Veil#Drop Attacks Deploy PureLog Info Stealer via Blogspot & PowerShell

Veil#Drop: A Fileless Information Stealer Campaign Leveraging Blogspot and PowerShell

Runtime Rebel analysts highlight a concerning campaign dubbed “Veil#Drop,” identified by Securonix, which employs a sophisticated framework to deliver the PureLog information stealer. This threat is particularly insidious due to its abuse of legitimate services like Blogspot, extensive use of PowerShell, and fileless execution techniques, all designed to bypass traditional security defenses. Understanding the mechanics of Veil#Drop is crucial for security professionals seeking to fortify their environments against advanced persistent threats.

Overview of Veil#Drop Attacks PureLog Information Stealer

According to SecurityWeek, the Veil#Drop framework orchestrates a multi-stage attack that begins with an initial compromise, typically involving legitimate but compromised websites. These sites serve as initial redirectors or hosts for malicious scripts that initiate the infection chain. A key characteristic of Veil#Drop is its reliance on Blogspot, Google’s blogging service, to host intermediary payloads. This strategic choice helps attackers blend malicious traffic with legitimate web activity, complicating detection efforts by network security appliances.

The ultimate goal of Veil#Drop is the deployment of PureLog, a potent information stealer designed to exfiltrate sensitive data from compromised systems. PureLog targets credentials, browser data, and other confidential information, posing a significant risk to organizational data integrity and user privacy. The campaign’s emphasis on fileless techniques underscores a broader trend in malware development, where adversaries strive to minimize disk-based artifacts to evade endpoint detection and response (EDR) solutions.

Technical Analysis: Blogspot Hosted Malware Delivery and Evasion

The infection chain for Veil#Drop typically unfolds in several stages. Initial access likely occurs through methods such as malvertising, drive-by downloads from compromised legitimate sites, or phishing attacks. Once an initial foothold is established, the attack leverages PowerShell extensively. PowerShell, a powerful scripting language built into Windows, is abused to execute malicious code directly in memory without writing it to disk. This constitutes the core of its fileless methodology.

Attackers use Blogspot as a critical component for payload staging and delivery. Rather than hosting the final payload directly on a suspicious domain, Veil#Drop operators store encrypted or obfuscated scripts on Blogspot pages. These scripts are then retrieved by the initial PowerShell execution on the victim’s machine. This technique presents challenges for traditional threat intelligence feeds, as Blogspot is a widely trusted domain, making it harder to flag as malicious. This method of Blogspot hosted malware delivery serves to mask the true origin of the malicious code and provides a resilient infrastructure for command and control (C2) activities, even if indirectly.

Further, the use of PowerShell enables various evasion tactics. Malicious scripts can be highly obfuscated, dynamically decrypting and executing subsequent stages of the attack. This approach allows the malware to circumvent signature-based antivirus solutions. The final stage involves the in-memory execution of the PureLog information stealer, which then proceeds to collect data. The TTPs observed align with several MITRE ATT&CK techniques, including Execution (T1059.001 PowerShell), Defense Evasion (T1027 Obfuscated Files or Information, T1055 Process Injection), and Command and Control (T1102 Web Service).

Actionable Recommendations: Detecting Fileless PowerShell Malware and Strengthening Defenses

Defending against sophisticated campaigns like Veil#Drop requires a multi-layered approach focusing on prevention, detection, and response. Prioritizing robust endpoint visibility and control is paramount.

• Enhance PowerShell Logging: Enable and diligently review PowerShell script block logging, module logging, and transcription. This provides invaluable forensic data on PowerShell execution and helps in detecting fileless PowerShell malware behavior. Integrate these logs into your SIEM for centralized analysis and alerting.
• Implement Advanced EDR Solutions: Deploy EDR platforms capable of behavioral analysis, memory forensics, and script analysis. These tools can identify anomalous PowerShell activity, detect in-memory injection techniques, and flag suspicious processes even when no files are written to disk.
• Strengthen Application Control: Utilize application whitelisting solutions (e.g., AppLocker, Windows Defender Application Control) to restrict the execution of unauthorized scripts and executables, especially for PowerShell. Allow only digitally signed or approved scripts to run.
• Network Monitoring and DNS Filtering: Monitor network traffic for suspicious connections, particularly unusual outbound connections to public blogging platforms or uncharacteristic data exfiltration patterns. Implement DNS filtering to block known malicious domains and categorize access to high-risk services.
• User Awareness Training: Educate users about the dangers of phishing, social engineering, and the risks associated with clicking on unknown links or downloading attachments from untrusted sources. Many sophisticated attacks still rely on user interaction for initial access.
• Principle of Least Privilege and Zero Trust: Adhere to the principle of least privilege for all users and services. Implement a Zero Trust architecture, continuously verifying every user and device accessing resources, regardless of their location.
• Regular Security Audits: Conduct regular audits of all public-facing web properties and review website content management systems for signs of compromise, ensuring they are patched and configured securely.