Media Company CloudZ RAT potentially steals OTP messages using Pheno plugin

Summary

Cisco Talos identified an intrusion in which attackers deployed the CloudZ remote access trojan together with a custom plugin called Pheno. The activity targets Windows 10 and 11 systems that rely on Microsoft Phone Link to synchronize with mobile devices. By abusing the Phone Link bridge on the workstation, the attackers can access SMS content and one-time password messages without placing malware directly on the phone itself. The infection chain uses a Rust-based dropper, a .NET loader, scheduled-task persistence, and several payload delivery methods.

Investigation

Talos traced the intrusion to a fake ScreenConnect update that delivered a Rust-compiled loader named systemupdates.exe or Windows-interactive-update.exe. That loader decrypted and dropped a .NET component, which then installed CloudZ RAT through a scheduled task that launched regasm.exe. After installation, CloudZ retrieved the Pheno plugin from a staging server and used it to access data stored in the Phone Link SQLite database. Investigators also identified command-and-control infrastructure, including the IP address 185.196.10.136 and multiple malicious domains tied to the campaign.

Mitigation

Cisco Talos noted that ClamAV detections such as Win.Packed.Msilheracles and Win.Trojan.CloudZRAT, along with Snort rules 66408–66410 and 301492, can help identify the threat. Blocking the known malicious domains and IP address, while restricting execution of unsigned binaries from locations such as ProgramData, can help stop the loader chain. Organizations can also reduce exposure by disabling or closely monitoring Microsoft Phone Link and by enforcing least privilege over scheduled task creation and execution.

Response

If this activity is detected, isolate the affected host immediately and collect memory and disk images for forensic analysis. Investigators should confirm the presence of the SystemWindowsApis scheduled task and any CloudZ-related binaries, then remove them from the system. The identified command-and-control infrastructure should be blocked, and potentially exposed credentials should be reset, especially where OTP-based authentication may have been intercepted. A broader system review should also examine other persistence methods and audit PowerShell and regasm.exe activity for related abuse.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The attacker has compromised a low‑privilege user account and wishes to establish persistence while confirming that the CloudZ .NET loader is active. They:

  1. Create a scheduled task that launches a PowerShell script (C:Tempcloudz.ps1).
  2. Immediately execute the task with schtasks /run to ensure the script runs.
  3. Inside the script, enumerate all processes using Get‑CimInstance Win32_Process to test for the .NET loader presence.
  4. The PowerShell process and the schtasks command both produce Sysmon EventID 1 records whose CommandLine fields contain the exact strings the rule watches, causing an alert.

• Regression Test Script:

  #-------------------------------------------------
  # CloudZ‑style persistence & verification script
  #-------------------------------------------------
  $taskName = "CloudZ_Persistence"
  $scriptPath = "C:Tempcloudz.ps1"
  
  # 1️⃣ Write the PowerShell payload that queries processes
  @"
  # CloudZ payload – process enumeration
  Get-CimInstance Win32_Process | Out-Null
  "@ | Set-Content -Path $scriptPath -Encoding ASCII
  
  # 2️⃣ Register a scheduled task that runs the payload
  $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$scriptPath`""
  $trigger = New-ScheduledTaskTrigger -AtLogOn
  Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Force
  
  # 3️⃣ Immediately run the task (generates schtasks /run)
  schtasks /run /tn "$taskName"
  
  # 4️⃣ Short pause to allow logging
  Start-Sleep -Seconds 5

• Cleanup Commands:

  # Remove scheduled task
  Unregister-ScheduledTask -TaskName "CloudZ_Persistence" -Confirm:$false
  
  # Delete the payload script
  Remove-Item -Path "C:Tempcloudz.ps1" -Force
  
  # Optionally stop Sysmon (restore original config) if needed
  # & "$env:ProgramFilesSysinternalsSysmon.exe" -u