Modular RAT Campaign Steals Credentials and Captures Screenshots

A sophisticated spear-phishing campaign, dubbed Operation GriefLure, targeting senior executives in Vietnam and the Philippines with a stealthy modular remote access trojan (RAT).

The campaign focuses on high-value organizations, including Viettel Group Vietnam’s largest military-backed telecom provider and St. Luke’s Medical Center (SLMC) in the Philippines, demonstrating a calculated approach to regional cyber-espionage.

What sets Operation GriefLure apart is its use of deeply convincing decoy content. In the Vietnam-focused campaign, attackers embedded eight genuine legal and investigative documents tied to a real data breach dispute involving Viettel.

These included police reports, internal emails, and signed corporate admissions, making the lure nearly indistinguishable from legitimate case material.

In contrast, the Philippines campaign used a fabricated whistleblower complaint accusing SLMC of financial fraud and compliance violations.

The document was carefully crafted to trigger urgency among healthcare administrators by referencing regulatory risks, including potential violations tied to PhilHealth and JCI accreditation.

Seqrite Labs has uncovered a targeted spear phishing campaign dubbed Operation GriefLure, which targeted at senior executives of Viettel Group.

The attack begins with a spear-phishing email delivering a compressed archive containing decoy PDFs and a malicious Windows shortcut (LNK) file.

This LNK abuses the legitimate Windows ftp.exe utility as a Living-off-the-Land (LotL) tool, allowing attackers to evade traditional endpoint detection.

Once executed, the malware silently reconstructs its payload using fragmented files disguised as .doc documents.

Within seconds, a malicious executable named sfsvc.exe is assembled and launched while a decoy PDF opens to distract the victim. The entire process completes in under 10 seconds with no visible indicators.

Modular RAT Campaign

At the core of the attack is a modular malware framework. The sfsvc.exe binary acts as a custom loader, executing a secondary DLL payload (360.dll) that functions as a multi-stage shellcode loader. This design enables fileless execution, process injection, and persistence.

The primary decoy document a formal legal escalation email written directly to Viettel’s CEO summarizing a 4-month data breach dispute and threatening for legal action against the corporation.

Once active, the RAT communicates with a command-and-control (C2) server using obfuscated HTTP requests. It supports a wide range of surveillance and data theft capabilities, including:

• Credential harvesting from browsers, FTP clients, and remote access tools.
• Screenshot capture with dynamic resolution adjustment.
• Process enumeration and system profiling.
• Directory listing and file metadata exfiltration.
• Chunked payload delivery and remote execution.

For example, the malware can scan Chrome’s stored login data, capture screenshots of sensitive applications, and upload them to a remote server disguised as a legitimate domain.

The malware employs advanced evasion strategies, including DLL sideloading, XOR-based payload obfuscation, and NTFS Alternate Data Streams to hide malicious files.

It also includes functionality to detect installed security software and adapt its behavior accordingly.

A notable feature is its ability to terminate and relaunch the Windows Explorer process under controlled conditions, effectively manipulating the user environment to maintain persistence and reduce visibility.

Operation GriefLure highlights the evolution of targeted phishing campaigns, where attackers blend authentic documents with advanced malware delivery techniques.

Analysis of the campaign infrastructure revealed the use of a suspicious domain, whatsappcenter[.]com, hosted on a Hong Kong-based provider known for bulletproof hosting.

The malware also contains indicators such as targeting of WeChat data and references to China-based security software, suggesting a China-linked threat actor with moderate-to-high confidence.

By combining social engineering precision with modular, fileless malware, threat actors can achieve rapid and covert compromise of high-profile targets.

Security teams should monitor for unusual use of native tools such as ftp.exe, inspect compressed attachments carefully, and deploy behavioral detection mechanisms that can identify fileless execution patterns.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.