levelblue.com • 1h
CrySome RAT: Analysis of Targeted Logistics Sector Infection Chain
LevelBlue SpiderLabs has identified a sophisticated spear-phishing campaign targeting the logistics and supply chain sectors via the deployment of the CrySome Remote Access Trojan (RAT). The attack utilizes social engineering, specifically leveraging fraudulent "rate confirmation" documents to exploit established business workflows. The infection follows a multi-stage execution flow, moving from initial document execution through various dropper payloads to establish persistent remote access. Successful compromise grants attackers high-level control over the host, enabling lateral movement and unauthorized data exfiltration within corporate networks.