Start with the lure themes, delivery paths, and process behavior rather than a single payload hash. Look for transportation or travel themed messages, cloud-hosted download links, obfuscated VBS, PowerShell spawning from script files, and follow-on attempts to query security tooling or create persistence. Correlate these signals across email, endpoint, and DNS telemetry to catch campaign reuse.
What makes this campaign style hard to hunt
Long-running phishing campaigns that deliver RATs often succeed because the lure, delivery path, and post-delivery behavior are more stable than any single sample. Cloud-hosted links and attachments can rotate quickly, but the campaign usually keeps repeating the same themes, infrastructure patterns, and endpoint actions. Hunting should therefore focus on recurrence and correlation, not just detonation of one file.
That matters because cloud hosting, script-based delivery, and RAT staging create a layered trail. The phish may arrive through email, the payload may live behind a benign-looking link, and the execution chain may only become obvious once a script spawns PowerShell, reaches out again, and begins persistence or security-tool checks.
Signals that deserve correlation across email, endpoint, and DNS
The strongest hunts start with lure content and delivery mechanics. Transportation or travel themed messages, especially when paired with cloud download links, often indicate a repeatable campaign template rather than an isolated event. On the endpoint, obfuscated VBS or similar script files, followed by PowerShell spawning from that script, are useful transition points because they show intent to bridge the email lure into code execution.
After execution, look for follow-on actions that signal a deployed RAT rather than a simple downloader. Those include attempts to query security tooling, enumerate defenses, or establish persistence. DNS telemetry helps connect the pieces when the same campaign reuses domains, subdomains, or resolution patterns across multiple recipients or waves.
MailChimp Breach is a useful reminder that social engineering and credential abuse often sit alongside broader campaign reuse, not as one-off events. For cloud-hosted delivery specifically, the safest hunting posture is to treat repeated lure structure and infrastructure behavior as first-class indicators, even when payload hashes change.
How to turn indicators into a campaign hunt
Build hunts around a timeline. Start with the email message, map the attachment or URL, then pivot to endpoint execution and DNS resolution. That sequence helps separate a harmless attachment from a staged intrusion, and it reduces false confidence from focusing on the initial lure alone.
Use one hunt to ask whether the same campaign family is reappearing across different users or inboxes. If the lure theme, cloud-hosted redirect, script type, and process chain repeat, you likely have a campaign cluster that deserves grouping and containment. If only the payload hash changes but the surrounding behavior stays consistent, treat it as campaign reuse, not new activity.
MITRE ATT&CK Enterprise Matrix helps structure that correlation around credential access, persistence, and execution behaviors. If your telemetry stack can tie process creation, DNS, and mail gateway events together, you can move from isolated detections to repeatable campaign attribution.
Risk and Threat Considerations
These campaigns are risky because they are designed to blend in long enough for repeated delivery and post-exploitation activity. Cloud hosting gives the attacker a convenient way to rotate links and attachments while preserving the same lure and execution pattern, which can delay detection if teams rely on file reputation alone.
Failure mechanism: The phish succeeds when the lure content builds trust, the cloud-hosted object evades simple blocking, and the script chain launches a second-stage process that enables persistence or defensive discovery.
Impact: A successful campaign can lead to repeated endpoint compromise across multiple users, defender visibility gaps, and broader access loss if the RAT is used for further credential theft or lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | PowerShell and script spawning are central to the delivery chain. |
| T1071 — Application Layer Protocol | Cloud-hosted links and callback traffic often use normal web and DNS channels. | |
| T1547 — Boot or Logon Autostart Execution | RAT campaigns often follow with persistence after initial execution. | |
| Recommendation — Map script-to-PowerShell execution to T1059 and hunt for the associated process lineage. Correlate web and DNS traffic to spot staged retrieval and callback behavior. Check for autostart persistence after the initial script execution chain. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems, including physical computing assets, are monitored to find cybersecurity events and verify the effectiveness of protective measures | This hunt depends on monitoring email, endpoint, and DNS telemetry together. |
| DE.AE-02 — Detected cybersecurity events are analyzed to understand attack targets and methods | Campaign hunting requires analysis of lure themes and delivery patterns. | |
| Recommendation — Monitor mail, endpoint, and DNS telemetry together to surface repeat campaign behavior. Analyze recurring lure themes and delivery methods to group events into campaigns. | ||
Practitioner Guidance
What to prioritise: Prioritise joins that tie together lure theme, hosted link, script execution, and DNS follow-on. If you only alert on the initial attachment or URL, you will miss the campaign structure that makes long-running phishing effective.
What to verify: Verify whether the same sender pattern, file family, or cloud-hosted redirect appears across multiple messages and users. A single suspicious email is useful; a repeatable pattern across telemetry is what justifies a campaign hunt.
Practitioner takeaway: The key judgement is to hunt the delivery chain as a campaign, not the payload as a single artifact, because long-running phishing survives by reusing behavior while changing the surface details.
Related resources from NHI Mgmt Group
- How should security teams defend against phishing campaigns that use malicious attachments to deliver persistence mechanisms and staged malware?
- How should security teams defend against spear phishing campaigns that use government themes and shortened links to deliver malware?
- How should hospitality and travel organisations reduce risk from reservation-themed phishing campaigns that deliver malware through links and attachments?
- How should security teams implement AI-driven phishing detection across email, headers, links, and attachments?
