Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/11/2019
05:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Trickbot Operators Now Selling Attack Tools to APT Actors

North Korea's Lazarus Group - of Sony breach and WannaCry fame - is among the first customers.

The operators of the prolific Trickbot banking botnet have begun offering advanced persistent threat actors access to a sophisticated new attack toolset called Anchor for exploiting the networks of high-value targets that the malware previously has compromised.

Researchers at security vendor SentinelOne's newly established SentinelLabs recently spotted North Korea's notorious state-backed Lazarus Group using the toolset to deploy one of its own malware samples on the network of an Anchor victim.

The discovery is significant because financially motivated crimeware operations like Trickbot so far mostly operated completely separately from APT campaigns — especially state-backed ones — that are typically more focused on data theft, surveillance, and other long-tailed activities.

"The maturity of the crimeware models and convergence of threats force us to rethink our defenses," says Vitali Kremez, lead cybersecurity researcher at SentinelLabs.

"Criminals and the nation-state are hunting for high-value targets and [collaborating] on their breach accesses," he says. Organizations now have to be concerned not just about criminal groups, but of crimeware threats that might mature into APT activity, Kremez notes.

Trickbot's operators, who started in 2016 by using the malware to steal money from online banking accounts, have over the years morphed into a massive crimeware-as-a-service operation. Trickbot itself has evolved from a tool for stealing bank account login information to a tool that can perform a variety of malicious functions — including delivering ransomware, banking Trojans, and cryptominers.

The operators of Trickbot have built a database of information on networks that they have compromised, which other attackers can access and use for a fee to deliver ransomware and carry out attacks of their own.

So far, Trickbot's crimeware-as-a-service offering has targeted mainly other financially motivated affiliates. But with the Anchor project, Trickbot's business model appears to have expanded, according to SentinelLabs.

"It was a separate hidden project and/or fork from the main Trickbot malware codebase," Kremez says. It appears to have been developed for high-value targets and intrusions and multiple APT groups are currently using it, he says. 

The Anchor attack framework includes tools ranging from a sophisticated malware installer to a clean-up tool for wiping clean all evidence of an attack. It includes mechanisms that allow attackers to load legitimate frameworks such as Metasploit, Cobalt Strike, and PowerShell Empire and use them for post-compromise exploitation, SentinelLabs said.

"Anchor presents as an all-in-one attack framework designed to compromise enterprise environments using both custom and existing toolage," the vendor noted. It gives APT actors a way to do targeted data-extraction and to remain undetected on compromised networks for a long time.

Mutually Beneficial

For an operation like the Lazarus Group, Trickbot's Anchor project is especially useful. The group, best known for its attacks on Sony as well as its abuse of the SWIFT financial network to steal tens of millions of dollars from the Bank of Bangadesh, is a somewhat rare APT threat actor. As an arm of the North Korean regime, the Lazarus Group is not just focused on data theft, but also on financially motivated attacks in support of the cash-starved government.

Some see the WannaCry ransomware attacks and the attacks via the SWIFT network as example of the group's efforts to raise money for the North Korean government.

For the Lazarus Group, the primary benefit of the Trickbot Anchor tie-up "is access to compromised high-value targets for further post-exploitation and monetization without the need to run their own campaign," Kremez says.

And the use of third-party tools such as those from Trickbot can also help make attribution harder for investigators.

SentinelLabs' research suggests a working relationship between Lazarus Group members and some of the criminals behind Trickbot Anchor, which allows them to have a mutually beneficial financial relationship, Kremez says. "We believe it might be a partnership agreement given our knowledge of how the groups operate in a very private protective manner," and only with the most trusted partners, he says.

APT groups are not the only focus, however. According to SentinelLabs, the Anchor attack toolset is also being used in large-scale cyber heists and attacks on point-of-sale systems.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Security 101: What Is a Man-in-the-Middle Attack?"

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9351
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with a verbose error showing where the application resides (the a...
CVE-2020-9352
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter.
CVE-2020-9353
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML ...
CVE-2020-9354
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL allows an unauthenticated attacker to overwrite files via vectors involving an XML comment and /.. pat...
CVE-2020-9355
PUBLISHED: 2020-02-23
danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.