Explosive MirrorBlast Campaign Targets Financial Firms and It Points to TA505

Background

In autumn 2021, Morphisec Labs tracked a campaign, named ‘MirrorBlast’ by ET Labs. That specifically targeted financial-services organisations across Canada, the United States, Hong Kong and Europe, with related activity seen earlier that April. The draw for attackers is familiar: financial firms hold rich customer data and the means to pay large ransoms.

The attack chain closely matches the tradecraft of TA505 (MITRE G0092), a financially motivated, allegedly Russia-based group active since at least 2014 and known for constantly changing its malware and driving global malware-distribution trends. The overlap spans the infection chain, the loader, the domain-naming pattern and the final payload. The FlawedGrace RAT long associated with TA505 (as documented by Proofpoint and HP Threat Research).

What we observed

Morphisec’s analysis lays out a deliberately evasion-first chain:

• Delivery via trusted-brand lures: early waves used a malicious Excel attachment, then shifted to a Google FeedProxy URL carrying a SharePoint / OneDrive ‘file share request’ theme. Links led to a compromised SharePoint site or a fake OneDrive page; the SharePoint sign-in requirement conveniently filters out automated sandboxes.
• A near-undetectable Excel: the weaponised document carries an extremely lightweight macro that keeps VirusTotal detections very low. It runs only on 32-bit Office (an ActiveX compatibility quirk) and performs anti-sandbox checks, bailing out unless the computer name equals the user domain and the username is ‘admin’ or ‘administrator’. Across variants the macro moved from Office document properties into sheet cells and gained an extra obfuscation layer.
• A LOLBin hand-off: the macro runs JScript through the ScriptControl ActiveX ‘AddCode’ method, which spawns msiexec.exe to silently download and install an MSI. Because msiexec is launched with UILevel=-2 (completely silent) and is not a direct child of Excel.exe, it breaks attack-chain visibility and evades sandboxing.
• KiXtart and REBOL loaders: the MSI (built with WiX 3.11.0.1528) drops a legitimate interpreter, KiXtart or REBOL, plus a malicious script into a random ProgramData folder; some packages add Run-key autorun persistence. The loader beacons the victim’s domain, username, OS version, architecture (and a build number) to the C2 (menorukis[.]su), receives a UUID, then loops until the C2 answers ‘3’ and pulls the next stage. A newer REBOL build (1.0.2) drops the PowerShell step entirely to cut noise.
• The endgame: per Morphisec and corroborating research, the next-stage REBOL script leads to FlawedGrace, a full-featured remote-access trojan associated with TA505. The point at which the operator gains hands-on control.

MirrorBlast attack chain

Detection-only tooling struggles here: the FUD macro, the 32-bit-Office gate, and the msiexec hand-off all exist to defeat sandboxes and signatures.

Attribution

Morphisec attributes MirrorBlast to TA505 on the strength of multiple overlapping TTPs: the Email -> XLS -> MSI (KiXtart/REBOL loader) chain, whose MSI closely resembles TA505’s Get2 / GetandGo loader; the SharePoint/OneDrive lure theme; domain names built from ‘cdn’, ‘dl’, ‘fileshare’, ‘onedrive’ or ‘dropbox’ tokens; a details-pane MD5 that matches a legitimate PuTTY SFTP client hash previously seen in a TA505 intrusion; and the FlawedGrace endpoint. This is TTP-based attribution to a named actor, strong and consistent with independent Proofpoint and HP analysis, but, as always with shared or reused tradecraft, an assessment rather than a certainty.

Confidence: 85%.

A macro so lightweight it is nearly invisible, a living-off-the-land hand-off to hide the hand, and a RAT at the finish, MirrorBlast is TA505 doing what it does best: evading the scanners.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# Behavioural hunts for the MirrorBlast / TA505 chain
# 1) Office spawning a script host or msiexec (the JScript -> msiexec hand-off)
index=edr (parent_process IN ("excel.exe","winword.exe") process_name IN ("mshta.exe","wscript.exe","cscript.exe","msiexec.exe"))
| stats count values(command_line) as cmd by host, parent_process, process_name
# 2) msiexec installing from a URL, silent (LOLBin abuse)
index=edr process_name="msiexec.exe" (command_line="*http*" OR command_line="*/i *" OR command_line="*/quiet*" OR command_line="*/qn*")
# 3) KiXtart / REBOL interpreters dropped into ProgramData
index=edr (process_path="*\\ProgramData\\*" AND process_name IN ("*kix*","*rebol*")) OR file_path="*\\ProgramData\\*\\*.rb"
# 4) Run-key persistence writes referencing ProgramData interpreters
index=edr registry_path="*\\CurrentVersion\\Run*" registry_value="*ProgramData*"
# 5) C2 beacons
index=dns OR index=proxy (domain IN ("menorukis.su","feristoaul.com","fidufagios.com"))

# Morphisec YARA (excerpt) -- weaponised Excel + MSI:
rule MirrorBlast { strings: $h={D0 CF 11 E0 A1 B1 1A E1} $j1=").reverse().join(" $j2="eval('" $j3=".split('" condition: $h at 0 and all of ($j*) }
rule MirrorBlast_msi { strings: $wix="Windows Installer XML Toolset (3.11.0.1528)" $kix="WKIX32" $reb="Google" condition: $wix and 1 of ($kix,$reb) }

Recommendations

• Cut off the entry point: block or disable Office macros for documents from the internet (Mark-of-the-Web), and disable legacy ActiveX / ScriptControl where possible; the whole chain hinges on macro execution.
• Hunt the hand-off, not just the file: alert on Office applications spawning wscript/cscript/mshta/msiexec, and on msiexec.exe installing from a URL or running silently (UILevel/-qn) when it is not a child of a legitimate installer.
• Watch ProgramData: flag KiXtart/REBOL interpreters and .rb scripts dropped into random ProgramData folders, and Run-key persistence pointing at ProgramData binaries.
• Block and monitor the published C2 indicators (menorukis[.]su, feristoaul[.]com, fidufagios[.]com and the listed IPs) at the perimeter, NDR and EDR, and load the Morphisec YARA rules; the full XLS/MSI hash set is in Morphisec’s report.
• Assume detection-only tooling will miss the FUD macro: layer behavioural / exploit-prevention controls, brief finance-team staff on SharePoint/OneDrive ‘file share request’ lures, and treat 32-bit Office estates as elevated risk for this specific chain.