Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/20/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trickbot Variant Uses URL Redirection to Spread

Switch in tactic is the latest attempt by operators of the prolific banking Trojan to slip past detection mechanisms.

The authors of the Trickbot banking Trojan have once again begun using URL redirection instead of malicious email attachments to spread their malware. It is the latest example of how cybercriminals constantly evolve — and sometimes recycle — their tactics to stay ahead of defenders.

Security researchers from Trend Micro on Monday said they had recently discovered a new variant of Trickbot arriving via redirection URL in a spam mail message. The URL appears to point toward a Google domain but instead redirects users who click on it to a site that downloads Trickbot on the user's system.

The content of the spam email purports to be about a processed order that is ready for shipping, Trend Micro said. The email contains what appears to be a tracking number for the package, standard delivery disclaimers, contact details of the purported sender, and even social media icons for lending additional authenticity to the email.

If a user gets tricked into clicking on the embedded URL in the email, the user is routed to a Trickbot download site that is designed to appear like a Web page for reviewing online orders.

The site downloads a compressed file that contains a Visual Basic Script for downloading Trickbot. Once the malware is executed on the system, it quickly deploys additional modules for various tasks, such as stealing browser data, injecting malicious code into browsers for monitoring online banking activity, searching through files on the infected machine, and profiling the network.

"Utilizing a URL redirection from a known domain is a tactic used by other bad actors to fool unsuspecting victims into thinking the embedded URL within an email is legitimate," says Jon Clay, marketing manager at Trend Micro.

The developers of Trickbot know that many users might do a cursory review of the embedded URLs and are more likely to click on them if they see a legitimate domain. They also know that many users are accustomed to seeing redirect notices when pop-ups appear and are therefore unlikely to be alarmed when they see the requests, Clay says.

"The significance of this new tactic is that, once again, the developers of Trickbot — and many other malware families — are constantly shifting their attack strategies to not only fool their victims, but also to make it more difficult for security solutions to detect their threat," he says.

A Persistent Threat
Trickbot first surfaced in 2016 and has remained a major threat ever since to online banking customers in several countries, including the US, UK, and Australia. In the US, the malware has targeted users of numerous major banks and credit card companies, including Chase, Bank of America, American Express, and Discover.

Security researchers have described the malware as being sophisticated, stealthy, and capable of evading sandboxes and other detection and blocking measures. Among other things, Trickbot is designed to steal the usernames and passwords that people use for accessing their online banking accounts and transmit the credentials to the criminals behind the operation so it can be used to steal money.

In the first quarter of 2019, Trickbot was among the most active banking Trojans in the wild, according to Trend Micro's data. The only other banking malware that was consistently more active during that period was Emotet.

Trickbot's operators have typically distributed the malware via malicious attachments in spam email. The attachments — usually a Microsoft Word or an Excel document — appear to be an invoice or other financial statement that prompt users to enable macros, which then download and execute the malware. However, they have also used URL redirection in the past to spread the malware.

Threat actors often use redirection as a way to get around Web reputation technologies that are becoming increasingly better at detecting malicious URLs, Clay says. In some cases, Trend Micro has observed adversaries using multiple redirects as part of the infection chain in an effort to thwart security detections, he says. 

"Bad actors are looking to compromise legitimate Web pages and install redirects more and more as it has been an effective strategy to evade detection," Clay notes.

The trend highlights the need for organizations to have capabilities for assessing Web reputation and scanning for embedded URLs within emails. They also need to be able to detect and analyze multiple redirects during a session, Clay says. In addition, organizations need to educate users on how to recognize illegitimate pop-ups and on the danger of enabling Macros in a pop-up, he says.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.