Critical IBM SPSS Vulnerability Lets Attackers Deploy CNCMachineRMS RAT

Key Takeaways

• A new ClickFix campaign leverages a critical vulnerability in IBM SPSS WinWrap Basic IDE to deploy a previously undocumented Remote Access Trojan (RAT) called CNCMachineRMS.
• The attack chain is notable for its stealth, utilizing a legitimate, signed IBM application and standard Windows functions to evade detection.
• CNCMachineRMS offers extensive remote control capabilities, including a command shell, file management, screen capture, and persistence mechanisms.
• The vulnerability (CVE ID not specified in the provided text, but implied by the attack chain) impacts users of IBM SPSS WinWrap Basic IDE.
• Organizations should actively hunt for indicators of compromise (IoCs) and treat any detection as a high-severity incident requiring immediate containment and thorough investigation.

Attackers Exploit IBM SPSS IDE to Deliver Stealthy CNCMachineRMS RAT

Recent ClickFix campaigns are exploiting a vulnerability within the IBM SPSS WinWrap Basic IDE, transforming what appears to be a routine user action into a sophisticated attack that delivers a new, undocumented Remote Access Trojan (RAT) named CNCMachineRMS. This RAT grants attackers persistent and comprehensive control over compromised Windows systems.

This particular campaign is notable for its deceptive approach, hiding behind legitimate and digitally signed software. Threat actors initiate the attack with a ClickFix lure, then exploit the scripting functionality of the IBM SPSS WinWrap Basic IDE to execute malicious code. This tactic allows the malicious activity to blend in with trusted software operations, making it significantly harder to detect compared to attacks involving overtly hostile programs.

Intricate Evasion Tactics Employed

LevelBlue said in a report that the attack chain employs four decoy DLLs and abuses a standard Windows date-formatting feature to activate its shellcode. This multi-layered approach makes the initial stages of the compromise more difficult to identify and delays the exposure of the final CNCMachineRMS payload. A detailed analysis of the attack chain is available in LevelBlue’s comprehensive report.

The CNCMachineRMS RAT is far more than a simple downloader. It equips attackers with a full suite of remote capabilities, including command shell access, file browsing, screenshot capture, the creation of new local accounts, multiple persistence mechanisms, and the ability to retrieve and execute additional tools. This extensive functionality means that detecting CNCMachineRMS should be treated as a direct compromise, indicating potential hands-on access by an attacker, rather than a mere malware alert.

The ClickFix Campaign and IBM SPSS Vulnerability

The attack chain commences with a “ClickFix” social engineering lure, a common tactic designed to trick users into executing commands under the guise of a routine system fix. Previous ClickFix campaigns have similarly persuaded victims to install malicious MSI packages, demonstrating how a single user-pasted command can quickly escalate into a full system compromise.

In this particular iteration, the attackers leverage the legitimate and signed WinWrapIDE.exe, which is part of IBM SPSS. They exploit the IDE’s capability to activate its scripting engine via COM, directing it to a malicious DLL dropped onto the system. Subsequently, decoy DLLs are loaded through standard import handling, a method that helps avoid detection by security solutions that typically flag unusual application calls.

The final decoy DLL allocates a buffer, populates it with random data, embeds shellcode, and then marks the memory as executable. Crucially, it invokes this shellcode through EnumTimeFormatsEx, a benign Windows date-formatting interface. This technique causes Windows itself to execute the malicious code, further obscuring its origin and blending it with legitimate system processes. This strategy aligns with a broader trend where ClickFix chains increasingly avoid easily detectable tools like PowerShell, opting for native system utilities to reduce red flags.

The BabaDeda shellcode itself is minimalist, requiring a separate configuration file, HelperStandardizationApplication.bin. This file contains an obfuscated configuration tree, a script, and the 1.14 MB CNCMachineRMS payload. This dependency can make isolated samples appear harmless during quick automated analyses, allowing the full threat to bypass initial scrutiny.

RAT Capabilities Raise Incident Stakes

CNCMachineRMS is a highly versatile Remote Access Trojan designed for adaptable remote administration. Its feature set includes an interactive command shell, a file manager, screen capture capabilities, the ability to establish local account backdoors, seven distinct persistence methods, and 20 specific commands for fetching and executing secondary payloads. This comprehensive toolkit enables attackers to adapt their post-compromise activities based on the target environment.

Upon initial infection, the RAT immediately captures a screenshot and gathers extensive system information, including the domain, SID, privilege status, motherboard and BIOS serial numbers, and installed antivirus products. It then establishes a beaconing mechanism, communicating with its command-and-control server every 600 seconds. The RAT also features a custom scripting language, allowing attackers to modify its behavior without needing to recompile the implant.

One notable script allows the RAT to re-establish registry persistence every 150 seconds. Both local state data and command-and-control traffic are managed within a custom container. The state file is padded with random data and undergoes regular changes, a tactic that can defeat hash-based detection methods. This approach to persistence mirrors other sophisticated RATs that rely on registry entries and scheduled tasks for covert, long-term access.

What You Should Do

• Isolate Affected Systems: Immediately disconnect any suspicious hosts from the network to prevent lateral movement and further compromise.
• Hunt for IoCs: Proactively search for the provided network and host indicators of compromise (IoCs) across your environment. This includes specific domains, IP addresses, file paths, registry keys, and SHA-256 hashes.
• Review Account Changes: Investigate Windows event IDs 4720 and 4732 for evidence of local account creation or changes to privileged groups.
• Check Scheduled Tasks and Run Keys: Scrutinize scheduled tasks and registry Run keys for entries masquerading as “IBM SPSS WinWrap Basic IDE” or other suspicious entries.
• Monitor Outbound Traffic: Implement robust monitoring of outbound network traffic, paying close attention to DNS-over-HTTPS (DoH) usage, which can bypass traditional internal DNS logs.
• Preserve Evidence: Before any cleanup or reimaging, ensure volatile evidence is preserved for forensic analysis.
• Reset Credentials: Reset any credentials that may have been exposed on compromised systems.
• Containment First: Prioritize containment and thorough investigation of neighboring systems before initiating routine cleanup or reimaging, as follow-on payloads can inflict significant damage.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.