{
	"id": "03b43378-8f92-403a-b14d-d9e5bca68584",
	"created_at": "2026-04-06T00:06:25.019934Z",
	"updated_at": "2026-04-10T03:36:08.260396Z",
	"deleted_at": null,
	"sha1_hash": "a5c321132044ae3f5a1223f9061f5470cb8b2389",
	"title": "More_eggs Activity Persists Via Fake Job Applicant Lures",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1423673,
	"plain_text": "More_eggs Activity Persists Via Fake Job Applicant Lures\r\nBy eSentire Threat Response Unit (TRU)\r\nArchived: 2026-04-05 20:49:23 UTC\r\nAdversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters\r\nand Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.\r\nWe have discovered some of the most dangerous threats and nation state attacks in our space – including the\r\nKaseya MSP breach and the more_eggs malware.\r\nOur Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced\r\nThreat Analytics driven by our Threat Response Unit – the TRU team.\r\nIn TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We\r\noutline how we responded to the confirmed threat and what recommendations we have going forward.\r\nHere’s the latest from our TRU Team…\r\nWhat did we find?\r\nIn May 2024, eSentire's Threat Response Unit (TRU) identified and traced activity related to a more_eggs\r\nmalware campaign targeting a customer in the industrial services industry. However, eSentire MDR for Endpoint\r\nblocked the activity after the user attempted to open the resume-themed loader.\r\nSpecifically, the targeted individual was a recruiter that was deceived by the threat actor into thinking they were a\r\njob applicant and lured them to their website to download the loader. eSentire observed similar tactics with\r\nmore_eggs back in early 2022.\r\nMore_eggs is a malicious software containing several components engineered to steal valuable credentials,\r\nincluding usernames and passwords for corporate bank accounts, email accounts, and IT administrator accounts\r\nand is sold on the Dark Web as a Malware-as-a-Service (MaaS).\r\nThe Golden Chickens group (aka Venom Spider) is believed to be the threat operators behind more_eggs, and the\r\nmalware is known to be utilized by the very capable FIN6, Evilnum, and Cobalt cybercriminals.\r\nDelivery\r\nThe delivery of the malware took place from the response to a LinkedIn job listing, where the attacker posed as a\r\npotential candidate, providing a link to the fake resume download site. When navigating to the site, the victim was\r\nmet with a ‘Download CV’ button (Figure 1), which resulted in the download of a malicious Windows Shortcut\r\nFile (LNK).\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 1 of 10\n\nThis delivery method has been observed by eSentire in previous more_eggs malware campaigns, where attackers\r\nhave disguised themselves in both roles, as the recruiter and as the potential candidate.\r\nThe threat actors behind these campaigns target organizations and individuals by leveraging periods of time where\r\nhiring is typically at an increase.\r\nFigure 1: Fake resume download site\r\nNavigating to the same URL days later results in the individuals resume in plain HTML, with no indication of a\r\nredirect or download (Figure 2).\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 2 of 10\n\nFigure 2: Normal resume site\r\nLoading/Loader\r\nOnce the victim downloads and opens the .LNK file, in this case “Christian C. Velour.LNK”, the shortcut points to\r\nthe executable “cmd.exe” followed by a long-obfuscated command. The command uses a lot of string\r\nsubstitutions to make analysis more difficult.\r\nHowever, once de-obfuscated (Figure 2), the intent of the malicious .LNK file becomes clearer. When opened, the\r\nmalicious command line generates a series of strings which are added to a new .INF file: “ieuinit.inf”. An INF file\r\nis a plain text configuration file used by the Windows operating system to install, uninstall, or configure device\r\ndrivers, software components, or system settings.\r\nIn this case, the Loader uses the configuration as a reference point for the Malicious DLL download URL.\r\nFrom there, the malicious command line creates a copy of the legitimate Microsoft “ie4unit.exe” executable in the\r\nuser’s appdata\\microsoft directory, which is the same directory the loader saved the malicious .INF file.\r\nThe “ie4unit.exe” file is a legitimate Microsoft Windows executable that is responsible for initializing certain\r\nsettings and components related to Internet Explorer.\r\nHere, it is used to execute commands from the specially prepared “ie4uinit.inf” file and to download the malicious\r\nDLL from a8advbiejf[.]christianvelour[.]com.\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 3 of 10\n\nAs seen in Figure 3, Windows’ WMI is invoked to run the hijacked copy of “ie4unit.exe”, which then drops the\r\nmalicious DLL file named “55609.dll”.\r\nThis DLL is then registered into the user’s registry and executed using “regsvr32.exe” to establish persistence,\r\ngather data about the infected host, and to drop additional payloads.\r\nFigure 3: De-obfuscated .LNK which uses legitimate Windows processes to download and execute\r\nmalicious DLL\r\nPayload\r\nUpon inspection of the “55609.dll”, the DLL is highly obfuscated and contains multiple anti-debug and anti-sandbox checks. The DLL’s payload is encrypted and so a key is generated in an iterative fashion for the payload\r\nto get decrypted during execution.\r\nSpecifically, there is a loop which contains a string with the keyword “SqadTO” followed by a numerical number\r\nwhich starts at 0 and then increases by one until a match is found with a hardcoded hash (Figure 4). This process\r\ndelays the execution of the payload until a match is generated.\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 4 of 10\n\nFigure 4: Loops to generate the key for the encrypted payload\r\nAs per the Security Brief from Proofpoint UK, the malware uses the RC4 algorithm to decrypt the strings.An\r\nexample of the decryption can be seen in Figure 5 and 6.\r\nFigure 5: The generated RC4 key is passed along with the encrypted string to the decryption\r\nfunction\r\nFigure 6: Example of a string decrypted after the decrypt function is run\r\nWithin the decrypted DLL, the malware sets up persistence on the host’s registry (Figure 7) and is responsible for\r\ndropping the “msxsl.exe” binary along with 2 other txt files which contain JavaScript code. These files are\r\ndropped in the %appdata%/Roaming/Microsoft folder.\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 5 of 10\n\nFigure 7: The DLL adds registry keys on the host's machine to setup persistence\r\nThe first text file “7E9CB3FBF4FD0B07.txt” (Figure 8), contains obfuscated JavaScript code that is responsible\r\nfor launching the second text file “1A4D05F30007.txt” using msxsl.exe.\r\nFigure 8: Obfuscated JavaScript code which execute the second text file dropped\r\n\"1A4D05F30007.txt\"\r\nWithin “1A4D05F30007.txt” there is a fair amount of JavaScript code with various functions (Figure 9), but in\r\nsummary the code appears to setup a command and control (C2) client which reaches out to\r\nhxxps[://]dcc[.]olcrv[.]com/login/tologin, and sends details from the host’s system such as OS version, local IP,\r\nantivirus software installed.\r\nThe code also has the capability ability to check whether the malicious script has system privileges, a function\r\ncalled “eTask” that can execute tasks received from the C2 server, and the ability to further download and execute\r\nfiles via the “dExec” function, which are all similar functions previously observed in more_eggs campaigns.\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 6 of 10\n\nFigure 9: Various functions observed in the more_eggs payload JavaScript code\r\nWhat did we do?\r\neSentire MDR for Endpoint blocked the malicious activity after the user attempted to open the resume-themed loader.\r\nOur team of 24/7 SOC Cyber Analysts isolated the affected host and notified the customer to provide\r\nsupport with complete remediation.\r\nWhat can you learn from this TRU Positive?\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 7 of 10\n\nMore_eggs campaigns are still active and their operators continue to use social engineering tactics such as\r\nposing to be job applicants who are looking to apply for a particular role, and luring victims (specifically\r\nrecruiters) to download their malware.\r\nThe malware continues to use LinkedIn for distribution, which allows for the targeting of specific\r\nindustries and organizations.\r\nIt utilizes heavy obfuscation as well as other techniques to evade possible detections, showing the\r\nlevel of sophistication more_eggs maintains.\r\nIt maintains a stealthy profile by abusing legitimate Windows processes and feeds those process\r\ninstructions via script files.\r\nAs these campaigns have occurred multiple times over the last several years with significant overlap from\r\nprevious versions, it is probable the threat actors behind the malware are finding success with their current\r\nmethods.\r\nAdditionally, campaigns like more_eggs, which use the MaaS offering appear to be sparse and selective in\r\ncomparison to typical malspam distribution networks.\r\nRecommendations from our Threat Response Unit (TRU):\r\n1. Confirm that all devices are protected with Endpoint Detection and Response (EDR) solutions.\r\nEmploy exhaustive endpoint monitoring for LOLBINs, aka Trusted Windows Binary abuse.\r\nLOLBINs of interest include cmd.exe, wscript.exe, wmic.exe, cmstp.exe, msxsl.exe,\r\npowershell.exe, and ie4uinit.exe. Ensure endpoint products have rules in place to detect suspicious\r\nusage of these Windows processes.\r\n2. Ensure employees are aware of common phishing tactics and implement a Phishing and Security\r\nAwareness Training (PSAT) program that educates and informs your employees on emerging threats in the\r\nthreat landscape.\r\nBe suspicious of attachments from people you don’t know – additional care is required in cases\r\nwhere you must accept documents from the public (such as with employee hiring process).\r\nInspect attachment file types by right clicking the file and selecting properties.\r\nDocuments should never come as LNK, ISO, or VBS files.\r\nOften, these malicious files will be enclosed in a .zip file to bypass email filters.\r\n3. Have an easy process in place for reporting phishing and suspicious behavior.\r\nLeadership is responsible for ensuring a positive and convenient path is in place for reporting\r\nsuspicious behavior.\r\nDevelop a collaborative culture of cyber resiliency where employees are comfortable to bring\r\nforward questions, and even mistakes when it comes to email behavior and downloads. Punishing\r\nemployees for falling for phishing scams will reduce the chances that they – and other employees –\r\nreport them in the future.\r\n4. Users and administrators must adhere to the principle of least privilege by limiting account permissions\r\nstrictly to those necessary for their operational roles, helping to minimize potential damage from malware\r\ninfections.\r\nIndicators of Compromise\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 8 of 10\n\nYou can access the Indicators of Compromise here.\r\nReferences\r\nSecurity Brief: TA4557 Targets Recruiters Directly via Email\r\nGOLDEN CHICKENS: Evolution of the MaaS\r\nhttps://github.com/esThreatIntelligence/iocs/blob/main/more_eggs/more_eggs_iocs_5-29-2024.txt\r\nTo learn how your organization can build cyber resilience and prevent business disruption with eSentire’s Next\r\nLevel MDR, connect with an eSentire Security Specialist now.\r\nGET STARTED\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 9 of 10\n\nABOUT ESENTIRE’S THREAT RESPONSE UNIT (TRU)\r\nThe eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your\r\norganization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7\r\nSecurity Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and\r\nworks as an extension of your security team to continuously improve our Managed Detection and Response\r\nservice. By providing complete visibility across your attack surface and performing global threat sweeps and\r\nproactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending\r\nyour organization against known and unknown threats.\r\nSource: https://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nhttps://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures\r\nPage 10 of 10",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.esentire.com/blog/more-eggs-activity-persists-via-fake-job-applicant-lures"
	],
	"report_names": [
		"more-eggs-activity-persists-via-fake-job-applicant-lures"
	],
	"threat_actors": [
		{
			"id": "059b16f8-d4e0-4399-9add-18101a2fd298",
			"created_at": "2022-10-25T15:50:23.29434Z",
			"updated_at": "2026-04-10T02:00:05.380938Z",
			"deleted_at": null,
			"main_name": "Evilnum",
			"aliases": [
				"Evilnum"
			],
			"source_name": "MITRE:Evilnum",
			"tools": [
				"More_eggs",
				"EVILNUM",
				"LaZagne"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "12517c87-040a-4627-a3df-86ca95e5c13f",
			"created_at": "2022-10-25T16:07:23.61665Z",
			"updated_at": "2026-04-10T02:00:04.689Z",
			"deleted_at": null,
			"main_name": "FIN6",
			"aliases": [
				"ATK 88",
				"Camouflage Tempest",
				"FIN6",
				"G0037",
				"Gold Franklin",
				"ITG08",
				"Skeleton Spider",
				"Storm-0538",
				"TAAL",
				"TAG-CR2",
				"White Giant"
			],
			"source_name": "ETDA:FIN6",
			"tools": [
				"AbaddonPOS",
				"Agentemis",
				"AmmyyRAT",
				"Anchor_DNS",
				"BlackPOS",
				"CmdSQL",
				"Cobalt Strike",
				"CobaltStrike",
				"FlawedAmmyy",
				"FrameworkPOS",
				"Grateful POS",
				"JSPSPY",
				"Kaptoxa",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"LockerGoga",
				"MMon",
				"Magecart",
				"Meterpreter",
				"Mimikatz",
				"More_eggs",
				"NeverQuest",
				"POSWDS",
				"Reedum",
				"Ryuk",
				"SCRAPMINT",
				"SONE",
				"SpicyOmelette",
				"StealerOne",
				"Taurus Loader Stealer Module",
				"Terra Loader",
				"TerraStealer",
				"Vawtrak",
				"WCE",
				"Windows Credential Editor",
				"Windows Credentials Editor",
				"cobeacon",
				"grabnew"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "f5c90ccc-0f18-4e07-a246-b62101ab2f6f",
			"created_at": "2023-01-06T13:46:38.854407Z",
			"updated_at": "2026-04-10T02:00:03.122844Z",
			"deleted_at": null,
			"main_name": "GC02",
			"aliases": [
				"Golden Chickens",
				"Golden Chickens02",
				"Golden Chickens 02"
			],
			"source_name": "MISPGALAXY:GC02",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f2fa9952-301f-4376-ac69-743d6f2bec1e",
			"created_at": "2023-01-06T13:46:39.122721Z",
			"updated_at": "2026-04-10T02:00:03.22231Z",
			"deleted_at": null,
			"main_name": "VENOM SPIDER",
			"aliases": [
				"badbullz",
				"badbullzvenom"
			],
			"source_name": "MISPGALAXY:VENOM SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "ea7bfe06-7c23-481d-b8ba-eafa6cda3bc9",
			"created_at": "2022-10-25T15:50:23.317961Z",
			"updated_at": "2026-04-10T02:00:05.280403Z",
			"deleted_at": null,
			"main_name": "FIN6",
			"aliases": [
				"FIN6",
				"Magecart Group 6",
				"ITG08",
				"Skeleton Spider",
				"TAAL",
				"Camouflage Tempest"
			],
			"source_name": "MITRE:FIN6",
			"tools": [
				"FlawedAmmyy",
				"GrimAgent",
				"FrameworkPOS",
				"More_eggs",
				"Cobalt Strike",
				"Windows Credential Editor",
				"AdFind",
				"PsExec",
				"LockerGoga",
				"Ryuk",
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "b3acfb48-b04d-4d3d-88a8-836d7376fa2e",
			"created_at": "2024-06-19T02:03:08.052814Z",
			"updated_at": "2026-04-10T02:00:03.659971Z",
			"deleted_at": null,
			"main_name": "GOLD FRANKLIN",
			"aliases": [
				"FIN6 ",
				"ITG08 ",
				"MageCart Group 6 ",
				"Skeleton Spider ",
				"Storm-0538 ",
				"White Giant "
			],
			"source_name": "Secureworks:GOLD FRANKLIN",
			"tools": [
				"FrameWorkPOS",
				"Metasploit",
				"Meterpreter",
				"Mimikatz",
				"PowerSploit",
				"PowerUpSQL",
				"RemCom"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "88802a4b-5b3d-42ee-99e6-8a4f5fd231f6",
			"created_at": "2023-01-06T13:46:38.851345Z",
			"updated_at": "2026-04-10T02:00:03.121861Z",
			"deleted_at": null,
			"main_name": "GC01",
			"aliases": [
				"Golden Chickens",
				"Golden Chickens01",
				"Golden Chickens 01"
			],
			"source_name": "MISPGALAXY:GC01",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "8ce861d7-7fbd-4d9c-a211-367c118bfdbd",
			"created_at": "2023-01-06T13:46:39.153487Z",
			"updated_at": "2026-04-10T02:00:03.232006Z",
			"deleted_at": null,
			"main_name": "Evilnum",
			"aliases": [
				"EvilNum",
				"Jointworm",
				"KNOCKOUT SPIDER",
				"DeathStalker",
				"TA4563"
			],
			"source_name": "MISPGALAXY:Evilnum",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "ee3363a4-e807-4f95-97d8-b603c31b9de1",
			"created_at": "2023-01-06T13:46:38.485884Z",
			"updated_at": "2026-04-10T02:00:02.99385Z",
			"deleted_at": null,
			"main_name": "FIN6",
			"aliases": [
				"SKELETON SPIDER",
				"ITG08",
				"MageCart Group 6",
				"ATK88",
				"TA4557",
				"Storm-0538",
				"White Giant",
				"GOLD FRANKLIN",
				"G0037",
				"Camouflage Tempest"
			],
			"source_name": "MISPGALAXY:FIN6",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "39ea99fb-1704-445d-b5cd-81e7c99d6012",
			"created_at": "2022-10-25T16:07:23.601894Z",
			"updated_at": "2026-04-10T02:00:04.684134Z",
			"deleted_at": null,
			"main_name": "Evilnum",
			"aliases": [
				"G0120",
				"Jointworm",
				"Operation Phantom in the [Command] Shell",
				"TA4563"
			],
			"source_name": "ETDA:Evilnum",
			"tools": [
				"Bypass-UAC",
				"Cardinal RAT",
				"ChromeCookiesView",
				"EVILNUM",
				"Evilnum",
				"IronPython",
				"LaZagne",
				"MailPassView",
				"More_eggs",
				"ProduKey",
				"PyVil",
				"PyVil RAT",
				"SONE",
				"SpicyOmelette",
				"StealerOne",
				"Taurus Loader Stealer Module",
				"Taurus Loader TeamViewer Module",
				"Terra Loader",
				"TerraPreter",
				"TerraStealer",
				"TerraTV"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "7a257844-df90-4bd4-b0f1-77d00ff82802",
			"created_at": "2022-10-25T16:07:24.376356Z",
			"updated_at": "2026-04-10T02:00:04.964565Z",
			"deleted_at": null,
			"main_name": "Venom Spider",
			"aliases": [
				"Golden Chickens",
				"TA4557",
				"Venom Spider"
			],
			"source_name": "ETDA:Venom Spider",
			"tools": [
				"More_eggs",
				"PureLocker",
				"SONE",
				"SpicyOmelette",
				"StealerOne",
				"Taurus Builder",
				"Taurus Builder Kit",
				"Taurus Loader",
				"Taurus Loader Reconnaissance Module",
				"Taurus Loader Stealer Module",
				"Taurus Loader TeamViewer Module",
				"Terra Loader",
				"TerraCrypt",
				"TerraLogger",
				"TerraPreter",
				"TerraRecon",
				"TerraStealer",
				"TerraTV",
				"TerraWiper",
				"ThreatKit",
				"VenomKit",
				"VenomLNK",
				"lite_more_eggs"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775433985,
	"ts_updated_at": 1775792168,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a5c321132044ae3f5a1223f9061f5470cb8b2389.pdf",
		"text": "https://archive.orkl.eu/a5c321132044ae3f5a1223f9061f5470cb8b2389.txt",
		"img": "https://archive.orkl.eu/a5c321132044ae3f5a1223f9061f5470cb8b2389.jpg"
	}
}