SOC Prime Bias: Critical

27 Jan 2026 17:21
newspaper icon Trend Micro

Watering Hole Attack Targets EmEditor Users with Information‑Stealing Malware

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Watering Hole Attack Targets EmEditor Users with Information‑Stealing Malware
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

A trojanized EmEditor installer was leveraged to distribute a multi-stage malware chain. The compromised installer pulls PowerShell scripts from attacker-controlled domains and then fetches follow-on payloads that harvest credentials, collect host and environment details, and exfiltrate the results. The delivery mechanism aligns with a watering-hole technique, where the vendor’s download path is compromised to reach users seeking legitimate software.

Investigation

Analysis determined the MSI package was altered to run an embedded PowerShell command that contacted spoofed EmEditor-themed domains. The initial script then downloaded two additional stages responsible for anti-analysis behavior, credential theft, and system fingerprinting, before transmitting collected data to a command-and-control server. The investigation documented distinct indicators, including unique strings and specific URLs used across the execution chain.

Mitigation

Verify installer integrity using vendor code-signing validation and hash checks prior to deployment. Apply strict PowerShell controls and monitoring, and watch for behaviors associated with disabling ETW or other telemetry. Implement network filtering for the identified malicious domains and alert on anomalous outbound HTTPS activity.

Response

Hunt for the PowerShell command line referencing the malicious domains, block the associated URLs/domains, isolate impacted endpoints, and preserve forensic artifacts such as the tampered MSI. Perform a supply-chain review of the vendor distribution workflow and coordinate user notification and remediation guidance.

"graph TB %% Class definitions classDef technique fill:#ffcc99 classDef file fill:#e6e6fa classDef command fill:#add8e6 classDef server fill:#ffd700 classDef tool fill:#d3d3d3 %% Technique nodes tech_T1195["<b>Technique</b> – T1195 Supply Chain Compromise:<br/>Compromise of a software supply chain to distribute malicious payload."] class tech_T1195 technique tech_T1199["<b>Technique</b> – T1199 Trusted Relationship:<br/>Use of a trusted vendor relationship to deliver malicious content."] class tech_T1199 technique tech_T1546_016["<b>Technique</b> – T1546.016 Event Triggered Execution (Installer Packages):<br/>CustomAction in MSI runs a script when the installer is executed."] class tech_T1546_016 technique tech_T1059_001["<b>Technique</b> – T1059.001 PowerShell:<br/>Execution of PowerShell commands to download and run payloads."] class tech_T1059_001 technique tech_T1027["<b>Technique</b> – T1027 Obfuscated Files or Information:<br/>Payloads are heavily obfuscated using string manipulation and encoding."] class tech_T1027 technique tech_T1620["<b>Technique</b> – T1620 Reflective Code Loading:<br/>Malicious code is loaded into memory reflectively without touching disk."] class tech_T1620 technique tech_T1497["<b>Technique</b> – T1497 Virtualization/Sandbox Evasion:<br/>Checks for analysis environments using user activity and time based logic."] class tech_T1497 technique tech_T1218_007["<b>Technique</b> – T1218.007 System Binary Proxy Execution:<br/>Msiexec is used as a trusted binary to launch the malicious MSI."] class tech_T1218_007 technique tech_T1555_004["<b>Technique</b> – T1555.004 Credentials from Password Stores:<br/>Extraction of stored credentials from Windows Credential Manager."] class tech_T1555_004 technique tech_T1082["<b>Technique</b> – T1082 System Information Discovery:<br/>Collects OS, hardware, and software details."] class tech_T1082 technique tech_T1016_001["<b>Technique</b> – T1016.001 Internet Connection Discovery:<br/>Determines network connectivity status."] class tech_T1016_001 technique tech_T1592_002["<b>Technique</b> – T1592.002 Gather Victim Host Information (Software):<br/>Enumerates installed applications and versions."] class tech_T1592_002 technique tech_T1102["<b>Technique</b> – T1102 Web Service:<br/>Uses HTTPS web services for command and control communication."] class tech_T1102 technique tech_T1090_002["<b>Technique</b> – T1090.002 Proxy External Proxy:<br/>Traffic is routed through an external proxy server."] class tech_T1090_002 technique tech_T1070_001["<b>Technique</b> – T1070.001 Indicator Removal (Clear Windows Event Logs):<br/>Disables ETW and clears logs to hide activity."] class tech_T1070_001 technique tech_T1546_013["<b>Technique</b> – T1546.013 Event Triggered Execution (PowerShell Profile):<br/>Persistence via malicious PowerShell profile script."] class tech_T1546_013 technique tech_T1068["<b>Technique</b> – T1068 Exploitation for Privilege Escalation:<br/>Potential use of local exploits to gain higher privileges."] class tech_T1068 technique %% File, tool, command and server nodes file_msi["<b>File</b> – EmEditor.msi:<br/>Compromised MSI installer hosted on the vendor download page."] class file_msi file tool_msiexec["<b>Tool</b> – Msiexec:<br/>Windows Installer executable used to run the malicious MSI."] class tool_msiexec tool command_ps["<b>Command</b> – PowerShell:<br/>CustomAction runs PowerShell that downloads scripts via Invoke-WebRequest."] class command_ps command server_c2["<b>Server</b> – C2 HTTPS:<br/>https://cachingdrive.com/gate/init/2daef8cd"] class server_c2 server %% Connections showing attack flow tech_T1195 –>|delivers| file_msi tech_T1199 –>|downloads| file_msi file_msi –>|executed by| tool_msiexec tool_msiexec –>|triggers| tech_T1546_016 tech_T1546_016 –>|runs| command_ps command_ps –>|executes| tech_T1059_001 command_ps –>|uses obfuscation| tech_T1027 command_ps –>|loads code reflectively| tech_T1620 command_ps –>|performs sandbox checks| tech_T1497 command_ps –>|proxy execution via msiexec| tech_T1218_007 command_ps –>|extracts credentials| tech_T1555_004 command_ps –>|gathers system info| tech_T1082 command_ps –>|discovers internet connection| tech_T1016_001 command_ps –>|enumerates software| tech_T1592_002 command_ps –>|communicates with| server_c2 server_c2 –>|uses| tech_T1102 server_c2 –>|routes through| tech_T1090_002 command_ps –>|clears logs| tech_T1070_001 command_ps –>|establishes persistence| tech_T1546_013 command_ps –>|may trigger| tech_T1068 "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An adversary has compromised the official EmEditor installer package. After a victim runs the installer, the malicious binary reaches out to the hard‑coded C2 domain cachingdrive.com/gate/init/2daef8cd. This outbound request downloads a secondary payload that elevates privileges and harvests credentials. The attacker uses a standard Windows command line (cmd.exe) to launch the installer, ensuring the malicious URL appears verbatim in the process‑creation event, which matches the Sigma rule’s string‑match condition.

  • Regression Test Script:

    # --------------------------------------------------------------
# Simulated malicious execution of a compromised EmEditor installer
# --------------------------------------------------------------
$installerPath = "C:TempEmEditorSetup.exe"
$maliciousUrl   = "https://cachingdrive.com/gate/init/2daef8cd"

# Ensure the installer exists (placeholder – in a real test, copy a benign exe)
if (-not (Test-Path $installerPath)) {
    Write-Error "Installer not found at $installerPath"
    exit 1
}

# Execute the installer with the malicious argument
Write-Host "[*] Launching compromised installer..."
Start-Process -FilePath $installerPath -ArgumentList $maliciousUrl -Wait

Write-Host "[+] Execution complete. Verify that the detection rule fired."
# --------------------------------------------------------------

  • Cleanup Commands:

    # --------------------------------------------------------------
# Remove any artifacts left by the simulated test
# --------------------------------------------------------------
$installerPath = "C:TempEmEditorSetup.exe"

if (Test-Path $installerPath) {
    Remove-Item $installerPath -Force
    Write-Host "[*] Removed installer binary."
}

# (Optional) Delete downloaded payloads if they were materialized
$downloadedPath = "$env:TEMPpayload.bin"
if (Test-Path $downloadedPath) {
    Remove-Item $downloadedPath -Force
    Write-Host "[*] Removed downloaded malicious payload."
}
# --------------------------------------------------------------

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free