- Joined
- Jan 22, 2026
- Messages
- 101
- Reaction score
- 943
Hackers are jamming Windows Defender with deception.
Researchers have documented a multi-stage phishing campaign targeting users in Russia. The attacks use two types of malware at once: the ransomware cryptographer and the remote access Trojan Amnesia RAT. The study was published by the Fortinet FortiGuard Labs laboratory.
The attack begins with emails disguised as regular business correspondence. Victims are sent "working" documents designed so that they look routine and do not arouse suspicion. Inside there are scripts and decoy files that distract the user's attention with fake tasks or messages "from the boss" while malicious processes are running unnoticed in the system.
One of the features of the campaign is the architecture of the load delivery. Different cloud services are used for different stages. Scripts are distributed via GitHub, and binary files are downloaded from Dropbox. This separation makes it more difficult to block the infrastructure and makes the attack more resistant to attempts to disable servers and storage.
Another characteristic detail that Fortinet points out is the use of the defendnot tool to disable Microsoft Defender. Defendnot was published last year by a researcher named es3n1n and was originally conceived as a demo project. It allows you to trick Windows Security Center into believing that another antivirus is already installed on your computer. As a result, Microsoft Defender is automatically disabled to avoid conflicts with supposedly third-party security software.
Malicious files are distributed through ZIP archives, which contain several decoy documents and a malicious Windows shortcut (LNK) with a Russian-language file name. A double extension is used, for example, "Assignment for the Book_02 of the .txt.lnk Department", which makes the file look like a regular text document.
When the shortcut is opened, the PowerShell command is run, which downloads the following script from the GitHub repository at github[.]com/Mafin111/MafinREP111. This script acts as the first loader: it is fixed in the system, prepares the environment to hide traces of activity and transfers control to the next stages of the attack.
First, it programmatically hides the PowerShell window so that the user does not see that something is running. Then a fake text document is created in the application's local data directory, which opens automatically on the screen. While the victim is reading the bait, the script sends a notification to the attack operator via the Telegram Bot API that the first stage has been successfully completed. This is followed by a pause of 444 seconds, and then a Visual Basic Script named "SCRRC4ryuk.vbe" is loaded and run, hosted in the same repository.
This approach makes the loader minimalistic and allows operators to change the payload without rebuilding the entire infection chain. Visual Basic Script is heavily obfuscated and works as a control module. It builds the next stage directly in memory, without writing files to disk. This reduces the chances of detection by antiviruses and monitoring tools.
The final script checks whether it is running with elevated privileges. If not, it starts cyclically displaying the User Account Control (UAC) window, forcing the user to grant administrator rights. There is a 3-second pause between attempts.
Next, a series of actions is launched to clean up the system and prepare for the deployment of the main load: – Microsoft Defender sets up exceptions for the ProgramData, Program Files, Desktop, Downloads and system temporary folder directories so that the antivirus does not scan them – additional Defender protection components are disabled via PowerShell – deploy defendnot, which registers a fake antivirus in Windows Security Center and it forces Defender to shut down completely. – The environment is being explored, including covert filming of the screen through .A NET module with GitHub that takes screenshots every 30 seconds, saves them to PNG and sends them via a Telegram bot - Windows administrative and diagnostic tools are disabled through registry changes – file association interception is implemented, in which opening files with certain extensions results in a message with instructions on how to contact the attacker. via messenger.
After disabling protection and recovery mechanisms, the main Trojan Amnesia RAT (file "svchost.scr") is downloaded from Dropbox to the system. It is a full-fledged remote management and data theft tool. It collects information from browsers, crypto wallets, Discord, Steam, and Telegram, extracts system data, takes screenshots, receives images from a webcam, records audio from a microphone, reads the clipboard, and monitors active windows.
Amnesia RAT allows you to remotely control the system: view and terminate processes, execute shell commands, download and launch new malicious files. Data is mainly transmitted over HTTPS via the Telegram Bot API. Large amounts of information can be uploaded to third-party file sharing sites, such as GoFile, and download links are transmitted to the attacker via Telegram.
In fact, the Trojan provides credential theft, session interception, financial fraud, and constant information collection, turning the infected system into a tool for further attacks and account compromise.
The second payload is an extortionate cryptographer based on the Hakuna Matata family. It encrypts documents, archives, images, media files, source code, and application files. Before starting encryption, the malware terminates processes that may interfere with it. Additionally, it monitors the clipboard and replaces the addresses of crypto wallets with those controlled by the attackers, redirecting funds transfers. The final stage of infection is the deployment of WinLocker, which blocks the user's work with the system.
Fortinet notes that the entire attack chain is built without exploiting software vulnerabilities. Attackers use standard Windows functions, administrative tools, and security policy mechanisms, consistently disabling protection and deploying surveillance and destructive modules.
Microsoft, in response to the abuse of defendnot, recommends enabling Tamper Protection to prevent unauthorized changes to Defender settings, as well as monitoring suspicious Windows Security Center API calls and changes to security services.
At the same time, researchers are also detecting other phishing campaigns against Russian organizations. Since November 2025, the UNG0902 group has been conducting Operation DupeHike, aimed at human resources, accounting and administrative divisions of companies. The attacks use the DUPERUNNER implant, which downloads the AdaptixC2 management framework. ZIP archives with LNK files and baits on bonus topics and internal financial regulations are sent to victims. After launching the malicious file, the system accesses an external server, shows a fake PDF document, and performs system profiling and loading of the control module in the background.
The Paper Werewolf group (also known as GOFFEE) has also been active in recent months. Her campaigns use AI-generated decoys and DLL files designed as Excel XLL add-ons. They distribute the EchoGather backdoor, which collects information about the system, connects to the management server, and supports command execution and file transfer over HTTP(S) using the WinHTTP API.
Collectively, these campaigns show a steady trend: phishing in the Russian segment is increasingly based not on technical vulnerabilities, but on social engineering, multi-stage download chains, and abuse of legitimate operating system mechanisms.
Researchers have documented a multi-stage phishing campaign targeting users in Russia. The attacks use two types of malware at once: the ransomware cryptographer and the remote access Trojan Amnesia RAT. The study was published by the Fortinet FortiGuard Labs laboratory.
The attack begins with emails disguised as regular business correspondence. Victims are sent "working" documents designed so that they look routine and do not arouse suspicion. Inside there are scripts and decoy files that distract the user's attention with fake tasks or messages "from the boss" while malicious processes are running unnoticed in the system.
One of the features of the campaign is the architecture of the load delivery. Different cloud services are used for different stages. Scripts are distributed via GitHub, and binary files are downloaded from Dropbox. This separation makes it more difficult to block the infrastructure and makes the attack more resistant to attempts to disable servers and storage.
Another characteristic detail that Fortinet points out is the use of the defendnot tool to disable Microsoft Defender. Defendnot was published last year by a researcher named es3n1n and was originally conceived as a demo project. It allows you to trick Windows Security Center into believing that another antivirus is already installed on your computer. As a result, Microsoft Defender is automatically disabled to avoid conflicts with supposedly third-party security software.
Malicious files are distributed through ZIP archives, which contain several decoy documents and a malicious Windows shortcut (LNK) with a Russian-language file name. A double extension is used, for example, "Assignment for the Book_02 of the .txt.lnk Department", which makes the file look like a regular text document.
When the shortcut is opened, the PowerShell command is run, which downloads the following script from the GitHub repository at github[.]com/Mafin111/MafinREP111. This script acts as the first loader: it is fixed in the system, prepares the environment to hide traces of activity and transfers control to the next stages of the attack.
First, it programmatically hides the PowerShell window so that the user does not see that something is running. Then a fake text document is created in the application's local data directory, which opens automatically on the screen. While the victim is reading the bait, the script sends a notification to the attack operator via the Telegram Bot API that the first stage has been successfully completed. This is followed by a pause of 444 seconds, and then a Visual Basic Script named "SCRRC4ryuk.vbe" is loaded and run, hosted in the same repository.
This approach makes the loader minimalistic and allows operators to change the payload without rebuilding the entire infection chain. Visual Basic Script is heavily obfuscated and works as a control module. It builds the next stage directly in memory, without writing files to disk. This reduces the chances of detection by antiviruses and monitoring tools.
The final script checks whether it is running with elevated privileges. If not, it starts cyclically displaying the User Account Control (UAC) window, forcing the user to grant administrator rights. There is a 3-second pause between attempts.
Next, a series of actions is launched to clean up the system and prepare for the deployment of the main load: – Microsoft Defender sets up exceptions for the ProgramData, Program Files, Desktop, Downloads and system temporary folder directories so that the antivirus does not scan them – additional Defender protection components are disabled via PowerShell – deploy defendnot, which registers a fake antivirus in Windows Security Center and it forces Defender to shut down completely. – The environment is being explored, including covert filming of the screen through .A NET module with GitHub that takes screenshots every 30 seconds, saves them to PNG and sends them via a Telegram bot - Windows administrative and diagnostic tools are disabled through registry changes – file association interception is implemented, in which opening files with certain extensions results in a message with instructions on how to contact the attacker. via messenger.
After disabling protection and recovery mechanisms, the main Trojan Amnesia RAT (file "svchost.scr") is downloaded from Dropbox to the system. It is a full-fledged remote management and data theft tool. It collects information from browsers, crypto wallets, Discord, Steam, and Telegram, extracts system data, takes screenshots, receives images from a webcam, records audio from a microphone, reads the clipboard, and monitors active windows.
Amnesia RAT allows you to remotely control the system: view and terminate processes, execute shell commands, download and launch new malicious files. Data is mainly transmitted over HTTPS via the Telegram Bot API. Large amounts of information can be uploaded to third-party file sharing sites, such as GoFile, and download links are transmitted to the attacker via Telegram.
In fact, the Trojan provides credential theft, session interception, financial fraud, and constant information collection, turning the infected system into a tool for further attacks and account compromise.
The second payload is an extortionate cryptographer based on the Hakuna Matata family. It encrypts documents, archives, images, media files, source code, and application files. Before starting encryption, the malware terminates processes that may interfere with it. Additionally, it monitors the clipboard and replaces the addresses of crypto wallets with those controlled by the attackers, redirecting funds transfers. The final stage of infection is the deployment of WinLocker, which blocks the user's work with the system.
Fortinet notes that the entire attack chain is built without exploiting software vulnerabilities. Attackers use standard Windows functions, administrative tools, and security policy mechanisms, consistently disabling protection and deploying surveillance and destructive modules.
Microsoft, in response to the abuse of defendnot, recommends enabling Tamper Protection to prevent unauthorized changes to Defender settings, as well as monitoring suspicious Windows Security Center API calls and changes to security services.
At the same time, researchers are also detecting other phishing campaigns against Russian organizations. Since November 2025, the UNG0902 group has been conducting Operation DupeHike, aimed at human resources, accounting and administrative divisions of companies. The attacks use the DUPERUNNER implant, which downloads the AdaptixC2 management framework. ZIP archives with LNK files and baits on bonus topics and internal financial regulations are sent to victims. After launching the malicious file, the system accesses an external server, shows a fake PDF document, and performs system profiling and loading of the control module in the background.
The Paper Werewolf group (also known as GOFFEE) has also been active in recent months. Her campaigns use AI-generated decoys and DLL files designed as Excel XLL add-ons. They distribute the EchoGather backdoor, which collects information about the system, connects to the management server, and supports command execution and file transfer over HTTP(S) using the WinHTTP API.
Collectively, these campaigns show a steady trend: phishing in the Russian segment is increasingly based not on technical vulnerabilities, but on social engineering, multi-stage download chains, and abuse of legitimate operating system mechanisms.
𝗨𝗦𝗔 , 𝗘𝗥𝗢𝗨𝗣𝗘 & 𝗔𝗦𝗜𝗔 . 𝗝𝘂𝘀𝘁 𝗳𝗶𝗻𝗱 𝗮 𝗻𝗲𝗮𝗿𝗯𝘆 𝗔𝗧𝗠 𝗮𝗻𝗱 𝗵𝗼𝗹𝗹𝗮 𝗮𝘁 𝗺𝗲 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗰𝗹𝗼𝗻𝗲 𝗰𝗮𝗿𝗱
