Masquerading

Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.^[2]

Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.^[3]

AppleSeed can disguise JavaScript files as PDFs.^[4]

APT28 has renamed the WinRAR utility to avoid detection.^[5]

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.^[6]

ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.^[7]

BeaverTail has masqueraded as MiroTalk installation packages: "MiroTalk.dmg" for macOS and "MiroTalk.msi" for Windows, and has included login GUIs with MiroTalk themes.^[8]

Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.^[9]

BoomBox has the ability to mask malicious data strings as PDF files.^[10]

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.^[11]

During C0015, the threat actors named a binary file compareForfor.jpg to disguise it as a JPG file.^[12]

During C0018, AvosLocker was disguised using the victim company name as the filename.^[13]

Contagious Interview has delivered BeaverTail malware masquerading as legitimate software or applications.^{[14][15][16][17][8]} Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers.^[18]

The Dacls Mach-O binary has been disguised as a .nib file.^[19]

DarkGate can masquerade as pirated media content for initial delivery to victims.^[20]

DarkTortilla's payload has been renamed PowerShellInfo.exe.^[21]

DarkWatchman has used an icon mimicking a text file to mask a malicious executable.^[22]

Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as dump64.exe to evade detection.^[23]

EnvyScout has used folder icons for malicious files to lure victims into opening them.^[10]

FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.^[24][25]

Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.^[26]

FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.^[27]

KV Botnet Activity involves changing process filename to pr_set_mm_exe_file and process name to pr_set_name during later infection stages.^[28]

LazyScripter has used several different security software icons to disguise executables.^[29]

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.^[30]

Milan has used an executable named companycatalogue to appear benign.^[31]

NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.^[32]

Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.^[33]

NotPetya drops PsExec with the filename dllhost.dat.^[34]

OilRig has used .doc file extensions to mask malicious executables.^[35]

For Operation Dust Storm, the threat actors disguised some executables as JPG files.^[36]

During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.^[37]

PLATINUM has renamed rar.exe to avoid detection.^[38]

Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.^[39]

PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).^[40]

Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.^[41][42]

Ramsay has masqueraded as a JPG image file.^[43]

RCSession has used a file named English.rtf to appear benign on victim hosts.^[44][45]

RedLine Stealer malware has masqueraded as legitimate software such as "PDF Converter Software" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.^[46]

RTM has been delivered as archived Windows executable files masquerading as PDF documents.^[47]

Ryuk can create .dll files that actually contain a Rich Text File format document.^[48]

Saint Bot has renamed malicious binaries as wallpaper.mp4 and slideshow.mp4 to avoid detection.^[49][50]

During Salesforce Data Exfiltration, threat actors used voice calls to socially engineer victims into authorizing a modified version of the Salesforce Data Loader app.^[51]

Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.^[52]

SombRAT can use a legitimate process name to hide itself.^[53]

Storm-1811 has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.^[54]

StrelaStealer PE executable payloads have used uncommon but legitimate extensions such as .com instead of .exe.^[55]

TA551 has masked malware DLLs as dat and jpg files.^[56]

TeamTNT has disguised their scripts with docker-related file names.^[57]

TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.^[58]

The TrickBot downloader has used an icon to appear as a Microsoft Word document.^[59]

UPSTYLE has masqueraded filenames using examples such as update.py.^[60]

WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.^[61]

Windshift has used icons mimicking MS Office files to mask malicious executables.^[62] Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.^[63]

WindTail has used icons mimicking MS Office files to mask payloads.^[62]

Winter Vivern created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.^[64]

XCSSET installs malicious application bundles that mimic native macOS apps, such as Safari, by using the legitimate app’s icon and customizing the Info.plist to match expected metadata.^[65][66]

ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.^[67][68]

Anti-virus can be used to automatically quarantine suspicious files.

Audit user accounts to ensure that each one has a defined purpose.

Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).

Require signed binaries.

Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.

Use file system access controls to protect folders such as C:\Windows\System32.

Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.

Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.