Attack Chain

1. Initial Compromise: A threat actor gains initial access to a victim's Windows endpoint through various means, such as spearphishing, exploiting a vulnerable service, or drive-by download.
2. Malware Deployment: The attacker deploys an information-stealing malware, such as Phantom Stealer or Stealerium, to the compromised system.
3. Credential Harvesting Initialization: The deployed info-stealer executes, beginning its reconnaissance phase for valuable credentials.
4. Targeted File Access: The info-stealer attempts to access files located within the %APPDATA%\Martin Prikryl\WinSCP 2\Configuration\Security directory, which is known to contain sensitive WinSCP credentials.
5. Credential Exfiltration: The info-stealer reads and parses the WinSCP configuration files, extracting stored SSH and FTP credentials, including passwords and private keys.
6. Data Transmission: The harvested credentials are then encoded and exfiltrated to attacker-controlled command and control (C2) infrastructure over various network protocols.
7. Unauthorized Access: Threat actors use the stolen credentials to gain unauthorized access to remote systems (e.g., servers, cloud instances) where WinSCP was configured to connect, enabling further lateral movement and data theft.

Impact

Successful exploitation of this credential theft technique can lead to severe consequences. Attackers can leverage stolen SSH and FTP credentials to gain unauthorized access to critical systems, including production servers, cloud environments, and internal networks. This access can facilitate further lateral movement, data exfiltration of sensitive intellectual property or customer data, deployment of additional malware (e.g., ransomware), and disruption of business operations. The targeted nature of WinSCP credentials implies the attacker is seeking access to specific, often high-value, remote resources configured by the user.

Recommendation

• Deploy the Sigma rule in this brief to your SIEM and tune for your environment.
• Enable Windows Security Event logging for EventCode 4663 (Object Access) on all endpoints to provide the necessary telemetry for this detection.
• Investigate any alerts generated by this rule by examining the process_name, process_path, and process_id fields, along with associated network connections.
• Review network logs and proxy logs for connections from the identified suspicious process to external or unusual IP addresses, which may indicate credential exfiltration.