SmartApeSG Attack Chain Moves from ClickFix to RAT and MeshAgent

Summary

The campaign uses ClickFix social engineering to deliver an unidentified Remote Access Trojan (RAT). After the initial compromise, attackers deploy MeshAgent on the infected Windows host to establish persistence and maintain remote access. The infection chain also relies on password-protected ZIP archives to distribute malicious components.

Investigation

The investigation included analysis of infection traffic in Wireshark and examination of fake verification pages used in the ClickFix scheme. Analysts identified an unknown RAT alongside MeshAgent running persistently on the compromised host. Suspicious file activity was primarily observed within the AppData\Local\Temp directory.

Mitigation

Organizations should use web filtering to block known malicious ClickFix landing pages and associated social engineering domains. Endpoint security controls should monitor and prevent unauthorized MeshAgent execution and suspicious binaries launched from Temp directories. Users should also be trained to recognize fake verification or error messages requesting manual script execution.

Response

If malicious activity is detected, the compromised Windows host should be isolated immediately to stop further C2 communication. Responders should perform forensic analysis of the AppData\Local\Temp directory to identify malicious files. Network logs should also be reviewed for connections to Mesh C2 infrastructure, followed by a full system hunt for unauthorized remote access tools.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access via a phishing macro. To establish a persistent remote access channel, they download a specialized tool named MeshAgent.exe. To blend in with standard user activity and evade directory-based scrutiny, they drop the file into the %TEMP% folder. They then execute the agent using a command line that explicitly includes the string “MeshAgent” to interact with their C2 infrastructure. This action is designed to trigger the specific signature-based detection rule currently in place.

• Regression Test Script:

  # Simulation script to trigger the detection of MeshAgent in Temp
  $TempPath = $env:TEMP
  $BinaryName = "MeshAgent.exe"
  $BinaryPath = Join-Path $TempPath $BinaryName
  
  # 1. Create a dummy executable (mimicking a RAT/Agent)
  # We use a simple renamed system tool to ensure it can actually 'run' for the simulation
  Copy-Item "C:WindowsSystem32cmd.exe" -Destination $BinaryPath
  
  # 2. Execute the binary with the specific strings required by the detection rule
  # The rule looks for 'MeshAgent', 'RAT', or 'C2' in the CommandLine
  Start-Process -FilePath $BinaryPath -ArgumentList "/c echo This is a MeshAgent simulation with C2 connectivity"

• Cleanup Commands:

  # Cleanup the simulation artifacts
  Remove-Item -Path "$env:TEMPMeshAgent.exe" -Force -ErrorAction SilentlyContinue