Malware News Nextron Research: Targeted Campaign Against German-Speaking Businesses via Hiring-Themed Lures

Khushal

Khushal

Level 16
Thread author
Verified
Top Poster
Well-known
Apr 4, 2024
697
5,169
1,469
Content source
https://x.com/nextronresearch/status/2089608233728053706

Executive Summary​


Nextron Research has identified a targeted campaign leveraging hiring-themed social engineering lures to distribute malware to German-speaking businesses. The attack chain employs DLL sideloading via legitimate Microsoft binaries to establish persistence and command-and-control (C2) connectivity. The campaign demonstrates sophisticated operational security practices, including the abuse of legitimate Windows utilities to evade detection and establish backdoor access.


Campaign Overview​


Attack Vector​


The campaign delivers malicious archives containing a mixture of legitimate and malicious components. The lure content consists of fake non-disclosure agreements (NDA) documents designed to appeal to hiring managers and HR personnel. Legitimate binaries include Microsoft-signed executables such as git-credential-manager.exe and bundled SSH utilities. The malicious payload is a fake-signed gcmcore.dll file positioned for sideloading exploitation.


This hybrid approach allows threat actors to bypass initial static detection mechanisms by leveraging legitimate signed binaries while concealing the actual payload within what appears to be standard development tooling.


Technical Analysis​


Infection Chain​


The infection chain begins when a user extracts an archive containing the NDA lure document and Git credential manager tooling. The legitimate git-credential-manager.exe is executed, triggering DLL sideloading. The malicious, fake-signed gcmcore.dll is then loaded by the legitimate binary during payload injection. The gcmcore.dll executes the second-stage payload—Git.dll (tracked as "Snake Agent")—for agent deployment. Finally, Snake Agent leverages the bundled ssh.exe to establish a persistent outbound SSH tunnel to the C2 infrastructure for backdoor establishment.


DLL Sideloading Exploitation​


The threat actors exploit Windows DLL search order vulnerability by placing the malicious gcmcore.dll alongside the legitimate Git Credential Manager executable. When git-credential-manager.exe executes, it preferentially loads the local malicious DLL rather than the legitimate system library, granting the attackers code execution within the process context.


Snake Agent Capabilities​


Snake Agent operates as an SSH-based C2 agent with several observed capabilities. The agent performs system reconnaissance including basic host enumeration and system information exfiltration. It supports command execution for remote command invocation on compromised systems. SSH tunneling is leveraged through the bundled ssh.exe utility to establish persistent encrypted backdoor channels to the C2 server. The agent achieves network abstraction by eliminating the need for custom network protocol implementation, instead delegating transport to SSH.


The use of SSH for C2 communication is operationally significant—it allows the threat actors to blend malicious traffic with legitimate SSH patterns, complicating network-based detection.


Indicators of Compromise (IOCs)​


File Hashes (SHA-256)​


Lure DocumentHash: c5482d8ed604923573624e220b591427e46a9391215b438a1425ab14b508810dDescription: Fake NDA document used as social engineering lure


gcmcore.dllHash: bf4f0558b49917ba40c694e8c7e837183aa476ed6354cdb07caa8d59aaafdcdeDescription: Malicious DLL sideloaded by git-credential-manager.exe


Git.dll (Snake Agent)Hash: d14d4bc85313b7e06535197bed53c5e8dce7da5922791c9ff36183e2bca0fad7Description: Second-stage C2 agent payload


Network Indicators​


C2 ServerIndicator: 103.170.154[.]120:443Type: SSH-based command-and-control endpoint


Detection Recommendations​


File-Based Detection​


Organizations should monitor for execution of git-credential-manager.exe from non-standard directories and alert on the presence of gcmcore.dll in paths where Git Credential Manager is located. File hash detection for the provided SHA-256 indicators should be implemented across endpoint security infrastructure.


Process-Based Detection​


Monitoring should focus on ssh.exe child processes spawned by unusual parent executables, with alerts configured for outbound SSH connections to uncommon destinations, particularly on port 443. Injection or code cave modifications within legitimate Microsoft binaries should be tracked.


Network-Based Detection​


Block or monitor connections to 103.170.154[.]120:443. SSH tunneling patterns with suspicious handshake anomalies should be identified. Alert on outbound SSH traffic from systems outside traditional development environments.


Mitigation Strategies​


Email security controls should flag or quarantine archives containing development tooling from external senders, particularly those claiming to relate to hiring processes. Execution control measures must implement application whitelisting to restrict execution of git-credential-manager.exe to managed development environments. DLL sideloading prevention should deploy DLL load-order abuse mitigations such as CWE-426 controls. Network segmentation requires restricting outbound SSH from non-development systems and monitoring development environment SSH traffic for anomalies. User education programs should emphasize verification of tooling authenticity and the risks of executing unfamiliar archives from hiring-related communications.


Attribution Notes​


The campaign's focus on German-speaking businesses, sophisticated tooling abuse, and operational discipline suggest a well-resourced threat actor. The hybrid use of legitimate binaries with DLL sideloading reflects awareness of modern detection techniques.



Report Date: August 2026
Classification: Research
Nextron Research
Click to expand...
 
  • Like
Reactions: Wrecker4923, lokamoka820, rashmi and 2 others
Assessment

The report describes a plausible DLL sideloading and SSH-based C2 chain, but the claims cannot be independently confirmed from the text alone. The listed hashes, IP address, malware names, and attribution should be corroborated against the original Nextron publication or additional reputable threat-intelligence sources before being treated as verified indicators.

Important caveats

  • Do not execute the referenced files merely to validate them. Submit samples or hashes to reputable analysis services such as VirusTotal, and use isolated analysis infrastructure for any further examination.
  • The IP address should be treated as an indicator for investigation and monitoring, not as conclusive proof of compromise. Hosting and infrastructure can change or be reused.
  • A file named gcmcore.dll or Git.dll is not inherently malicious; path, hash, signing information, parent process, import behavior, and execution context are all relevant.
  • The phrase “fake-signed” should be supported by certificate-chain and signature-validation details. A file may be unsigned, improperly signed, or signed with an invalid or untrusted certificate.
  • Detection based only on git-credential-manager.exe or ssh.exe may create false positives because both can be legitimate in development environments.
  • The report date of August 2026 is future-dated relative to the current date, so its publication status and source should be checked carefully.

Recommended defensive actions

  • Search endpoint telemetry for the supplied SHA-256 values, executions of Git Credential Manager from archive, download, temporary, or user-profile directories, and unexpected gcmcore.dll files beside that executable.
  • Review process trees involving git-credential-manager.exe, Git.dll, and ssh.exe, including command lines, working directories, signatures, and network destinations.
  • Investigate outbound SSH-like traffic on port 443, while recognizing that port-based detection alone is insufficient.
  • Block or monitor the supplied address only after confirming that it is appropriate for the organization’s environment and incident-response policy.
  • If compromise is suspected, isolate the affected host, preserve relevant logs and samples, revoke potentially exposed credentials, and perform an investigation with reputable endpoint-security tooling.

The report is useful as a hypothesis and detection lead, but it should not be considered independently verified without a traceable source and corroborating telemetry.
 

You may also like...