New Threat Actor using Serpent Backdoor attacking French Entities

For a detailed advisory, download the pdf file here

Threat actors are using a new backdoor called Serpent through macro-enabled Microsoft Word documents attacking French entities in sectors such as construction and government. Using this backdoor the attacker could potentially enable remote administration, command & control (C2), data theft or even deliver other additional payloads.

The threat actor targets organizations using phishing mails attached with a macro-enabled Microsoft Word document masquerading as information relating to the European Union’s General Data Protection Regulations (GDPR). Once the macros are enabled in the Microsoft Word, it executes a PowerShell script hidden in an image. The PowerShell script downloads, installs, and updates the Chocolatey installer package and repository script. Now Chocolatey installs Python including several packages and dependencies. Another image file encoded with a Python script is downloaded and saves the Python file as MicrosoftSecurityUpdate.py. The script then creates and executes a .bat file that in turn executes the Python script. The attack chain ends with a command to a shortened URL which redirects to the Microsoft Office help website.

The MITRE TTPs commonly seen are:

TA0011: Command and Control

TA0003: Persistence

TA0009: Collection

TA0005: Defense Evasion

T1027: Obfuscated Files or Information

T1070: Indicator Removal on Host

T1090: Proxy

T1137: Office Application Startup

T1213: Data from Information Repositories

T1573: Encrypted Channel

Indicators of Compromise (IoCs)

Reference