Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/24/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Cyberattackers Bait Financial Firms with Google Cloud Platform

A new wave of attacks abuses the Google Cloud Platform URL redirection in PDF decoys, sending users to a malicious link.

Researchers have spotted a trend in targeted themed attacks using the App Engine Google Cloud Platform (GCP) to deliver malware via PDF decoys. The threat has so far been detected across 42 organizations, mostly in the financial sector but also within governments worldwide.

This attack is more convincing than traditional attacks because the URL hosting the malware redirects the host URL to Google App Engine, explain Netskope analysts in findings published today. Many decoys used were likely linked to threat actor group Cobalt Strike, they report.

Netskope's discovery was made earlier this year, when researchers saw common detections across 42 of its customers in the banking and finance industry. Further investigation showed detections were triggered by attachments in eml files; analysis revealed attacks were abusing Google App Engine on the GCP as bait to deliver malware to targets.

"URL redirection mechanisms/features are widely used and abused by threat actors to deceive victims into believing the malicious files are being delivered from a trusted source," says Ashwin Vamshi, a Netskope security researcher and author of the report. "The usage of themed PDF decoys with enticing emails is a perfect choice since the payload seems to be originating from a trusted source, and popular PDF viewers enable users to easily whitelist domains."

Sneak Attack, PDF Style
PDF decoys typically arrive attached to emails designed to contain legitimate content and appear as though they're coming from whitelisted sources. In this case, victims are tricked with a GoogleApp Engine URL, which is abused to redirect victims to malware. Because GCP is a trusted source among enterprise users, targets are unlikely to know they're being duped.

Most PDFs were created using Adobe Acrobat 18.0 and contain the malicious link. All decoys use HTTPS URLs to deliver the payload. Once they execute the PDF decoy and click the link, victims are logged out of Google App Engine and a response status code 302 is generated for URL redirection. Victims are taken to a landing page where a malicious file is downloaded onto their machines. In all cases, GCP App Engine validated the redirection and delivered the payload.

The payload is a Microsoft Word document containing obfuscated macro code or PDF documents as the second-stage payload. When executed, it displays a message to victims prompting them to enable editing and content mode to view the file. If enabled, the macro is executed and downloads another stage payload, a tactic that makes attacks harder to analyze.

PDF readers typically alert users when a document connects to a website with a "remember this action" pop-up, researchers say. If users check the box, future URLs within the domain will connect without any prompt. Attackers can abuse this, launching several attacks without users seeing any kind of security warning after they approve redirection in their first notification.

Admins may also have appengine.google.com whitelisted for legitimate reasons, another factor that makes it easier for adversaries to succeed with this type of attack.

Cobalt Strikes Again
The Cobalt Strike threat group has a reputation for using various tactics, techniques, and procedures to target financial and banking firms using malware like Carbanak. It's also known for using Cobalt Strike software, a white hat tool for conducting security assessments.

The pattern continues in this series of attacks, which hit a range of financial and government targets across geographies. Victims included OmniPay (Asia), Metrobank Philippines, Travelex foreign exchange business, SKB Bank and RGS Bank in Russia, Bancosol, BancNet Online, India's Ministry of External Affairs, Accuity, Bank of Alexandria, and Standard Bank, South Africa.

"Based on the timeline of the emails sent to the potential targets, we expect the group to be actively carrying out attacks," Vamshi says. The report notes that while emails were sent to targets from the threat actor, it's possible the address may be spoofed with a forged sender.

Netskope reported the abuse to Google on Jan. 10. Google responded by saying the open redirector exists by design. For those unfamiliar, open redirectors take users from a Google URL to another site chosen by whoever constructed the link. Since the attached URL in these malicious files is an unvalidated redirect, users are unknowingly taken to a malicious page.

Users can recognize URL redirection abuse by hovering their mouse over hyperlinks before they click, Vamshi says. Organizations, especially financial institutions, should teach employees to recognize AWS, Azure, and GCP URLs so they can discern legitimate and malicious sites.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JanVanderine
100%
0%
JanVanderine,
User Rank: Apprentice
1/25/2019 | 10:24:03 AM
Re: At the very end
Reisen,

Part of the problem is condescending security snobs who ridicule users because those users don't know everything. If is not the salesperson's job to be a security geek. It is not the accountant's job to be a security geek. That same accountant could be sitting there thinking, "Wow, Reisen doesn't even know how to run a balance sheet with 3 year backwards depreciation - what an idiot. Impressed. Not." 

If you really are a security professional, part of YOUR job is to make "security life" easier for other people. If that means telling them something YOU think is "1st grade skills" but they may never have been exposed to, then perhaps you should suck it up buttercup and help educate the masses instead of being part of the problem.
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18218
PUBLISHED: 2019-10-21
cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CVE-2019-18217
PUBLISHED: 2019-10-21
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.
CVE-2019-16862
PUBLISHED: 2019-10-21
Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.
CVE-2019-17409
PUBLISHED: 2019-10-21
Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.
CVE-2019-10715
PUBLISHED: 2019-10-21
There is Stored XSS in Verodin Director before 3.5.4.0 via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.