Operation Poseidon: Spear-Phishing Attacks Abusing Google Ads Redirection Mechanisms

Summary

Operation Poseidon is a spear-phishing campaign attributed to the Konni APT that weaponizes Google and Naver ad click-tracking/redirection URLs to deliver malicious LNK shortcut files. When opened, the LNK triggers an AutoIt loader that executes EndRAT predominantly in memory. The operation relies on compromised WordPress sites for payload hosting and command-and-control (C2) services.

Investigation

Genians Security Center reviewed the phishing email lures, embedded tracking beacons, and the end-to-end execution flow—from LNK shortcut launch to the AutoIt staging logic and in-memory EndRAT deployment. Analysts also noted infrastructure and development artefact reuse, including the domain jlrandsons.co.uk and the build path D:3_Attack WeaponAutoitBuild__Poseidon – Attackclient3.3.14.a3x.

Mitigation

Prevent execution of LNK files delivered inside ZIP archives, and scrutinize ad-click redirection chains originating from Google/Naver tracking domains. Enforce strict EDR coverage for AutoIt activity and suspicious process spawning (notably abnormal PowerShell or cmd.exe launches). Reduce infrastructure abuse by hardening and routinely patching WordPress instances to limit their use as malware distribution points.

Response

Alert on initial LNK execution events, flag AutoIt.exe runs initiated by user interaction, and monitor outbound connections to the identified C2 domains and IPs. Quarantine suspected endpoints and collect forensic artefacts, including the AutoIt script, LNK metadata, and any recovered EndRAT components, to support scoping and eradication.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An attacker crafts a malicious shortcut (malicious.lnk) that points to powershell.exe with an encoded command to download and execute a payload. The shortcut is delivered via spear‑phishing email. Upon double‑click, Windows Explorer resolves the .lnk, spawning powershell.exe as a child of the LNK process. This exact parent‑child relationship satisfies the Sigma rule’s execution_after_LNK condition.

• Regression Test Script:

  # -------------------------------------------------------------
  # Create a malicious LNK that launches PowerShell with an encoded command
  # -------------------------------------------------------------
  $WshShell = New-Object -ComObject WScript.Shell
  
  # Path where the LNK will be created (Desktop)
  $lnkPath = "$Env:UserProfileDesktopmalicious.lnk"
  
  # Target executable
  $target = "$Env:SystemRootSystem32WindowsPowerShellv1.0powershell.exe"
  
  # Example encoded command (creates a text file as a harmless indicator)
  $plainCmd = "New-Item -Path $Env:Tempposeidon_test.txt -ItemType File -Force"
  $bytes = [System.Text.Encoding]::Unicode.GetBytes($plainCmd)
  $encoded = [Convert]::ToBase64String($bytes)
  
  $arguments = "-EncodedCommand $encoded"
  
  $shortcut = $WshShell.CreateShortcut($lnkPath)
  $shortcut.TargetPath = $target
  $shortcut.Arguments = $arguments
  $shortcut.Save()
  
  Write-Host "LNK created at $lnkPath"
  
  # -------------------------------------------------------------
  # Execute the LNK to trigger the detection rule
  # -------------------------------------------------------------
  Start-Process -FilePath $lnkPath
  
  # -------------------------------------------------------------
  # Optional: pause to allow SIEM ingestion
  # -------------------------------------------------------------
  Start-Sleep -Seconds 10
  
  # -------------------------------------------------------------
  # Cleanup (remove the indicator file, the LNK, and the indicator)
  # -------------------------------------------------------------
  Remove-Item -Path "$Env:Tempposeidon_test.txt" -ErrorAction SilentlyContinue
  Remove-Item -Path $lnkPath -ErrorAction SilentlyContinue
  
  Write-Host "Cleanup completed."

• Cleanup Commands: (if the above script is not used)

  # Remove any indicator files created during the test
  Remove-Item -Path "$Env:Tempposeidon_test.txt" -ErrorAction SilentlyContinue
  
  # Delete the malicious shortcut
  $lnkPath = "$Env:UserProfileDesktopmalicious.lnk"
  Remove-Item -Path $lnkPath -ErrorAction SilentlyContinue
  
  Write-Host "Test artifacts removed."