Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

// // //
10/10/2017
10:55 AM
Simon Marshall
Simon Marshall
Simon Marshall

PoohMilk Is Advanced Spear-Phishing

A new vulnerability in Microsoft Office means a new opportunity for phishing – and PoohMilk answers the call.

If a person walks into your office and produces a pistol, you know you're in trouble. It's a one-on-one situation, but you can at least try and negotiate. Personalized spear-phishing attacks leave no such wiggle-room. And, they're actively getting more difficult to deal with.

Phishing itself takes little skill. It's a quantitative game. One recent attack came from a blank email with an attachment payload. Not even any text. But some people out there will open it. Often the "score" is very little. By comparison, spear-phishing is a qualitative practice. Target a small group of individuals. Research their personalities. Reach out to them with highly individualized content. They just might open an email or attachment. And the "score" here is much bigger. The biggest attacks are known as whaling, for a good reason.

A evolved type of spear-phishing campaign takes whaling to a whole new level. It's sneaky. It insinuates itself into an in-progress email conversation, interjecting itself, hijacking the conversation, but doing so in a very believable way. And, we could speculate, does so at the one moment where users will pay even less attention to the authenticity of an email because it is a reply to an existing discussion. These emails are not dropping in out of the blue sky and undergoing the usual recognition checks that users make, they already seem part of a regular conversation.

A recent Microsoft Office weakness has contributed to making this development possible. Microsoft has subsequently issued a patch, but the point is that it has taught hackers how to appear even more authentic to the one person that holds the value in an organization.

The latest -- still-active -- campaign which confirms the trend, was analyzed by Palo Alto Networks' Unit 42 research team. The hacker sent customized decoy content from multiple compromised email accounts from a legitimate domain in north-east Asia that delivered a PoohMilk and Freenki malware payload.

PoohMilk is a first stage loader, and after a successful exploitation, it sets persistence in the registry with the appropriate command line argument to execute the second stage payload, Freenki. This piece of malware collects host information and then serves as a second stage downloader.

To avoid successful detection, the hacker was observed to rotate the second stage downloader loader, not always using Freenki. Unit 42 said this is intended to lower the chance of payload malware getting exposed to the security research community, as it hides its malicious behavior when being analyzed by automated analysis systems without the proper command line argument.

It's difficult to assess how commonplace this type of attack is becoming, because its targets are so small in number.

"We don't have any specific statistics on how widespread this is," Christopher Budd, senior threat communications manager at Palo Alto Networks told SecurityNow. "A key point is that this is so highly targeted that it requires a lot of focused work on the attacker's part: this inherently limits how widespread these kinds of attacks can be."

The current campaign continues with nothing to indicate it has ceased or run by its 'sell by' date.


You're invited to attend Light Reading's 11th annual Future of Cable Business Services event. Join us in New York on November 30 for the premier independent conference focusing on the cable industry's continuing efforts in the commercial services market – all cable operators and other communications service providers get in free. 

"We can't say conclusively how long it's been underway," said Budd. "We have observed characteristics shared between this campaign and previous attacks noted in January and August 2016."

So, it's a new attack concept, that largely relies on a lack of patching and other security to break in. In the same way that someone receiving an email reply in a conversation wouldn't likely look closely at the authenticity, they may also worry so little about this attack (or not even know about it) to the point where they feel their patching and security is sufficient. And that's the problem.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-20752
PUBLISHED: 2022-07-06
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a timing attack. This vulnerability is due to insufficient pro...
CVE-2022-20768
PUBLISHED: 2022-07-06
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of certain unencrypted credentials....
CVE-2022-20791
PUBLISHED: 2022-07-06
A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an auth...
CVE-2022-20800
PUBLISHED: 2022-07-06
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity ...
CVE-2022-20808
PUBLISHED: 2022-07-06
A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect handling of multiple simultaneous device registrations on Cisco SSM On-Prem. ...