WhatsApp VBScript RMM Campaign

WhatsAppVBScriptRMM AbuseUAC BypassSocial Engineering

An unattributed, access-motivated actor is abusing compromised WhatsApp accounts to send the contacts of those accounts heavily obfuscated VBScript files disguised as business and financial documents. When opened, the VBScript runs a multi-stage chain that tampers with Windows User Account Control and silently installs a preconfigured ManageEngine Endpoint Central (RMM) agent, granting the attacker remote access to the victim's machine.

Indicators of Compromise

Domains (13)

invoice.msopsa.topfacaia.s3.us-east-005.backblazeb2.comyifubafu.s3.ap-southeast-1.amazonaws.comhksha3.s3.ap-southeast-1.amazonaws.comqse.shoppes.helpcaiwuascw.s3.us-east-005.backblazeb2.comsjdkjj23.s3.ap-southeast-1.amazonaws.comxijkwm2.s3.ap-southeast-1.amazonaws.combaoyuw2s.s3.ap-southeast-1.amazonaws.comshaaslong.onebaolongwes.oss-ap-southeast-1.aliyuncs.comtemu.baskwms.topbaoxis.cc

Hashes (41)

ddaffe9849f7f3c79f8804adb9a6b3d57f81c1bc8cfd588e8998968e2621456eb7cd06c71465038b658a6dc1f273a5078c3322009b8982663c0cbecd9492e7ebd06333c360b51456f427e616c3c5f8bd1d94fbe9cab21278cc3f104bea334d0879ecd61b09b0f2d54b34586c916c4ec95002eca748205d544618e3bd2dedc223f90ed4b2d0b67114aa89ddfed658e5c08c6d9fc389ad3f20ccbc71d77eb39bfad01cad98dd0d01b75e04e784953c5e2b3b1aba44dd3d9b6339b6f56e2f42034bd43fdaa1f0ee09d7e5f0f94ee9df7b6c6c39900d77dcba158e1d27c7619cb06ddf4fa0369eaca5cec348be293890d4af7403cbcc5a9c32384d431856dc48fcc974fd9f91fc93b6288b4fc253ea5b3e201c47c63e5ed25060d95359c57c77b1077f16449cd0c4862d1eadf8a5742bf09a6fb6a55424adfb61e31f06aef33273e5+21 more

IPv4 (6)

202.61.160.202202.61.160.137202.61.160.208202.61.160.16038.55.151.63202.61.160.201

Notes

CONCLUSION Because the final payload is legitimate, signed RMM software installed through msiexec, the malicious activity blends into normal administration; detection should focus on the delivery and setup behaviour rather than the agent itself. Users should be cautious with unexpected WhatsApp attachments even from known contacts, and script/executable types (VBS, VBE, EXE, BAT, CMD, JS, PS1) should not be opened unless independently verified. Defenders should watch for WScript.exe spawned by WhatsApp.Root.exe, explorer.exe or a browser, modifications to the ConsentPromptBehaviorAdmin registry value, and unexpected msiexec installs of ManageEngine Endpoint Central.SOCRadar customers can track this campaign across the <a href="https://platform.socradar.com">SOCRadar</a> platform using IOC Radar (hash, domain and IP hunting), Cyber Threat Intelligence (campaign tracking), Attack Surface Management and Dark Web Monitoring.<div> </div>

Mitigation

MitigationSource: <a href="https://attack.mitre.org/mitigations/">attack.mitre.org/mitigations</a><div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#185fa5;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">ID</th><th style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#185fa5;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Mitigation</th><th style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#185fa5;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Recommended Action</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017">M1017</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Training</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Train users to avoid opening unexpected VBS/VBE/EXE files received via messaging apps, even from known contacts.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1018">M1018</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Account Management</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Limit user accounts from having local administrator rights where possible; standard users cannot silently install RMM agents.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021">M1021</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Restrict Web-Based Content</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Block download of script file types (.vbs, .vbe, .js, .ps1) via web proxies and messaging platform filters.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1024">M1024</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Restrict Registry Permissions</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Restrict write access to UAC-related registry keys such as ConsentPromptBehaviorAdmin to prevent tampering.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026">M1026</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Enforce least-privilege; prevent standard users from running runas-elevated processes that modify UAC settings.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028">M1028</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Operating System Configuration</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Set ConsentPromptBehaviorAdmin to value 2 (prompt for credentials) via Group Policy to prevent silent UAC bypass.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031">M1031</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Network Intrusion Prevention</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Deploy IDS/IPS rules to detect BITS, curl, and certutil communications to unusual cloud storage endpoints (S3, Alibaba OSS, Backblaze).</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1034">M1034</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Limit Hardware Installation</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Use Group Policy to restrict silent MSI installation of unauthorized software including RMM agents.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1037">M1037</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Filter Network Traffic</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Block or alert on outbound connections to the identified attacker-controlled UEMS server IP range (202.61.160.0/24).</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038">M1038</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Execution Prevention</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Use AppLocker or WDAC policies to block WScript.exe from executing scripts outside approved directories.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040">M1040</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Deploy endpoint protection capable of detecting multi-stage VBScript execution chains spawned by messaging application processes.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042">M1042</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Disable or Remove Feature or Program</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Disable Windows Script Host (WScript.exe / CScript.exe) on endpoints where script execution is not required.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045">M1045</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Code Signing</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Enforce script execution policies requiring signed scripts; unsigned VBScript downloaded via WhatsApp will be blocked.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1047">M1047</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Audit</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Regularly audit installed RMM software and MSI installation logs for unauthorized ManageEngine Endpoint Central deployments.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1049">M1049</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Antivirus/Antimalware</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Ensure endpoint security solutions with behavioral detection are active and updated to detect obfuscated VBScript downloaders.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051">M1051</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Update Software</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Keep WhatsApp Desktop and all OS components updated to benefit from security improvements that may harden against file execution exploits.</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1052">M1052</a></td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Account Control</td><td style="border-left:solid #000000 1pt;border-right:solid #000000 1pt;border-bottom:solid #000000 1pt;border-top:solid #000000 1pt;vertical-align:middle;background-color:#ffffff;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Do not disable UAC; ensure ConsentPromptBehaviorAdmin is set to require credentials (value 2) to counter the script's UAC-bypass loop.</td></tr></tbody></table></div>