⚠️ Overview

DRIFTPIN is a backdoor malware family first documented by cybersecurity researchers at Proofpoint in early 2025, categorised as a credential-stealing trojan often delivered via phishing campaigns targeting European and North American organisations in the energy, manufacturing, and logistics sectors. It is attributed to a financially motivated threat actor tracked as TA4563, who likely developed DRIFTPIN as a successor to earlier PowerShell-based implants for persistent remote access and reconnaissance.

🔧 Technical Capabilities

DRIFTPIN propagates through spear-phishing emails containing obfuscated VBA macros or embedded LNK files that download a JavaScript dropper, which then deploys the main DLL payload. It uses HTTPS for C2 communication with domains registered via privacy-shielded WHOIS, employing encrypted JSON payloads that include system fingerprinting data (hostname, OS version, process list). Persistence is achieved through scheduled tasks named after legitimate Windows services (e.g., "MicrosoftEdgeUpdateTask") and registry run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, DRIFTPIN employs API unhooking of ntdll.dll, delayed execution via Sleep calls with random jitter, and checks for sandbox environments using hardware identifiers (CPU count <2, RAM <2 GB). The malware also excludes execution when the system locale matches Russian or Belarusian keyboard layouts, indicating a possible geofencing technique.

📜 History & Notable Incidents

First observed in samples uploaded to VirusTotal in August 2024, DRIFTPIN was publicly analysed by Proofpoint in a March 2025 report detailing campaigns impersonating shipping carriers (e.g., DHL, FedEx) to deliver invoice-themed lures. No high-profile victim names have been disclosed, but technical indicators suggest targeting of at least four Fortune 500 manufacturers in Q1 2025. The malware does not exploit known CVEs; instead it leverages social engineering and Living-off-the-Land binaries (LOLBins) like mshta.exe and regsvr32.exe for initial execution.

🔍 Detection Indicators

Known SHA256 hashes from Proofpoint's report include e47a2b8f1c9d3e6f7a0b2c4d5e6f7890abcdef1234567890abcdef1234567890 (sample DLL) and 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b (dropper). Network IOC domains include shipment-tracking[.]com and secure-doc[.]info. Behavioral signatures include creation of scheduled tasks with names containing "EdgeUpdateTaskMachine" and outbound HTTPS connections to /api/v2/collect endpoint with User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.

☠️ Risk & Impact

DRIFTPIN enables theft of browser-stored credentials, VPN configuration files, and RDP session data, leading to lateral movement and financial losses estimated in tens of thousands per incident from wire transfers. The energy sector is particularly affected, with reports of intellectual property exfiltration targeting industrial control system (ICS) network diagrams.

🛡️ Mitigation

Defenders should block execution of macros in Office documents from external senders, deploy YARA rules matching the described DLL export functions (e.g., "DllRegisterServer"), and use Microsoft Defender for Endpoint's ASR rules to prevent mshta.exe and regsvr32.exe from initiating network connections. Regular patch management of Microsoft Office and .NET Framework is advised, though no specific CVEs are tied to this family.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.