Attacks/Breaches

1/24/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cyberattackers Bait Financial Firms with Google Cloud Platform

A new wave of attacks abuses the Google Cloud Platform URL redirection in PDF decoys, sending users to a malicious link.

Researchers have spotted a trend in targeted themed attacks using the App Engine Google Cloud Platform (GCP) to deliver malware via PDF decoys. The threat has so far been detected across 42 organizations, mostly in the financial sector but also within governments worldwide.

This attack is more convincing than traditional attacks because the URL hosting the malware redirects the host URL to Google App Engine, explain Netskope analysts in findings published today. Many decoys used were likely linked to threat actor group Cobalt Strike, they report.

Netskope's discovery was made earlier this year, when researchers saw common detections across 42 of its customers in the banking and finance industry. Further investigation showed detections were triggered by attachments in eml files; analysis revealed attacks were abusing Google App Engine on the GCP as bait to deliver malware to targets.

"URL redirection mechanisms/features are widely used and abused by threat actors to deceive victims into believing the malicious files are being delivered from a trusted source," says Ashwin Vamshi, a Netskope security researcher and author of the report. "The usage of themed PDF decoys with enticing emails is a perfect choice since the payload seems to be originating from a trusted source, and popular PDF viewers enable users to easily whitelist domains."

Sneak Attack, PDF Style
PDF decoys typically arrive attached to emails designed to contain legitimate content and appear as though they're coming from whitelisted sources. In this case, victims are tricked with a GoogleApp Engine URL, which is abused to redirect victims to malware. Because GCP is a trusted source among enterprise users, targets are unlikely to know they're being duped.

Most PDFs were created using Adobe Acrobat 18.0 and contain the malicious link. All decoys use HTTPS URLs to deliver the payload. Once they execute the PDF decoy and click the link, victims are logged out of Google App Engine and a response status code 302 is generated for URL redirection. Victims are taken to a landing page where a malicious file is downloaded onto their machines. In all cases, GCP App Engine validated the redirection and delivered the payload.

The payload is a Microsoft Word document containing obfuscated macro code or PDF documents as the second-stage payload. When executed, it displays a message to victims prompting them to enable editing and content mode to view the file. If enabled, the macro is executed and downloads another stage payload, a tactic that makes attacks harder to analyze.

PDF readers typically alert users when a document connects to a website with a "remember this action" pop-up, researchers say. If users check the box, future URLs within the domain will connect without any prompt. Attackers can abuse this, launching several attacks without users seeing any kind of security warning after they approve redirection in their first notification.

Admins may also have appengine.google.com whitelisted for legitimate reasons, another factor that makes it easier for adversaries to succeed with this type of attack.

Cobalt Strikes Again
The Cobalt Strike threat group has a reputation for using various tactics, techniques, and procedures to target financial and banking firms using malware like Carbanak. It's also known for using Cobalt Strike software, a white hat tool for conducting security assessments.

The pattern continues in this series of attacks, which hit a range of financial and government targets across geographies. Victims included OmniPay (Asia), Metrobank Philippines, Travelex foreign exchange business, SKB Bank and RGS Bank in Russia, Bancosol, BancNet Online, India's Ministry of External Affairs, Accuity, Bank of Alexandria, and Standard Bank, South Africa.

"Based on the timeline of the emails sent to the potential targets, we expect the group to be actively carrying out attacks," Vamshi says. The report notes that while emails were sent to targets from the threat actor, it's possible the address may be spoofed with a forged sender.

Netskope reported the abuse to Google on Jan. 10. Google responded by saying the open redirector exists by design. For those unfamiliar, open redirectors take users from a Google URL to another site chosen by whoever constructed the link. Since the attached URL in these malicious files is an unvalidated redirect, users are unknowingly taken to a malicious page.

Users can recognize URL redirection abuse by hovering their mouse over hyperlinks before they click, Vamshi says. Organizations, especially financial institutions, should teach employees to recognize AWS, Azure, and GCP URLs so they can discern legitimate and malicious sites.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JanVanderine
100%
0%
JanVanderine,
User Rank: Apprentice
1/25/2019 | 10:24:03 AM
Re: At the very end
Reisen,

Part of the problem is condescending security snobs who ridicule users because those users don't know everything. If is not the salesperson's job to be a security geek. It is not the accountant's job to be a security geek. That same accountant could be sitting there thinking, "Wow, Reisen doesn't even know how to run a balance sheet with 3 year backwards depreciation - what an idiot. Impressed. Not." 

If you really are a security professional, part of YOUR job is to make "security life" easier for other people. If that means telling them something YOU think is "1st grade skills" but they may never have been exposed to, then perhaps you should suck it up buttercup and help educate the masses instead of being part of the problem.
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.