Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Modular Malware Brings Stealthy Attacks to Former Soviet States

A new malware technique is making phishing attacks harder to spot when they succeed.

Modular downloaders aren't new to the world of malware, but a new campaign featuring modular software launched by a major criminal group is drawing the attention of threat researchers. The attacks, so far targeting Russia and the former Soviet republics of the Commonwealth of Independent States (CIS), could presage new tactics aimed at victims around the world.

Researchers at Proofpoint discovered a pair of modular downloaders this summer and noticed two unusual factors in their use. First, the loaders were conducting reconnaissance on the infected system to decide whether the full payload will be downloaded. Second, the loaders, with very small and carefully obfuscated footprints, were being launched by the Cobalt Group, a major criminal organization previously tied to activities such as ATM jackpotting and to other large criminal groups.

"This is the first time we've seen a real shift to have a number of major actors using these tiny downloaders," says Chris Dawson, threat intelligence lead at Proofpoint. The new modular downloader — dubbed "CobInt" by researchers at Group-IB for the organization launching the attack and the name of a .DLL used in the malware — is "small, it's stealthy, and it's pretty well-obfuscated," he adds. "It's difficult to detect if you don't know what you're looking for."  

The process of infecting a target machine is a three-step flow, with each step adding functionality, Dawson explains. The first module is an email with an attachment carrying the initial exploit. If the exploit code, typically a .VBS exploit, can execute, it immediately sends a request for the second-stage downloader. This downloader, written in C, will do reconnaissance on the target system to determine whether certain security measures are running, the system is within a sandbox, or has qualities indicating that it might trap the malware. If the system is "clean" (from the malware's perspective), then it downloads the final payload and establishes persistence on the computer.

Each of the three modules is small and uses multiple layers of obfuscation to avoid detection. "It's unusual to see this level of obfuscation, and we've seen it three times in a row by high-profile actors," says Dawson, referring to separate campaigns researchers have found using the same modular software in the space of a few weeks.

And while the process has multiple steps, it doesn't mean that security professionals can look for the malware at their leisure. "The total time is seconds — it's very quick," Dawson says.

So far, the specific code in use is particular to one criminal organization, and Dawson thinks it will stay that way. "This is likely going to remain a Cobalt Group tool. Aside from using Cobalt Strike, which is a readily available tool, they use custom software," he explains.

But in the world of criminal IT activity, the Cobalt Group's success will be noticed. "We've seen these techniques spreading through other groups," Dawson says. "We see a group that tends to be a good barometer using the technique, and if TA505 is using this, it indicates that others with follow in their wake."

Asked whether he sees these campaigns spreading outside the CIS states, Dawson points out that they are, so far, very specific. "In general, it's Russian language [phishing] hitting organizations in the region," he says. But there's no technical reason that another group can't adopt the technique — if not the actual code — for use anywhere in the world.

Related content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15540
PUBLISHED: 2019-08-25
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVE-2019-15538
PUBLISHED: 2019-08-25
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.