Unveiling the Stealthy Memory-Only Malware Exploiting Content Delivery Networks

Introduction

On August 22, 2024, Mandiant released a detailed report on a newly discovered memory-only malware dubbed "PEAKLIGHT." This sophisticated malware employs a complex, multi-stage infection process, leveraging content delivery networks (CDNs) to distribute malicious payloads. The malware is designed to evade traditional detection methods by operating entirely within memory, making it particularly dangerous and challenging to detect. PEAKLIGHT is part of a broader malware-as-a-service (MaaS) campaign delivering infostealers such as LUMMAC.V2, SHADOWLADDER, and CRYPTBOT.

Report Overview

Mandiant's Managed Defense team identified PEAKLIGHT during investigations into anomalous network activity within a client environment. The malware was initially distributed via malicious Microsoft Shortcut Files (LNKs) embedded within ZIP archives, disguised as pirated movie files. These LNK files acted as the initial infection vector, leading to downloading a memory-only JavaScript dropper from a CDN. This dropper subsequently executed a PowerShell-based downloader, now known as PEAKLIGHT, to fetch additional payloads.

The infection process of PEAKLIGHT is highly intricate, consisting of several stages.

1. Stage 1: Movie Lures - Users were tricked into downloading ZIP files containing LNK files, which, when executed, connected to a CDN hosting an obfuscated JavaScript dropper.
2. Stage 2: JavaScript Dropper - This memory-only dropper executed a PowerShell script to download and run additional malware from remote servers.
3. Stage 3: PEAKLIGHT Downloader - The PowerShell script downloaded files from a CDN and saved them to specific directories on the infected machine. PEAKLIGHT then executed these files, which included various infostealers.
4. Stage 4: Final Payload - The downloaded files contained malware components such as LUMMAC.V2, SHADOWLADDER, and CRYPTBOT, designed to exfiltrate sensitive data from the compromised system.

The PEAKLIGHT malware poses a significant threat due to its ability to operate entirely in memory, bypassing traditional file-based detection mechanisms. Organizations infected with PEAKLIGHT are at risk of data theft, as the malware is designed to steal credentials, personal information, and other sensitive data. The use of CDNs to host the malware's payloads further complicates detection, as traffic to these networks is often considered legitimate.

Insights and Analysis

The use of memory-only techniques and trusted content delivery networks highlights cybercriminals' evolving tactics. To counter such threats, defenders must adopt advanced detection methods that monitor in-memory activity.

To mitigate the risk posed by PEAKLIGHT, organizations should implement advanced endpoint detection and response (EDR) solutions capable of monitoring in-memory activities. Regularly updating security software, conducting thorough network traffic analysis, and educating users about the dangers of downloading pirated content are critical steps in defending against this threat.

Indicators of Compromise (IOCs)

MITRE ATT&CK Mapping

References

PEAKLIGHT: Decoding the Stealthy Memory-Only Malware | Google Cloud Blog

Mandiant identified a new memory-only dropper using a complex, multi-stage infection process.

Google Cloud