Inside TAG-150’s Evolving Tradecraft with DinDoor, DenoRAT, and NightshadeC2

Summary

TAG-150 is using a sophisticated multi-stage intrusion chain built around Deno-based malware. The campaign relies on ClickFix-style social engineering to trigger execution of an MSI installer, which then deploys DinDoor, DenoRAT, and ultimately NightshadeC2. By leveraging the Deno runtime, the attackers gain advanced remote access and information-stealing capabilities.

Investigation

eSentire’s Threat Response Unit disrupted a ClickFix-style command inside a finance customer’s environment. The investigation uncovered an infection sequence that began with a Windows Run prompt command, followed by an AI-generated PowerShell stage, Griffin20.ps1, used to install the Deno runtime. Later stages involved DinDoor, DenoRAT, and a Python-based in-memory loader that delivered the NightshadeC2 RAT.

Mitigation

Organizations should consider disabling the Windows Run prompt through Group Policy Objects where operationally feasible. Implementing a strong phishing and security awareness training program is also recommended to reduce the success of ClickFix-style lures. Deploying next-generation antivirus or endpoint detection and response solutions is essential for visibility, detection, and containment.

Response

If this activity is detected, the affected host should be isolated immediately to contain the infection chain. Organizations should engage a 24/7 managed detection and response provider or an equivalent incident response team to support rapid containment and full remediation. Ongoing monitoring for the identified Deno-based malware components is also advised.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully established a foothold on a Windows host and is attempting to activate their DenoRAT beacon. To evade traditional signature-based EDR, the malware uses “Living-off-the-Land” network patterns, communicating via standard HTTP/S. The malware will attempt to check-in with the C2 server by sending GET requests to the specific endpoints /user and /message-event. This simulation mimics the beaconing behavior to verify that the SOC’s detection logic triggers when these specific strings appear in the web access logs.

• Regression Test Script:

    # DenoRAT C2 Beacon Simulation Script
    # This script simulates the specific HTTP GET requests used by DenoRAT to trigger the detection rule.
  
    $C2_URL = "http://localhost" # Replace with your local testing web server address
    $Endpoints = @("/user", "/message-event")
  
    Write-Host "[+] Starting DenoRAT C2 Simulation..." -ForegroundColor Cyan
  
    foreach ($Endpoint in $Endpoints) {
        $Target = $C2_URL + $Endpoint
        Write-Host "[*] Simulating C2 Check-in to: $Target" -ForegroundColor Yellow
        try {
            # Executing the GET request
            $Response = Invoke-WebRequest -Uri $Target -Method Get -ErrorAction SilentlyContinue
            Write-Host "[+] Request Sent. Status Code: $($Response.StatusCode)" -ForegroundColor Green
        }
        catch {
            # We expect a 404 if the endpoints don't actually exist, which is fine for testing telemetry
            Write-Host "[!] Request Sent (Expected 404/Connection Error): $_" -ForegroundColor Gray
        }
        Start-Sleep -Seconds 2
    }
  
    Write-Host "[+] Simulation Complete." -ForegroundColor Cyan

• Cleanup Commands:

    # No persistent changes are made by the simulation script.
    # To clean up web server logs if necessary (Caution: This deletes logs!):
    # Remove-Item -Path "C:inetpublogsLogFilesW3SVC1*.log" -Force
    Write-Host "[+] Cleanup: No persistent artifacts were created." -ForegroundColor Green