Sophisticated Malware Targets US Accounting Firm

Uploaded on 2025-07-22 in TECHNOLOGY--Hackers, NEWS-Cybersecurity News, FREE TO VIEW

A new cyber threat has emerged, targeting a US-based certified public accounting firm with a sophisticated attack, as detailed in a recent report by the Threat Response Unit (TRU) at eSentire.

The attack deployed a novel crypter named “Ghost Crypt” to deliver the PureRAT malware, using an advanced obfuscation and a technique dubbed “Process Hypnosis.”

This campaign highlights the evolving tactics of cyber criminals and highlights the need for robust cybersecurity measures.

Deceptive Entry Point

The attack began with a cunning social engineering tactic. The threat actor, posing as a new client, sent a PDF containing a link to a Zoho WorkDrive folder hosting malicious ZIP files. To ensure execution, the attacker contacted the victim, creating urgency by requesting immediate extraction and execution of the file. The ZIP archive contained a disguised executable with a double extension (.pdf.exe) and a renamed DLL, which, when executed, decrypted and injected PureRAT into the legitimate Windows binary csc.exe.

This deceptive approach exemplifies the growing reliance on social engineering to bypass initial security defences.

Ghost Crypt: A New Crypter on the Block

Ghost Crypt, advertised on Hackforums since April 2025, is a crypter designed to evade major antivirus solutions. It employs a custom variant of the ChaCha20 encryption algorithm and supports sideloading of both EXE and DLL files. The crypter’s primary function is to obfuscate and deliver malicious payloads, making detection challenging. In this attack, Ghost Crypt facilitated the injection of PureRAT, a Remote Access Trojan (RAT) first observed in January 2023, which has seen a surge in infections throughout 2025.

The crypter’s ability to bypass security measures demonstrates its appeal to cyber criminals.

Process Hypnosis: Stealthy Injection Technique

The attack’s standout feature was the use of “Process Hypnosis,” a novel injection method that enhances stealth. The malware initiates by calling the CreateProcessW API with the DEBUG_ONLY_THIS_PROCESS flag, opening the target process in debug mode to prevent external debugging. It then uses VirtualAllocEx to allocate memory with Read, Write, and Execute (RWX) permissions, writing the PureRAT payload into the csc.exe process using WriteProcessMemory. The technique culminates with SetThreadContext to redirect the main thread’s entry point to the PureRAT loader, followed by DebugActiveProcessStop to resume execution.

This method effectively cloaks the malware, complicating detection by security tools.

PureRAT’s Malicious Capabilities

PureRAT, the successor to PureHVNC, is marketed by the underground vendor PureCoder and distributed via an automated Telegram channel, @ThePureBot. The malware targets sensitive data, scanning for cryptocurrency wallets like Ledger Live, Exodus, and Atomic Wallet, as well as browser extensions and messaging apps like Telegram.

Once installed, it establishes persistence through registry key entries and communicates with command-and-control (C2) servers to exfiltrate system details, user data, and hardware fingerprints. PureRAT’s ability to await further instructions, including plugin deployment, enhances its versatility, making it a potent tool for data theft and system compromise.

An Evolving Threat

The attack reflects broader trends in the cyber crime ecosystem. PureCoder, previously known for PureHVNC, has integrated its features into PureRAT, which is now their flagship offering. The malware is packed with .NET obfuscators like Eazfuscator.NET and .NET Reactor, using AES-256 and GZIP compression for added evasion. Additionally, the campaign leveraged legitimate software, such as Haihaisoft’s hpreader.exe, for DLL sideloading, highlighting the challenge of distinguishing benign tools from malicious ones.

The use of direct memory injection and API calls like SetThreadExecutionState to prevent system sleep further demonstrates the attack’s sophistication.

Defensive Measures

eSentire recommends several countermeasures to combat such threats.

Organisations should deploy Endpoint Detection and Response (EDR) solutions to detect and contain malicious activities.

Regular employee training on recognising social engineering tactics, such as urgent requests from unfamiliar sources, is crucial.

Additionally, implementing multi-factor authentication, restricting access to commands like osascript, and using Next-Gen Antivirus (NGAV) can bolster defences. eSentire’s PureCrypterPunisher tool aids in unpacking and analysing Pure Crypter samples, offering security teams valuable insights.

This attack demontrates the growing complexity of cyber threats, with tools like Ghost Crypt and PureRAT exploiting both technical vulnerabilities and human trust. As cybercriminals refine their tactics, businesses must prioritise proactive cybersecurity to safeguard sensitive data and maintain operational integrity.

eSentire | eSentire | InfoSecurity Magazine |

Image: Xavier Cee

You Might Also Read:

Hackers Use Windows Backdoor To Deliver BadSpace:

If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.