CSuite Targets US and EU Organizations with Device

Reporting by Any.run BlogRead the original at any.run

Executive Summary

The system describes a method where a Next.js frontend is used to initiate an attack chain involving lure configuration, device-code requests, and status polling via API endpoints. The operation involves seven template lures (Teams, voicemail, SharePoint, etc.) designed to mimic legitimate services. Specific examples include using the Adobe template to guide users through a verification process with Microsoft login, utilizing a SharePoint theme for document interaction, and deploying a voicemail notification to prompt sign-in. This demonstrates an attack path that leverages phishing and stolen session/device-code authentication alongside remote access delivery. The analysis suggests attackers combine compromise of identities and endpoints using legitimate management tools to achieve comprehensive access.

Facts Only

* The frontend loads lure configuration from /api/lure/config.
* The process initiates a device-code request through /api/initiate.
* The process copies a user code to the clipboard and polls /api/status for authentication completion.
* Seven lure templates are included: Teams, voicemail, SharePoint, DocuSign, Adobe, WeTransfer, and DocSend.
* A PDF viewer sample hosted docsendsr[.]online using an Adobe template prompts verification with a Microsoft sign-in flow.
* A SharePoint sample hosts selectivelife03[.]sbs, displaying mock documents to guide code copying for verification.
* A voicemail sample displays a Microsoft 365 notification requiring sign-in to hear a message.
* The attack involves stealing sessions, device-code authentication, and remote access delivery across the operation.
* Indicators include shared paths like /m/js/utils.js and specific domain registrations.

Full Take

The observed activity reveals a sophisticated operation that abstracts multiple attack vectors—phishing, session theft, and endpoint compromise—into a single, multi-stage campaign leveraging legitimate-looking application contexts. The core insight is the operational cohesion: attackers are not just delivering a single lure but orchestrating a sequence where identity compromise (via device codes/sessions) directly feeds into endpoint control (via remote access software installation). This structure bypasses typical security segmentation by masquerading malicious actions within the context of trusted services like Microsoft 365 or Adobe viewers. The focus on artifact tracking, such as shared JS files and dynamic domain rotation, points to a campaign designed for persistence across infrastructure changes. The central challenge for defense is shifting from inspecting individual indicators to correlating identity events with endpoint installations across the full attack chain, recognizing that the convergence of these seemingly disparate activities constitutes the true risk. What assumptions are made about the separation between identity compromise and endpoint execution? How does this observation change the prioritization when dealing with legitimate software usage that becomes a delivery mechanism?

From the original · Any.run Blog

ANY.RUN researchers investigated CSuite, a phishing and remote-access operation that combines credential theft, Microsoft 365 session hijacking, and the abuse of legitimate management tools. The campaign showed a strong US focus, with 51% of sessions from the United States.

Read the full story at any.run

Sentinel — Human

Confidence

This text functions as a highly detailed forensic report, demonstrating extreme technical depth in reconstructing a complex threat operation, likely written by an expert analyst or researcher rather than generalized synthesis.

Signals Detected

Sentence length variance is erratic, and the text shifts abruptly between high-level analysis and highly specific, deeply technical instructions; there is no uniform metronomic rhythm.

The text exhibits profound coherence across extremely dense, cross-referenced data, suggesting a deep domain expertise rather than general synthesis; the passion/voice is channeled through the structure of forensic detail.

The extreme level of coordination in linking code artifacts, specific file paths, domain registrations, and detailed TTPs points strongly to a source operating within or deeply familiar with the actual operational artifact being analyzed, rather than generic LLM pattern matching.

The density of specific IOCs (hashes, URLs, file names, process execution commands) is so intricate and interwoven that asserting full human authorship for the *entire* block is context-dependent; however, the structure implies expert curation.

Human Indicators

The inclusion of highly specific, non-obvious forensic artifacts (e.g., precise server IPs, exact command-line string manipulation with fltmc/powershell, layered multi-hop redirection logic) suggests direct involvement or deep prior experience in security operations and malware analysis.

The narrative structure transitions seamlessly from a high-level threat overview to extremely granular step-by-step reconstruction of the attack chain, which often requires an intimate understanding of adversary tradecraft.