Attacks/Breaches

9/12/2018
05:30 PM
50%
50%

Modular Malware Brings Stealthy Attacks to Former Soviet States

A new malware technique is making phishing attacks harder to spot when they succeed.

Modular downloaders aren't new to the world of malware, but a new campaign featuring modular software launched by a major criminal group is drawing the attention of threat researchers. The attacks, so far targeting Russia and the former Soviet republics of the Commonwealth of Independent States (CIS), could presage new tactics aimed at victims around the world.

Researchers at Proofpoint discovered a pair of modular downloaders this summer and noticed two unusual factors in their use. First, the loaders were conducting reconnaissance on the infected system to decide whether the full payload will be downloaded. Second, the loaders, with very small and carefully obfuscated footprints, were being launched by the Cobalt Group, a major criminal organization previously tied to activities such as ATM jackpotting and to other large criminal groups.

"This is the first time we've seen a real shift to have a number of major actors using these tiny downloaders," says Chris Dawson, threat intelligence lead at Proofpoint. The new modular downloader — dubbed "CobInt" by researchers at Group-IB for the organization launching the attack and the name of a .DLL used in the malware — is "small, it's stealthy, and it's pretty well-obfuscated," he adds. "It's difficult to detect if you don't know what you're looking for."  

The process of infecting a target machine is a three-step flow, with each step adding functionality, Dawson explains. The first module is an email with an attachment carrying the initial exploit. If the exploit code, typically a .VBS exploit, can execute, it immediately sends a request for the second-stage downloader. This downloader, written in C, will do reconnaissance on the target system to determine whether certain security measures are running, the system is within a sandbox, or has qualities indicating that it might trap the malware. If the system is "clean" (from the malware's perspective), then it downloads the final payload and establishes persistence on the computer.

Each of the three modules is small and uses multiple layers of obfuscation to avoid detection. "It's unusual to see this level of obfuscation, and we've seen it three times in a row by high-profile actors," says Dawson, referring to separate campaigns researchers have found using the same modular software in the space of a few weeks.

And while the process has multiple steps, it doesn't mean that security professionals can look for the malware at their leisure. "The total time is seconds — it's very quick," Dawson says.

So far, the specific code in use is particular to one criminal organization, and Dawson thinks it will stay that way. "This is likely going to remain a Cobalt Group tool. Aside from using Cobalt Strike, which is a readily available tool, they use custom software," he explains.

But in the world of criminal IT activity, the Cobalt Group's success will be noticed. "We've seen these techniques spreading through other groups," Dawson says. "We see a group that tends to be a good barometer using the technique, and if TA505 is using this, it indicates that others with follow in their wake."

Asked whether he sees these campaigns spreading outside the CIS states, Dawson points out that they are, so far, very specific. "In general, it's Russian language [phishing] hitting organizations in the region," he says. But there's no technical reason that another group can't adopt the technique — if not the actual code — for use anywhere in the world.

Related content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...
CVE-2018-19829
PUBLISHED: 2018-12-18
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVE-2018-16884
PUBLISHED: 2018-12-18
A flaw was found in the Linux kernel in the NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel id and cause a use-after-free. Thus a malicious container user can cause a host kernel memory corruption and a system ...
CVE-2018-17777
PUBLISHED: 2018-12-18
An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have acc...
CVE-2018-18921
PUBLISHED: 2018-12-18
PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.