Luxembourg state workstations were targeted by a coordinated cyber-espionage campaign timed with the nation's National Day. Attackers utilized spear-phishing emails to deploy Socgholish (FakeUpdates) as an initial access broker, which subsequently loaded Amadey for persistence and StealC for credential exfiltration. The infection chain focused on harvesting administrative credentials and government metadata from public sector infrastructure. The campaign was neutralized through a global disruption operation led by Europol in collaboration with GovCERT.lu, CIRCL, and CERT-EU, resulting in the dismantling of the Amadey and StealC command-and-control (C2) infrastructure.

• Threat Campaign: State-Level Targeting

  • Strategically timed attacks coinciding with Luxembourg's National Day to maximize social engineering efficacy.
  • Targeted public sector infrastructure to gain unauthorized access to state service workstations.
  • Coordination of a multi-stage malware stack designed for simultaneous persistence and rapid data exfiltration.

• Infection Chain: Multi-Stage Payload Delivery

  • Initial access established via spear-phishing emails using deceptive, event-based lures.
  • Socgholish (FakeUpdates) deployed via fake browser update prompts, bypassing standard security filters through user-driven execution.
  • Tiered execution where Socgholish served as the primary loader for secondary specialized implants.

• Malware Analysis: Toolset Capabilities

  • Socgholish: Acted as the initial access broker, utilizing JavaScript-based loaders to establish a foothold.
  • Amadey: Provided botnet functionality, maintaining persistent C2 channels for further payload deployment.
  • StealC: Specifically engineered for the theft of administrative credentials, workstation metadata, and sensitive government files.

• Impact: Operational and Data Risks

  • Compromise of high-value administrative workstations within Luxembourg's government network.
  • High risk of unauthorized access to state documentation and sensitive internal metadata.
  • Potential for lateral movement within state networks utilizing stolen administrative credentials.

• Remediation: International Law Enforcement Action

  • Collaborative detection and analysis performed by GovCERT.lu, CIRCL, and CERT-EU.
  • Europol-led global operation to identify and seize C2 infrastructure supporting the malware families.
  • Successful neutralization of global botnet networks managing the distribution of Amadey and StealC.