A new malware technique is making phishing attacks harder to spot when they succeed.

3 Min Read

Modular downloaders aren't new to the world of malware, but a new campaign featuring modular software launched by a major criminal group is drawing the attention of threat researchers. The attacks, so far targeting Russia and the former Soviet republics of the Commonwealth of Independent States (CIS), could presage new tactics aimed at victims around the world.

Researchers at Proofpoint discovered a pair of modular downloaders this summer and noticed two unusual factors in their use. First, the loaders were conducting reconnaissance on the infected system to decide whether the full payload will be downloaded. Second, the loaders, with very small and carefully obfuscated footprints, were being launched by the Cobalt Group, a major criminal organization previously tied to activities such as ATM jackpotting and to other large criminal groups.

"This is the first time we've seen a real shift to have a number of major actors using these tiny downloaders," says Chris Dawson, threat intelligence lead at Proofpoint. The new modular downloader — dubbed "CobInt" by researchers at Group-IB for the organization launching the attack and the name of a .DLL used in the malware — is "small, it's stealthy, and it's pretty well-obfuscated," he adds. "It's difficult to detect if you don't know what you're looking for."  

The process of infecting a target machine is a three-step flow, with each step adding functionality, Dawson explains. The first module is an email with an attachment carrying the initial exploit. If the exploit code, typically a .VBS exploit, can execute, it immediately sends a request for the second-stage downloader. This downloader, written in C, will do reconnaissance on the target system to determine whether certain security measures are running, the system is within a sandbox, or has qualities indicating that it might trap the malware. If the system is "clean" (from the malware's perspective), then it downloads the final payload and establishes persistence on the computer.

Each of the three modules is small and uses multiple layers of obfuscation to avoid detection. "It's unusual to see this level of obfuscation, and we've seen it three times in a row by high-profile actors," says Dawson, referring to separate campaigns researchers have found using the same modular software in the space of a few weeks.

And while the process has multiple steps, it doesn't mean that security professionals can look for the malware at their leisure. "The total time is seconds — it's very quick," Dawson says.

So far, the specific code in use is particular to one criminal organization, and Dawson thinks it will stay that way. "This is likely going to remain a Cobalt Group tool. Aside from using Cobalt Strike, which is a readily available tool, they use custom software," he explains.

But in the world of criminal IT activity, the Cobalt Group's success will be noticed. "We've seen these techniques spreading through other groups," Dawson says. "We see a group that tends to be a good barometer using the technique, and if TA505 is using this, it indicates that others with follow in their wake."

Asked whether he sees these campaigns spreading outside the CIS states, Dawson points out that they are, so far, very specific. "In general, it's Russian language [phishing] hitting organizations in the region," he says. But there's no technical reason that another group can't adopt the technique — if not the actual code — for use anywhere in the world.

Related content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights