see threat actors using to infect PCs is HTML smuggling (T1027.006).6 The aim is to deliver malicious content hidden within HTML files, tricking victims into infecting their PCs. In Q3, HP Sure Click stopped an HTML smuggling campaign delivering XWorm malware.7 The activity resembled HTML smuggling campaigns delivering AsyncRAT seen in Q2 2024.8

Notably, the HTML files bear hallmarks suggesting that they had been written with the help of GenAI. The first indication is the high volume of comments describing what the code does, even simple statements (Figure 10). GenAI services like ChatGPT often provide comments to explain the logic of the code it generates, offering a plausible, though not conclusive, explanation for their inclusion here. The second indication is that, visually, the design of the HTML webpage delivering XWorm is almost identical as the output from ChatGPT 4o after prompting the LLM to generate an HTML page that offers a file download. Figures 8 and 9 show these similarities, including the choice of colors, drop shadows and rounded edges.

If the user opens the HTML file in their web browser, the malicious content is decoded and downloaded. In this case, a PIF file is automatically downloaded in the background. When viewed in File Explorer, the file looks like a shortcut, but it is a portable executable. In fact, the file is a compiled AutoIt script (T1059.010) that decodes and executes shellcode (T1027.013).18 19 To trigger the rest of the infection chain, the file must be started by the user manually.

The shellcode, started by the AutoIt script (Figure 11), is responsible for executing the malware. First, a few simple anti-analysis checks are carried out and then a new folder is created in the local AppData path. The PIF file is copied into this new folder and started under a different process name. However, this is done in suspended mode, as the process is only intended to serve as a cover for the malware, XWorm. An earlier dropped file called “gammy” containing the encrypted malware, is now loaded into memory, decrypted and injected into the newly started process (T1055.012).20 XWorm is a multi-purpose malware family that in most cases is used as a RAT or information stealer (Figure 12).

Threat Insights Report - January 2025 8

Figure 10 – Heavily commented HTML file from XWorm campaign

Figure 11 – AutoIT script that loads XWorm into memory

Figure 12 – XWorm configuration showing the attacker’s command and control (C2) server

Threat Insights Report - January 2025 9

Figures 14 & 15 – Executable mimicking PDF document (above) prompt asking user to open UUE archive (below)

Figure 13 – Archive embedded in PDF document (above)

In addition to the HTML smuggling campaign that leads to XWorm, in Q3 we observed another campaign that makes use of the same malware dropper. In this case, however, the infection started with a PDF document (Figure 13). This contained not just a link, as is so often the case, but an embedded file. As soon as the PDF is opened, the OpenAction directive executes JavaScript that tries to open the embedded file, triggering a user dialog box to be shown (Figure 15).

The embedded file is a UUE archive containing a portable executable. To allay suspicion, the attacker chose an icon for the executable that mimics a PDF document (Figure 14). This file is the same AutoIt dropper as seen in the XWorm campaign. However, a different infostealer, Formbook, is installed as the final payload.21

The campaign not only combines multiple different attack techniques to stay undetected during delivery and execution, but also shows a rise of AI-assisted malware development. Currently, we are not yet seeing GenAI being used early in the attack chain for highly skilled tasks like vulnerability discovery and exploit generation. Nor are we currently seeing evidence of attackers using GenAI in the development of malware payloads in the wild.

However, this activity does point to the growing use of GenAI in the intermediate stages of the attack chain, focusing on initial access and malware delivery. Indeed, threat actors stand to gain numerous benefits from GenAI, from scaling attacks and creating variations that could increase their infection rates, to making attribution more difficult for network defenders by leaving out distinctive indicators and patterns from malware. As GenAI’s capabilities improve over time, we may see an expansion of attackers using this technology in other areas of the attack chain.

Threat Insights Report - January 2025 10

Threat actors target video game modification and cheat code repositories with Lumma Stealer

Figure 16 – Example of GitHub repository containing malware (TempSpoofer.exe) leading to Lumma Stealer

All the campaigns we’ve highlighted so far this quarter make use of email as their delivery method. The following campaign was an exception. In Q3, we spotted threat actors setting up a series of GitHub repositories containing not only legitimate source code, but also malicious portable executable files, often masquerading as the compiled version of the projects themselves (Figures 16 and 17).

The repositories were mostly video game cheat and modification tools. Since such tools are often flagged by anti-malware software even if they don’t contain malware, users tend to ignore or even deactivate security messages.

The executables hosted in the GitHub repositories are a .NET malware dropper. They contain the payload in encoded form and decode it at runtime. The dropper then changes the protection of the memory region of the decoded code and executes it using a Windows API call (Figure 19).

The payload is Lumma Stealer, an information stealer that we see regularly, particularly over the last two years.9 The malware’s capabilities include stealing passwords, crypto wallets and browser information.

A lesson here is that cheating is not only wrong because it ruins the game for other players but also because you could risk a serious malware infection.

Threat Insights Report - January 2025 11

Figure 19 – .NET dropper that decodes and runs the payload, Lumma Stealer

Figures 17 & 18 – List of GitHub repositories associated with this campaign (left) and Lumma Stealer C2 servers (above)

Threat Insights Report - January 2025 12

Threat vector trends

Threat file type trends

In Q3, executables and scripts regained first place as the most popular malware delivery type (40% of threats caught by HP Sure Click), seeing a 5% point rise over Q2. In Q3, the top five archive file formats abused by threat actors where ZIP, RAR, LZH, 7Z and GZ. Archives were the second most popular malware delivery file type (34% of threats).

8% of threats relied on documents such as Microsoft Word formats (e.g. DOC, DOCX), while malicious spreadsheets (e.g. XLS, XLSX) totaled 7% of threats. 9% of threats were PDF files, seeing a 2% point rise over Q2. The remaining 2% of threats used other application types.

Top malware file extensions

Email remained the top vector for delivering malware to endpoints (52% of threats), falling 9% points compared to Q2. Malicious web browser downloads grew by 10% points to 28% in Q3. Threats delivered by other vectors, such as removable media, fell by 1% point compared to the previous quarter, accounting for 20% of threats.

Of the email threats caught by HP Wolf Security in Q2, at least 11% had bypassed one or more email gateway scanner, down 1% point compared to Q2.

Top threat vectors

52% Email

28% Web browser downloads

20% Other

Threat Insights Report - January 2025 13

About the HP Wolf Security Threat Insights Report Enterprises are most vulnerable from users opening email attachments, clicking on hyperlinks in emails, and downloading files from the web. HP Wolf Security protects the enterprise by isolating risky activity in micro-VMs, ensuring that malware cannot infect the host computer or spread onto the corporate network. HP Wolf Security uses introspection to collect rich forensic data to help our customers understand threats facing their networks and harden their infrastructure. The HP Wolf Security Threat Insights Report highlights notable malware campaigns analyzed by our threat research team so that our customers are aware of emerging threats and can take action to protect their environments.

About HP Wolf Security HP Wolf Security is a new breedc of endpoint security. HP’s portfolio of hardware-enforced security and endpoint- focused security services are designed to help organizations safeguard PCs, printers, and people from circling cyber predators. HP Wolf Security provides comprehensive endpoint protection and resiliency that starts at the hardware level and extends across software and services.

Stay current The HP Wolf Security Threat Insights Report is made possible by most of our customers who opt to share threat telemetry with HP. Our security experts analyze threat trends and significant malware campaigns, annotating alerts with insights and sharing them back with customers.

We recommend that customers take the following steps to ensure that you get the most out of your HP Wolf Security deployments:a

• Enable Threat Intelligence Services and Threat Forwarding in your HP Wolf Security Controller to benefit from MITRE ATT&CK annotations, triaging and analysis from our experts.b To learn more, read our Knowledge Base articles.22 23

• Keep your HP Wolf Security Controller up to date to receive new dashboards and report templates. See the latest release notes and software downloads on the Customer Portal.24

• Update your HP Wolf Security endpoint software to stay current with threat annotation rules added by our research team.

The HP Threat Research team regularly publishes Indicators of Compromise (IOCs) and tools to help security teams defend against threats. You can access these resources from the HP Threat Research GitHub repository.25 For the latest threat research, head over to the HP Wolf Security blog.26

[1] https://hp.com/wolf [2] https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger [3] https://malpedia.caad.fkie.fraunhofer.de/details/win.0bj3ctivity_stealer [4] https://attack.mitre.org/techniques/T1027/009/ [5] https://attack.mitre.org/techniques/T1102/ [6] https://attack.mitre.org/techniques/T1027/006/ [7] https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm [8] https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2024/ [9] https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma [10] https://nvd.nist.gov/vuln/detail/cve-2017-11882 [11] https://attack.mitre.org/techniques/T1203/ [12] https://attack.mitre.org/techniques/T1059/005/ [13] https://attack.mitre.org/techniques/T1059/001/ [14] https://attack.mitre.org/techniques/T1547/001/ [15] https://threatresearch.ext.hp.com/the-many-skins-of-snake-keylogger/ [16] https://github.com/tpn/windows-rktools-2003/blob/master/portmgr.vbs [17] https://attack.mitre.org/techniques/T1059/007/ [18] https://attack.mitre.org/techniques/T1059/010/ [19] https://attack.mitre.org/techniques/T1027/013/ [20] https://attack.mitre.org/techniques/T1055/012/ [21] https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook [22] https://enterprisesecurity.hp.com/s/article/Threat-Forwarding [23] https://enterprisesecurity.hp.com/s/article/HP-Threat-Intelligence [24] https://enterprisesecurity.hp.com/s/ [25] https://github.com/hpthreatresearch/ [26] https://threatresearch.ext.hp.com/blog

References

a. HP Wolf Enterprise Security is an optional service and may include offerings such as HP Sure Click Enterprise and HP Sure Access Enterprise. HP Sure Click Enterprise requires Windows 8 or 10 and Microsoft Internet Explorer, Google Chrome, Chromium or Firefox are supported. Supported attachments include Microsoft Office (Word, Excel, PowerPoint) and PDF files, when Microsoft Office or Adobe Acrobat are installed. HP Sure Access Enterprise requires Windows 10 Pro or Enterprise. HP services are governed by the applicable HP terms and conditions of service provided or indicated to Customer at the time of purchase. Customer may have additional statutory rights according to applicable local laws, and such rights are not in any way affected by the HP terms and conditions of service or the HP Limited Warranty provided with your HP Product. For full system requirements, please visit www.hpdaas.com/requirements.

b. HP Wolf Security Controller requires HP Sure Click Enterprise or HP Sure Access Enterprise. HP Wolf Security Controller is a management and analytics platform that provides critical data around devices and applications and is not sold as a standalone service. HP Wolf Security Controller follows stringent GDPR privacy regulations and is ISO27001, ISO27017 and SOC2 Type 2 certified for Information Security. Internet access with connection to the HP Cloud is required. For full system requirements, please visit http://www.hpdaas.com/requirements.

c. HP Security is now HP Wolf Security. Security features vary by platform, please see product data sheet for details.

HP Services are governed by the applicable HP terms and conditions of service provided or indicated to Customer at the time of purchase. Customer may have additional statutory rights according to applicable local laws, and such rights are not in any way affected by the HP terms and conditions of service or the HP Limited Warranty provided with your HP Product.

© Copyright 2025 HP Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

LEARN MORE AT HP.COM