Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/20/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trickbot Variant Uses URL Redirection to Spread

Switch in tactic is the latest attempt by operators of the prolific banking Trojan to slip past detection mechanisms.

The authors of the Trickbot banking Trojan have once again begun using URL redirection instead of malicious email attachments to spread their malware. It is the latest example of how cybercriminals constantly evolve — and sometimes recycle — their tactics to stay ahead of defenders.

Security researchers from Trend Micro on Monday said they had recently discovered a new variant of Trickbot arriving via redirection URL in a spam mail message. The URL appears to point toward a Google domain but instead redirects users who click on it to a site that downloads Trickbot on the user's system.

The content of the spam email purports to be about a processed order that is ready for shipping, Trend Micro said. The email contains what appears to be a tracking number for the package, standard delivery disclaimers, contact details of the purported sender, and even social media icons for lending additional authenticity to the email.

If a user gets tricked into clicking on the embedded URL in the email, the user is routed to a Trickbot download site that is designed to appear like a Web page for reviewing online orders.

The site downloads a compressed file that contains a Visual Basic Script for downloading Trickbot. Once the malware is executed on the system, it quickly deploys additional modules for various tasks, such as stealing browser data, injecting malicious code into browsers for monitoring online banking activity, searching through files on the infected machine, and profiling the network.

"Utilizing a URL redirection from a known domain is a tactic used by other bad actors to fool unsuspecting victims into thinking the embedded URL within an email is legitimate," says Jon Clay, marketing manager at Trend Micro.

The developers of Trickbot know that many users might do a cursory review of the embedded URLs and are more likely to click on them if they see a legitimate domain. They also know that many users are accustomed to seeing redirect notices when pop-ups appear and are therefore unlikely to be alarmed when they see the requests, Clay says.

"The significance of this new tactic is that, once again, the developers of Trickbot — and many other malware families — are constantly shifting their attack strategies to not only fool their victims, but also to make it more difficult for security solutions to detect their threat," he says.

A Persistent Threat
Trickbot first surfaced in 2016 and has remained a major threat ever since to online banking customers in several countries, including the US, UK, and Australia. In the US, the malware has targeted users of numerous major banks and credit card companies, including Chase, Bank of America, American Express, and Discover.

Security researchers have described the malware as being sophisticated, stealthy, and capable of evading sandboxes and other detection and blocking measures. Among other things, Trickbot is designed to steal the usernames and passwords that people use for accessing their online banking accounts and transmit the credentials to the criminals behind the operation so it can be used to steal money.

In the first quarter of 2019, Trickbot was among the most active banking Trojans in the wild, according to Trend Micro's data. The only other banking malware that was consistently more active during that period was Emotet.

Trickbot's operators have typically distributed the malware via malicious attachments in spam email. The attachments — usually a Microsoft Word or an Excel document — appear to be an invoice or other financial statement that prompt users to enable macros, which then download and execute the malware. However, they have also used URL redirection in the past to spread the malware.

Threat actors often use redirection as a way to get around Web reputation technologies that are becoming increasingly better at detecting malicious URLs, Clay says. In some cases, Trend Micro has observed adversaries using multiple redirects as part of the infection chain in an effort to thwart security detections, he says. 

"Bad actors are looking to compromise legitimate Web pages and install redirects more and more as it has been an effective strategy to evade detection," Clay notes.

The trend highlights the need for organizations to have capabilities for assessing Web reputation and scanning for embedded URLs within emails. They also need to be able to detect and analyze multiple redirects during a session, Clay says. In addition, organizations need to educate users on how to recognize illegitimate pop-ups and on the danger of enabling Macros in a pop-up, he says.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16349
PUBLISHED: 2019-09-16
Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4_TrunAtom class.
CVE-2019-16350
PUBLISHED: 2019-09-16
ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c.
CVE-2019-16351
PUBLISHED: 2019-09-16
ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c.
CVE-2019-16352
PUBLISHED: 2019-09-16
ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.
CVE-2016-10967
PUBLISHED: 2019-09-16
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.