Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/20/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trickbot Variant Uses URL Redirection to Spread

Switch in tactic is the latest attempt by operators of the prolific banking Trojan to slip past detection mechanisms.

The authors of the Trickbot banking Trojan have once again begun using URL redirection instead of malicious email attachments to spread their malware. It is the latest example of how cybercriminals constantly evolve — and sometimes recycle — their tactics to stay ahead of defenders.

Security researchers from Trend Micro on Monday said they had recently discovered a new variant of Trickbot arriving via redirection URL in a spam mail message. The URL appears to point toward a Google domain but instead redirects users who click on it to a site that downloads Trickbot on the user's system.

The content of the spam email purports to be about a processed order that is ready for shipping, Trend Micro said. The email contains what appears to be a tracking number for the package, standard delivery disclaimers, contact details of the purported sender, and even social media icons for lending additional authenticity to the email.

If a user gets tricked into clicking on the embedded URL in the email, the user is routed to a Trickbot download site that is designed to appear like a Web page for reviewing online orders.

The site downloads a compressed file that contains a Visual Basic Script for downloading Trickbot. Once the malware is executed on the system, it quickly deploys additional modules for various tasks, such as stealing browser data, injecting malicious code into browsers for monitoring online banking activity, searching through files on the infected machine, and profiling the network.

"Utilizing a URL redirection from a known domain is a tactic used by other bad actors to fool unsuspecting victims into thinking the embedded URL within an email is legitimate," says Jon Clay, marketing manager at Trend Micro.

The developers of Trickbot know that many users might do a cursory review of the embedded URLs and are more likely to click on them if they see a legitimate domain. They also know that many users are accustomed to seeing redirect notices when pop-ups appear and are therefore unlikely to be alarmed when they see the requests, Clay says.

"The significance of this new tactic is that, once again, the developers of Trickbot — and many other malware families — are constantly shifting their attack strategies to not only fool their victims, but also to make it more difficult for security solutions to detect their threat," he says.

A Persistent Threat
Trickbot first surfaced in 2016 and has remained a major threat ever since to online banking customers in several countries, including the US, UK, and Australia. In the US, the malware has targeted users of numerous major banks and credit card companies, including Chase, Bank of America, American Express, and Discover.

Security researchers have described the malware as being sophisticated, stealthy, and capable of evading sandboxes and other detection and blocking measures. Among other things, Trickbot is designed to steal the usernames and passwords that people use for accessing their online banking accounts and transmit the credentials to the criminals behind the operation so it can be used to steal money.

In the first quarter of 2019, Trickbot was among the most active banking Trojans in the wild, according to Trend Micro's data. The only other banking malware that was consistently more active during that period was Emotet.

Trickbot's operators have typically distributed the malware via malicious attachments in spam email. The attachments — usually a Microsoft Word or an Excel document — appear to be an invoice or other financial statement that prompt users to enable macros, which then download and execute the malware. However, they have also used URL redirection in the past to spread the malware.

Threat actors often use redirection as a way to get around Web reputation technologies that are becoming increasingly better at detecting malicious URLs, Clay says. In some cases, Trend Micro has observed adversaries using multiple redirects as part of the infection chain in an effort to thwart security detections, he says. 

"Bad actors are looking to compromise legitimate Web pages and install redirects more and more as it has been an effective strategy to evade detection," Clay notes.

The trend highlights the need for organizations to have capabilities for assessing Web reputation and scanning for embedded URLs within emails. They also need to be able to detect and analyze multiple redirects during a session, Clay says. In addition, organizations need to educate users on how to recognize illegitimate pop-ups and on the danger of enabling Macros in a pop-up, he says.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-0234
PUBLISHED: 2019-07-15
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of ...
CVE-2018-7838
PUBLISHED: 2019-07-15
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP C...
CVE-2019-6822
PUBLISHED: 2019-07-15
A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.
CVE-2019-6823
PUBLISHED: 2019-07-15
A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.
CVE-2019-6824
PUBLISHED: 2019-07-15
A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.