Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/24/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Cyberattackers Bait Financial Firms with Google Cloud Platform

A new wave of attacks abuses the Google Cloud Platform URL redirection in PDF decoys, sending users to a malicious link.

Researchers have spotted a trend in targeted themed attacks using the App Engine Google Cloud Platform (GCP) to deliver malware via PDF decoys. The threat has so far been detected across 42 organizations, mostly in the financial sector but also within governments worldwide.

This attack is more convincing than traditional attacks because the URL hosting the malware redirects the host URL to Google App Engine, explain Netskope analysts in findings published today. Many decoys used were likely linked to threat actor group Cobalt Strike, they report.

Netskope's discovery was made earlier this year, when researchers saw common detections across 42 of its customers in the banking and finance industry. Further investigation showed detections were triggered by attachments in eml files; analysis revealed attacks were abusing Google App Engine on the GCP as bait to deliver malware to targets.

"URL redirection mechanisms/features are widely used and abused by threat actors to deceive victims into believing the malicious files are being delivered from a trusted source," says Ashwin Vamshi, a Netskope security researcher and author of the report. "The usage of themed PDF decoys with enticing emails is a perfect choice since the payload seems to be originating from a trusted source, and popular PDF viewers enable users to easily whitelist domains."

Sneak Attack, PDF Style
PDF decoys typically arrive attached to emails designed to contain legitimate content and appear as though they're coming from whitelisted sources. In this case, victims are tricked with a GoogleApp Engine URL, which is abused to redirect victims to malware. Because GCP is a trusted source among enterprise users, targets are unlikely to know they're being duped.

Most PDFs were created using Adobe Acrobat 18.0 and contain the malicious link. All decoys use HTTPS URLs to deliver the payload. Once they execute the PDF decoy and click the link, victims are logged out of Google App Engine and a response status code 302 is generated for URL redirection. Victims are taken to a landing page where a malicious file is downloaded onto their machines. In all cases, GCP App Engine validated the redirection and delivered the payload.

The payload is a Microsoft Word document containing obfuscated macro code or PDF documents as the second-stage payload. When executed, it displays a message to victims prompting them to enable editing and content mode to view the file. If enabled, the macro is executed and downloads another stage payload, a tactic that makes attacks harder to analyze.

PDF readers typically alert users when a document connects to a website with a "remember this action" pop-up, researchers say. If users check the box, future URLs within the domain will connect without any prompt. Attackers can abuse this, launching several attacks without users seeing any kind of security warning after they approve redirection in their first notification.

Admins may also have appengine.google.com whitelisted for legitimate reasons, another factor that makes it easier for adversaries to succeed with this type of attack.

Cobalt Strikes Again
The Cobalt Strike threat group has a reputation for using various tactics, techniques, and procedures to target financial and banking firms using malware like Carbanak. It's also known for using Cobalt Strike software, a white hat tool for conducting security assessments.

The pattern continues in this series of attacks, which hit a range of financial and government targets across geographies. Victims included OmniPay (Asia), Metrobank Philippines, Travelex foreign exchange business, SKB Bank and RGS Bank in Russia, Bancosol, BancNet Online, India's Ministry of External Affairs, Accuity, Bank of Alexandria, and Standard Bank, South Africa.

"Based on the timeline of the emails sent to the potential targets, we expect the group to be actively carrying out attacks," Vamshi says. The report notes that while emails were sent to targets from the threat actor, it's possible the address may be spoofed with a forged sender.

Netskope reported the abuse to Google on Jan. 10. Google responded by saying the open redirector exists by design. For those unfamiliar, open redirectors take users from a Google URL to another site chosen by whoever constructed the link. Since the attached URL in these malicious files is an unvalidated redirect, users are unknowingly taken to a malicious page.

Users can recognize URL redirection abuse by hovering their mouse over hyperlinks before they click, Vamshi says. Organizations, especially financial institutions, should teach employees to recognize AWS, Azure, and GCP URLs so they can discern legitimate and malicious sites.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JanVanderine
100%
0%
JanVanderine,
User Rank: Apprentice
1/25/2019 | 10:24:03 AM
Re: At the very end
Reisen,

Part of the problem is condescending security snobs who ridicule users because those users don't know everything. If is not the salesperson's job to be a security geek. It is not the accountant's job to be a security geek. That same accountant could be sitting there thinking, "Wow, Reisen doesn't even know how to run a balance sheet with 3 year backwards depreciation - what an idiot. Impressed. Not." 

If you really are a security professional, part of YOUR job is to make "security life" easier for other people. If that means telling them something YOU think is "1st grade skills" but they may never have been exposed to, then perhaps you should suck it up buttercup and help educate the masses instead of being part of the problem.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27652
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27653
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27654
PUBLISHED: 2020-10-29
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
CVE-2020-27655
PUBLISHED: 2020-10-29
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
CVE-2020-27656
PUBLISHED: 2020-10-29
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.