Jump to content

Zoom For You — SEO Poisoning to Distribute BATLOADER and Atera Agent

David H. Lipman

Recommended Posts

Zoom For You — SEO Poisoning to Distribute BATLOADER and Atera Agent


While defending our customers against threats, Mandiant Managed Defense continues to see new threats that abuse trust in legitimate tools and products to carry out their attacks. These attacks are effective in getting past security defenses and staying undetected in a network.

Through proactive threat hunting, our Managed Defense frontline team uncovered a campaign that used search engine optimization (SEO) poisoning to lead victims to download the BATLOADER malware for the initial compromise. We also observed a crafty defense evasion technique using mshta.exe, a Windows-native utility designed to execute Microsoft HTML Application (HTA) files.

SEO poisoning is an attack method in which threat actors create malicious websites packed with keywords and use search engine optimization techniques to make them show up prominently in search results.

Infection Chain

The threat actor used “free productivity apps installation” or “free software development tools installation” themes as SEO keywords to lure victims to a compromised website and to download a malicious installer. The installer contains legitimate software bundled with the BATLOADER malware. The BATLOADER malware is dropped and executed during the software installation process.

This initial BATLOADER compromise was the beginning of a multi-stage infection chain that provides the attackers with a foothold inside the target organization. Every stage was prepared for the next phase of the attack chain. And legitimate tools such as  PowerShell, Msiexec.exe, and Mshta.exe allow proxy execution of malicious payloads to avoid detection.

CVE-2020-1599 Patch Bypass

One notable sample found in the attack chain was a file named, “AppResolver.dll”. This DLL sample is an internal component of the Microsoft Windows Operating System developed by Microsoft, but with malicious VBScript embedded inside in a way that the code signature remains valid. The DLL sample does not execute the VBScript when run by itself. But when run with Mshta.exe, Mshta.exe locates and executes the VBScript without any issues.

This issue most closely resembles CVE-2020-1599, PE Authenticode signature remains valid after appending HTA supported scripts signed by any software developer. These PE+HTA polyglot (.hta files) can be exploited through Mshta.exe to bypass security solutions that rely on Microsoft Windows code signing to decide if files are trusted. This issue was patched as CVE-2020-1599.

In this case, we observed arbitrary script data was appended to the signature section beyond the end of the ASN.1 of a legitimately signed Windows PE file. The resultant polyglot file maintains a valid signature as long as the file has a file extension other than '.hta'. This polyglot file will successfully execute the script contents if it is executed with Mshta.exe, as Mshta.exe will skip the PE's bytes, locate the script at the end, and execute it. This evasion technique was used several times during the attack chain to change the host settings and to launch payloads.

At the latter stages, goodware such as Gpg4win Utility, NSUDO Utility, ATERA, and SplashTop, are seen installed as part of the attack chain of this campaign. These are to support remote access, privilege escalation, launching of payloads, encryption, and persistence. There was also malware such as BEACON, URSNIF deployed to provide backdoor and credential-stealing capabilities.

Attack chain of the BATLOADER campaign Attack chain of the BATLOADER campaign

An Alternate Infection Chain

Alternatively, the Threat Actor may deploy ATERA directly as the initial compromise. Similarly, through SEO poisoning, victims were lured to download an ATERA Agent Installation Package. The installer masquerades as a “free legitimate software” to lure the victim into installing it onto the host for the initial compromise.

ATERA is a Remote Monitoring Management Software. It provides IT Automation, Host, and Network Discovery features. SplashTop is software that can be integrated into ATERA is to provide remote access to a host. The infection chain is as follows:

  • A user performs a Google search and clicks a link to an actor-created page on a compromised website (Figure 1).
Google search results with link to the actor-created content on the compromised website Figure 1: Google search results with link to the actor-created content on the compromised website
  • The benign blog post (Figure 2) will abuse a Traffic Direction System (TDS)  to decide if the user should be directed to a webpage that masquerades as a message board that has posted a download link (Figure 3).
Benign blog post Figure 2: Benign blog post Actor-created discussion board with malicious download link Figure 3: Actor-created discussion board with malicious download link
  • The download link delivers the ATERA Agent Installer Package, named after the search term. (Figure 4 and Figure 5).
Atera Agent Installer Package named after the search term Figure 4: Atera Agent Installer Package named after the search term ATERA Agent Installer Package Masquerading as Microsoft Community Visual Studio 2015 Figure 5: ATERA Agent Installer Package Masquerading as Microsoft Community Visual Studio 2015
  • An example of the installation of an ATERA Agent masquerading as “Microsoft Community Visual Studio 2015 Free.msi” (Figure 6).
Installation of an Atera Agent Figure 6: Installation of an Atera Agent
  • After the successful ATERA Agent installation, the Splashtop will be downloaded to the C:\Windows\Temp directory, and installed on the victim’s host to maintain persistence (Figure 7 and Figure 8).
  • After the successful ATERA Agent installation, the ATERA Remote Monitoring & Management capabilities will push down pre-configured scripts, tools such as Splashtop Streamer to be installed and run on the victim’s host in a real-time and automated fashion.
Auto Deployment of the Splashtop Software Figure 7: Auto Deployment of the Splashtop Software
  • The ATERA Agent will remove itself after the successful Splashtop Streamer installation. The default configuration of the Splashtop Streamer is set to AutoStart running in background without security authentication to connect to the victim’s host to maintain persistence.
Splashtop Streamer Default Configuration Figure 8: Splashtop Streamer Default Configuration
  • Scripts were also pushed down by ATERA Agent to perform malicious task such as disabling functionalities and adding process and file exclusions for Microsoft Windows Defender (Figure 9 and Figure 10).
Malicious Script that was consistent of disabling Microsoft Windows Defender functionalities Figure 9: Malicious Script that was consistent of disabling Microsoft Windows Defender functionalities Malicious Script to download further payload Figure 10: Malicious Script to download further payload


In August 2021, a disgruntled CONTI affiliate leaked training documents, playbooks, and tools used to assist in CONTI ransomware operations. Mandiant has determined that some of the activity listed above overlaps with techniques in the playbooks disclosed in August.

At this time, due to the public release of this information, other unaffiliated actors may be replicating the techniques for their own motives and objectives. These victims seem to operate in a wide range of industries. The threat group's motivations are currently unknown, but we suspect that the group is financially motivated based on the seemingly industry-agnostic leading to ransomware activity.

Managed Defense Threat Hunting

Experienced defenders from Managed Defense are constantly inspired by Mandiant’s global cyber threat intelligence and incident response experiences gained on the frontlines of the world’s most consequential cyber-attacks. Fueled by up-to-the-minute threat intelligence, the Managed Defense threat hunting team designs and conducts hunt missions to reveal the stealthiest threat actors. Mandiant threat hunting combines powerful data analytics, automation and elite experts with intuition and frontline experience. You can follow our hunters as their work unfolds in the Managed Defense portal. Each mission is mapped to the MITRE ATT&CK framework and includes related intelligence so you can take decisive action throughout your environment.

Technical Indicators & Warnings

















































Network Indicators

















rule M_Hunting_Downloader_BATLOADER_1



author = "Mandiant"

date_created = "2021-10-28"

date_modified = "2021-10-28"

version = "1.0"

description = "Detects strings for BATLOADER sample"

md5 = "6cd13e6429148e7f076b479664084488"



$s1 = "launch.bat" ascii

$s2 = "Error writing to batch file:" ascii

$s3 = "cmd.exe" ascii

$s4 = "/C" ascii

$s5 = "You entered an invalid email, please enter the email that was registered on website." ascii



uint16(0) == 0x5A4D and filesize > 4KB and filesize < 5MB and all of them



ATT&CK Tactic Category



Search Open Websites/Domains (T1593.002)

  • Search Engines (T1593.002)

Resource Development

Compromise Infrastructure (T1584)

Stage Capabilities (T1608)

  • Upload Malware (T1608.001)

Develop Capabilities (T1587)

  • Malware (T1587.001)

Initial Access

Supply Chain Compromise (T1195)


User Execution (T1204)

  • Malicious File (T1204.002)

Command and Scripting Interpreter (T1059)

  • PowerShell (T1059.001)
  • Windows Command Shell (T1059.003)
  • Visual Basic (T1059.005)


Boot or Logon Autostart Execution (T1547)

  • Registry Run Keys / Startup Folder (T1547.001)

Privilege Escalation

External Remote Services (T1133)

Defense Evasion

Masquerading (T1036)

Obfuscated Files or Information (T1027)

Indicator Removal on Host (T1070)

  • File Deletion (T1070.004)

Signed Binary Proxy Execution (T1218)

  • Mshta (T1218.005)
  • Msiexec (T1218.007)

Impair Defenses (T1562)

  • Impair Defenses: Disable or Modify Tools (T1562.001)

Credential Access

Steal or Forge Kerberos Tickets: Kerberoasting (T1558)


System Information Discovery (T1082)

System Network Configuration Discovery (T1016)

Command and Control

Remote Access Software (T1219)


Special Thanks to Alip Asri in creating the IOCs for the Hunting Missions. And Ana Maria Martinez Gomez, Tufail Ahmed, Stephen Eckels, Dhanesh Kizhakkinan and Jacob Thompson for their assistance on the topic.


  • Like 1
  • Thanks 2
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.