PoisonX ドライバー ベースの攻撃キャンペーンが日本の組織を標的に

“graph TB %% Class definitions classDef action fill:#ffcc99 classDef tool fill:#99ff99 classDef malware fill:#ff9966 classDef process fill:#ccccff %% Nodes email[“Tool – Name: Phishing Email
Description: Targeted email with malicious Google Cloud Storage link”] class email tool initial_access_phishing[“Action – T1566.002 Spearphishing Link
Attacker sends email containing a link to a malicious LNK or EXE file”] class initial_access_phishing action lNK_file[“Tool – Name: Malicious LNK Shortcut
Description: Shortcut that runs curl.exe to fetch the dropper”] class lNK_file tool curl_download[“Process – Name: curl.exe
Action: Downloads PXDropper payload from the remote server”] class curl_download process pxdropper[“Malware – Name: PXDropper
Description: Dropper that sets up persistence and prepares privilege escalation”] class pxdropper malware persistence_service[“Action – T1547.009 Shortcut Modification
Creates or modifies a shortcut to achieve autostart”] class persistence_service action registry_run[“Action – T1547.001 Registry Run Keys/Startup Folder
Adds a Run registry entry for automatic execution”] class registry_run action service_creation[“Action – T1543.003 Create or Modify System Process: Windows Service
Installs a Windows service to run the dropper at boot”] class service_creation action priv_esc_exploit[“Action – T1068 Exploitation for Privilege Escalation
Exploits a vulnerability to load a signed driver”] class priv_esc_exploit action driver_install[“Malware – Name: PoisonX Driver
Description: Signed kernel driver loaded as a service (BYOVD)”] class driver_install malware kernel_privilege[“Action – T1547.006 Boot or Logon Autostart Execution
Kernel driver grants SYSTEMu2011level privileges”] class kernel_privilege action defense_evasion[“Action – T1497.001 Virtualization/Sandbox Evasion
Performs checks for analysis environments”] class defense_evasion action rootkit[“Action – T1014 Rootkit
Hooks kernel APIs to hide processes and network traffic”] class rootkit action discovery_process[“Action – T1057 Process Discovery
Enumerates running processes on the host”] class discovery_process action discovery_security[“Action – T1518.001 Security Software Discovery
Detects installed security products”] class discovery_security action defense_impair[“Action – Defense Impairment
Uses driver IOCTL commands to terminate security product processes”] class defense_impair action c2_ratat[“Malware – Name: 10FXRAT
Description: Remote access tool that creates an internal SOCKS5 proxy”] class c2_ratat malware c2_communication[“Action – T1219 Remote Access Tools
Establishes encrypted C2 channel with the attacker”] class c2_communication action proxy_setup[“Action – T1090 Proxy
Sets up internal SOCKS5 tunnel for traffic forwarding”] class proxy_setup action additional_mods[“Action – Additional Capabilities
Modular plugins provide keylogging, credential theft, and cryptou2011wallet harvesting”] class additional_mods action %% Connections showing the attack flow email –>|delivers| initial_access_phishing initial_access_phishing –>|provides| lNK_file lNK_file –>|executes| curl_download curl_download –>|downloads| pxdropper pxdropper –>|creates| persistence_service persistence_service –>|registers| service_creation service_creation –>|runs| pxdropper pxdropper –>|adds| registry_run pxdropper –>|uses| priv_esc_exploit priv_esc_exploit –>|installs| driver_install driver_install –>|grants| kernel_privilege kernel_privilege –>|enables| rootkit rootkit –>|performs| defense_evasion rootkit –>|performs| discovery_process rootkit –>|performs| discovery_security discovery_process –>|enables| defense_impair pxdropper –>|drops| c2_ratat c2_ratat –>|uses| c2_communication c2_communication –>|establishes| proxy_setup proxy_setup –>|supports| additional_mods

攻撃フロー