ThreatLabz has identified a new PhantomStealer variant that contains code to perform file encryption in addition to credential theft. The ransomware feature is configured at build time and uses 256-bit AES in CBC mode. Unlike most ransomware families, the AES parameters are not locally encrypted with an asymmetric algorithm. Instead, this PhantomStealer variant uploads the encryption parameters including the AES key, IV, and an HMAC to a preconfigured FTP server. This campaign is targeting corporate users through business-themed spear phishing emails. The infection chain begins with a malicious ZIP attachment containing an obfuscated JSE file that downloads a second-stage PowerShell script. The script loads PhantomStealer in memory (without touching the disk) to evade antivirus and endpoint detections. The following IOCs are associated with this campaign: Payload URL: cns-fl[.]com/dv/secured_stub.ps1 C2 mail server: mail.trimnt[.]com Email accounts: phan@trimnt[.]com and phan2@trimnt[.]com SHA256 file hashes: 3b366ac5bae87508a67dc2a4c6c452aecc6e3af54210eef77f9d9d1a3d18a9ed (JSE) C01086d1963c687ece7cb41e9e96e6700b0b4b60483187a37011144f4ac5f756 (JSE) 94285e38119a565200acfed9454d68f70f31a58701633ac2f45c844024a568ad (zip) Cbb573d028ee4b2550568e76b5e651ab33168bc7a4ecb41a26585d6804aeabd2 (zip) 97d58b8fc012ccf58865d0fff86a732034618e490d9be5f3bc7e54c154661f20 (zip) 854075c837e5e9698ded7f09ca416a40b12410a7b78bfaa29adef92a18a97545 (tar) 1eca9708f836b9126c408fdd1b3c88b6f7292c23953a87d5259e37cd2c647ab5 (ps1) 21d5da881572ecf5a28d27640091617a591f89f395a1a3b6154de440964832bb (dll) 0336799b651f55b0ff0c9561509db6e66a5a6b160c9e38c885f8e3367ce94522 (exe)