New Cyber Attack Weaponizes DeskSoft to Deploy Malware Leveraging RDP Access to Execute Commands

A sophisticated cyber attack has emerged targeting organizations through a malicious impersonation of DeskSoft’s legitimate EarthTime application, deploying multiple malware families in a coordinated ransomware operation.

The attack represents a concerning evolution in threat actor tactics, demonstrating how legitimate software can be weaponized to establish persistent access across enterprise networks.

The intrusion begins when unsuspecting users download and execute what appears to be the genuine EarthTime world clock utility by DeskSoft. However, the malicious executable instead deploys SectopRAT malware, establishing an initial command and control channel.

This deceptive approach exploits users’ familiarity with legitimate software, making the attack particularly effective at bypassing initial security awareness measures.

The attack demonstrates remarkable technical sophistication, with threat actors deploying multiple malware families including SystemBC for proxy tunneling and the Betruger backdoor for additional capabilities.

The DFIR Report analysts identified connections to three major ransomware operations – Play, RansomHub, and DragonForce – suggesting the involvement of a cross-group affiliate operating across multiple ransomware-as-a-service platforms.

Following initial compromise, the attackers establish persistence through startup folder shortcuts and create local administrative accounts for sustained access.

The malware chain includes reconnaissance tools such as AdFind, SharpHound, and SoftPerfect NetScan, enabling comprehensive environment mapping before lateral movement activities commence.

The attack’s primary lateral movement mechanism relies heavily on Remote Desktop Protocol connections, supplemented by Impacket’s wmiexec utility.

This combination allows attackers to traverse network segments while maintaining operational security through SystemBC’s proxy capabilities, effectively masking their true network origins.

Advanced Persistence and Evasion Mechanisms

The malware demonstrates sophisticated defense evasion techniques that significantly complicate detection and remediation efforts.

The initial EarthTime.exe executable employs process injection to compromise legitimate Windows processes, specifically targeting MSBuild.exe for payload execution.

This technique allows the malware to execute within the context of a trusted Microsoft binary, potentially evading security solutions that rely on process reputation.

The persistence mechanism operates through a multi-stage approach using Windows Background Intelligent Transfer Service.

The malware relocates itself to C:Users<USER>AppDataRoamingQuickAgent2ChromeAlt_dbg.exe, masquerading as a Chrome debugging utility.

Simultaneously, it creates a startup shortcut at C:Users<USER>AppDataRoamingMicrosoftWindowsStart MenuProgramsStartupChromeAlt_dbg.lnk, ensuring execution persistence across system reboots.

The attack incorporates timestamp manipulation techniques, automatically modifying file creation timestamps to complicate forensic analysis.

Researchers observed the GT_NET.exe binary setting future dates as far as 2037 on generated files, potentially disrupting timeline reconstruction during incident response activities.

Registry modifications target Windows Defender’s core functionality, systematically disabling real-time scanning, behavior monitoring, and network protection features.

These changes occur at the policy level within HKLMSOFTWAREPoliciesMicrosoftWindows Defender, ensuring system-wide impact that persists through reboots and affects all user accounts.

The malware employs metadata spoofing to impersonate legitimate security products, with binaries containing falsified version information referencing SentinelOne and Avast Antivirus.

This sophisticated masquerading technique aims to reduce suspicion from both users and automated security systems that may encounter the malicious executables during routine operations.

Data exfiltration occurs through unencrypted FTP connections, enabling network monitoring solutions to capture credentials and transfer details in clear text, providing valuable intelligence for incident response teams investigating similar attacks.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.