From Phishing to Persistence: A CrySome RAT Infection Chain Analysis

This report details a targeted spear-phishing campaign that used a fake logistics rate confirmation to deliver a multi-stage infection chain culminating in CrySome RAT; the chain leverages living-off-the-land execution, a UAC bypass, in-memory AMSI patching, and an open-source Defender disruption tool (WinDefCtl) to achieve persistence, HVNC/remote command execution, credential theft from Chromium browsers, and broad AV/EDR interference, and it provides IOCs and detection recommendations.