In recent weeks, a sophisticated phishing operation known as the ZipLine campaign has targeted U.S.-based manufacturing firms, leveraging supply-chain criticality and legitimate-seeming business communications to deploy an advanced in-memory implant dubbed MixShell.

This threat actor reverses traditional phishing workflows by initiating contact through corporate “Contact Us” web forms, prompting victims to reach out first.

Once dialogue is established, attackers pose as potential partners and engage the target in protracted email correspondence, often spanning two weeks, before delivering a weaponized ZIP archive hosted on a trusted Platform-as-a-Service domain.

The ZIP archive conceals a malicious .lnk file and embedded PowerShell script, which obfuscates its true purpose by including harmless PDF and DOCX lure files alongside the payload.

Upon execution, the .lnk file triggers a loader that scans common directories for the archive, extracts a marker-delimited PowerShell script, and injects it directly into memory, bypassing AMSI checks by forcing AmsiUtils.amsiInitFailed = $true.

Picus Security analysts identified this memory-resident approach as a key factor in MixShell’s stealth, enabling rapid, fileless execution without touching disk.

MixShell’s custom shellcode is unwrapped in memory using reflection and the System.Reflection.Emit API, dynamically resolving Windows API functions via a custom ROR4-based hashing algorithm.

The implant’s configuration, stored immediately after the code section in an XOR-encrypted, hex-encoded block, provides DNS TXT tunnel parameters for command and control (C2).

These parameters include prepend and append markers, an XOR key, and domain information, all of which facilitate covert data exchange over DNS queries.

If DNS fails after six attempts, the implant shifts to HTTP fallback, maintaining the same encryption and framing format to blend malicious traffic with legitimate web requests.

Beyond initial execution, MixShell establishes persistence by hijacking a COM object’s TypeLib registry entry.

The PowerShell script writes a malicious XML scriptlet named Udate_Srv.sct to the ProgramData directory and points the CLSID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}—associated with Internet Explorer’s Web Browser control—to this file.

On every system restart or when Explorer.exe triggers the hijacked COM object, the scriptlet launches cmd[.]exe /K set X=1&{shortcut}, re-running the payload without further user interaction.

Infection Mechanism Deep Dive

The infection chain of ZipLine is a masterclass in social engineering and technical evasion.

Attackers first submit a form-based inquiry—often with an “AI Impact Assessment” pretext—to the target’s website. Once the victim responds, the attackers request an NDA and provide a link to a ZIP file on a legitimate Herokuapp subdomain.

Within the archive, the PowerShell script locates the embedded payload marker xFIQCV, extracts the shellcode blob, and uses in-memory methods to allocate executable pages via VirtualAlloc and invoke the payload directly.

MixShell’s ROR4 hash routine (def api_hash and def ror4) iterates over uppercase-converted API names, generating identifiers to resolve function pointers at runtime.

This dynamic resolution avoids static imports, rendering common signature-based detections ineffective.

By maintaining all malicious actions in volatile memory, MixShell leaves only minimal forensic artifacts, challenging incident responders to detect and remediate infected hosts before data exfiltration or lateral movement can occur.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New ZipLine Campaign Attacks Critical Manufacturing Companies to Deploy In-memory Malware MixShell appeared first on Cyber Security News.

A newly identified ransomware strain named Cephalus has emerged as a sophisticated threat, targeting organizations through compromised Remote Desktop Protocol (RDP) connections.

The malware, which takes its name from Greek mythology referencing the son of Hermes who tragically killed his wife with an infallible javelin, represents a concerning evolution in ransomware deployment techniques.

Cephalus distinguishes itself from other ransomware families through its unique infection methodology and sophisticated evasion tactics.

The malware operators gain initial access to target networks by exploiting RDP credentials that lack multi-factor authentication (MFA), a vulnerability that continues to plague organizations worldwide.

Once inside the network, attackers utilize the MEGA cloud storage platform for data exfiltration before deploying the ransomware payload.

The ransomware deployment mechanism involves a particularly clever approach using DLL sideloading through legitimate security software components.

Huntress analysts identified this technique during investigations of two separate incidents occurring on August 13 and August 16, 2025, where the malware successfully infiltrated organizations running legitimate SentinelOne security products.

DLL Sideloading and Execution Chain

The most technically intriguing aspect of Cephalus lies in its deployment strategy, which exploits a legitimate SentinelOne executable file called SentinelBrowserNativeHost.exe.

The ransomware operators place this legitimate binary in the user’s Downloads folder, from where it loads a malicious DLL named SentinelAgentCore.dll.

This DLL subsequently loads a file called data.bin containing the actual ransomware code, creating a multi-stage execution chain that helps evade detection.

Upon successful execution, Cephalus immediately begins system recovery prevention by running embedded commands.

The first command executed is vssadmin delete shadows /all /quiet, which eliminates volume shadow copies that could be used for file recovery.

The malware then systematically disables Windows Defender through a series of PowerShell commands that create exclusions for critical system processes and file extensions including .cache, .tmp, .dat, and .sss files.

The ransomware further modifies Windows Registry entries to disable real-time protection, behavior monitoring, and on-access protection features.

It stops and disables Windows Defender services including SecurityHealthService, Sense, WinDefend, and WdNisSvc through PowerShell commands executed with hidden window styles and bypassed execution policies.

Cephalus ransom notes contain a unique characteristic – they reference news articles about previous successful attacks, attempting to establish credibility and create urgency for victims.

The malware encrypts files with the .sss extension and creates recover.txt files containing payment instructions.

Organizations can protect themselves by implementing MFA for RDP access, monitoring for unauthorized use of legitimate security tool executables in unusual locations, and maintaining comprehensive endpoint detection capabilities.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New Cephalus Ransomware Leverages Remote Desktop Protocol to Gain Initial Access appeared first on Cyber Security News.