A chain that bypasses Mark of the Web (MOTW) by using PackMyPayload to create an ISO.  The ISO contains a decoy PDF and a malicious executable (a Sliver agent) that when extracted will not contain MOTW.  When executed, the Sliver agent will receive a queued instruction from Operator.  Similar trust control bypass behaviour was observed in APT38 when targeting the pharmaceutical industry; ISOs were shared with decoy PDFs and backdoored PDF readers to stage malware.


APT38 Pharmaceutical Attacks

PackMyPayload is a Python tool for embedding files into an archive or container. It's used to prevent MOTW from being propagated to archived files.


Install PackMyPayload

Authors

Tactic

Test this TTP