From Phishing to Persistence: Lessons from the CrySome RAT Infection Chain
Phishing remains one of the most reliable entry points for attackers, serving as the initial intrusion vector in 58% of incidents analyzed in LevelBlue’s Q1 2026 TTP Briefing.
But today’s campaigns are becoming increasingly targeted and technically sophisticated, evolving from simply convincing a user to click to establishing long-term access to enterprise environments. The real challenge for defenders isn’t preventing every phishing email, but identifying and disrupting the activity that follows.
A recent investigation by LevelBlue SpiderLabs into the CrySome remote access trojan (RAT) demonstrates how threat actors chain together multiple legitimate Windows components and defense-evasion techniques after initial access, turning a single user click into a full enterprise compromise.
Phishing is only the beginning of the modern attack chain
During a customer security alert, the LevelBlue MDR SOC successfully triaged and contained a structured, multi-stage infection chain designed to deliver the CrySome RAT.
LevelBlue’s Threat Hunting Operations and Research (THOR) team then reverse-engineered the attack to reconstruct the full infection chain. They found that the intrusion began with a targeted spear-phishing email disguised as a legitimate logistics rate confirmation. By mimicking an expected business process, the attackers convinced the recipient to execute the initial payload without raising suspicion.
The use of logistics-themed lures is not exclusive to this attack. Earlier this year, the FBI warned that cybercriminals are increasingly targeting the transportation and logistics sector with phishing emails, spoofed websites, and fake business communications to gain initial access, reinforcing that attackers continue to exploit trusted business processes to improve the success of their phishing campaigns.
In the case of CrySome RAT, the phishing email itself was only the delivery mechanism. Once the user interacted with the email, the attackers executed a carefully orchestrated sequence designed to evade detection and establish persistence. Rather than immediately deploying the RAT, the attackers first used PowerShell to retrieve and stage additional payloads while attempting to blend into normal Windows activity. They then employed multiple defense-evasion techniques, including AMSI and User Account Control (UAC) bypasses, to reduce the likelihood that security controls would identify or interrupt the attack.
With those obstacles removed, the attackers deployed CrySome RAT and established command-and-control communications, enabling persistent remote access, browser credential theft, keylogging, and remote command execution. Each phase built on the previous one, illustrating how modern intrusion campaigns are being engineered to progress from initial access to long-term compromise while remaining as stealthy as possible.
CrySome RAT is not noteworthy because of one novel malware family, but because it reflects how attackers increasingly chain together legitimate Windows tools, defense-evasion techniques, and staged payloads to quietly establish persistence. More importantly, it reflects a broader shift in attacker behavior from simply gaining access to operating undetected inside enterprise networks.
Why defenders need visibility beyond the inbox
While the phishing lure in this attack was convincing, the true success of the campaign ultimately depended on what happened after the user interacted with the email.
Phishing is now serving as a gateway to a much larger intrusion. At the same time, attackers are more frequently leveraging legitimate workflows and tools to make malicious activity appear routine and maintain long-term access. Rather than relying on a single exploit or malware family, they’re chaining together multiple tools and techniques, such as PowerShell, defense evasion, staged payload delivery, and command-and-control communications, to gradually deepen their foothold.
This layered approach makes it more difficult for organizations relying primarily on email security or signature-based detection to detect attacks before they become broader compromises. The implication for defenders is clear: stopping phishing remains important, but visibility into post-compromise activity is critical.
How defenders can respond
As phishing campaigns continue to evolve, organizations should assume that some initial access attempts will succeed. In response, security teams should focus on detecting attacker behavior across the entire intrusion chain.
User awareness training remains an important layer of defense, but it addresses only one phase of today’s attack chains. Campaigns like CrySome RAT demonstrate that defenders must be prepared to identify subtle indicators of malicious behavior throughout the attack lifecycle. Organizations should complement phishing awareness with controls designed to identify suspicious post-compromise activity, including:
- Alerting on Microsoft Defender configuration changes
- Investigating executables launched from user-writable directories, especially binaries masquerading as legitimate Windows processes
- Blocking or investigating outbound connections to known malicious infrastructure
- Monitoring for:
- Suspicious PowerShell execution, particularly when followed by network downloads and child process creation
- Staged payload downloads from a single external host
- Browser process termination followed by the creation of abe_decrypt.dll, passwords.json, or cookies.json
The goal should be to disrupt the attack chain before attackers can establish long-term control.
Overall, CrySome RAT is representative of a broader evolution in attacker tradecraft: phishing has become the opening move in coordinated, multi-stage intrusion campaigns. Modern enterprise resilience depends on layered detection, continuous monitoring, and the ability to surface malicious behavior after the initial compromise.
Organizations that understand how modern attack chains unfold will be better equipped to detect malicious activity earlier, contain intrusions more quickly, and reduce the business impact of successful phishing campaigns.
