Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/11/2019
05:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Trickbot Operators Now Selling Attack Tools to APT Actors

North Korea's Lazarus Group - of Sony breach and WannaCry fame - is among the first customers.

The operators of the prolific Trickbot banking botnet have begun offering advanced persistent threat actors access to a sophisticated new attack toolset called Anchor for exploiting the networks of high-value targets that the malware previously has compromised.

Researchers at security vendor SentinelOne's newly established SentinelLabs recently spotted North Korea's notorious state-backed Lazarus Group using the toolset to deploy one of its own malware samples on the network of an Anchor victim.

The discovery is significant because financially motivated crimeware operations like Trickbot so far mostly operated completely separately from APT campaigns — especially state-backed ones — that are typically more focused on data theft, surveillance, and other long-tailed activities.

"The maturity of the crimeware models and convergence of threats force us to rethink our defenses," says Vitali Kremez, lead cybersecurity researcher at SentinelLabs.

"Criminals and the nation-state are hunting for high-value targets and [collaborating] on their breach accesses," he says. Organizations now have to be concerned not just about criminal groups, but of crimeware threats that might mature into APT activity, Kremez notes.

Trickbot's operators, who started in 2016 by using the malware to steal money from online banking accounts, have over the years morphed into a massive crimeware-as-a-service operation. Trickbot itself has evolved from a tool for stealing bank account login information to a tool that can perform a variety of malicious functions — including delivering ransomware, banking Trojans, and cryptominers.

The operators of Trickbot have built a database of information on networks that they have compromised, which other attackers can access and use for a fee to deliver ransomware and carry out attacks of their own.

So far, Trickbot's crimeware-as-a-service offering has targeted mainly other financially motivated affiliates. But with the Anchor project, Trickbot's business model appears to have expanded, according to SentinelLabs.

"It was a separate hidden project and/or fork from the main Trickbot malware codebase," Kremez says. It appears to have been developed for high-value targets and intrusions and multiple APT groups are currently using it, he says. 

The Anchor attack framework includes tools ranging from a sophisticated malware installer to a clean-up tool for wiping clean all evidence of an attack. It includes mechanisms that allow attackers to load legitimate frameworks such as Metasploit, Cobalt Strike, and PowerShell Empire and use them for post-compromise exploitation, SentinelLabs said.

"Anchor presents as an all-in-one attack framework designed to compromise enterprise environments using both custom and existing toolage," the vendor noted. It gives APT actors a way to do targeted data-extraction and to remain undetected on compromised networks for a long time.

Mutually Beneficial

For an operation like the Lazarus Group, Trickbot's Anchor project is especially useful. The group, best known for its attacks on Sony as well as its abuse of the SWIFT financial network to steal tens of millions of dollars from the Bank of Bangadesh, is a somewhat rare APT threat actor. As an arm of the North Korean regime, the Lazarus Group is not just focused on data theft, but also on financially motivated attacks in support of the cash-starved government.

Some see the WannaCry ransomware attacks and the attacks via the SWIFT network as example of the group's efforts to raise money for the North Korean government.

For the Lazarus Group, the primary benefit of the Trickbot Anchor tie-up "is access to compromised high-value targets for further post-exploitation and monetization without the need to run their own campaign," Kremez says.

And the use of third-party tools such as those from Trickbot can also help make attribution harder for investigators.

SentinelLabs' research suggests a working relationship between Lazarus Group members and some of the criminals behind Trickbot Anchor, which allows them to have a mutually beneficial financial relationship, Kremez says. "We believe it might be a partnership agreement given our knowledge of how the groups operate in a very private protective manner," and only with the most trusted partners, he says.

APT groups are not the only focus, however. According to SentinelLabs, the Anchor attack toolset is also being used in large-scale cyber heists and attacks on point-of-sale systems.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Security 101: What Is a Man-in-the-Middle Attack?"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5524
PUBLISHED: 2020-02-21
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.
CVE-2020-5525
PUBLISHED: 2020-02-21
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen.
CVE-2020-5533
PUBLISHED: 2020-02-21
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-5534
PUBLISHED: 2020-02-21
Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors.
CVE-2014-7914
PUBLISHED: 2020-02-21
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.