Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

9/26/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Adwind RAT Squeaks Past Linux, Windows, macOS Defenses

A newer version of the Adwind 3.0 Trojan can elude the AV defenses of Linux, Windows and macOS systems, according to Talos and ReversingLabs.

The Adwind 3.0 remote access Trojan (RAT) is part of a new campaign where its developers have reconfigured the malware to allow it to gain traction within Linux, Microsoft Windows and Apple macOS systems, according to a new report.

Security researchers at Cisco Talos, along with additional observations made by ReversingLabs, saw a spam campaign that centered on Turkey. Even though ReversingLabs first discovered the campaign in early September, Talos researchers were able to trace the trail of it before then.

The Talos researchers found that the campaign first began on August 26 and peaked two days later.

(Source: Flickr)
(Source: Flickr)

Their research showed that 75% of the requests were made from Turkey. Since the poisoned forged Microsoft Office documents that the attackers are using are in Turkish as well, this fits in well with the overall pattern of the attackers.

Researchers also found that some of the targets lived in Germany. This also fits in the overall pattern when you consider there is a significant Turkish community in Germany, which could be subject to exploitation and attack.

The poisoned attachment purports to be in Turkish. Depending on which dropper is used by the attackers, the Office document can use either the .csv or .xlt extensions for its hidden malicious payload. Both of these will be opened by Excel.

In its report, Talos notes that "Both versions were leveraging a new variant to the DDE code injection attack. Although this method is well-known, this variant is undetected at the time of this writing."

So, not novel but your antivirus software doesn't know about it. Good enough for the attachment to slip in.

All is not lost, however. Excel has some built-in defenses.

It detects that the opened file is not a real XLT document. It does think that the file is probably corrupted. Not only that, it will ask the user if they are sure they want to open it. Like, seriously dude?

And then, there is a second warning which notifies the user that the document will execute the application that is stuffed in there.

The user might pick up on these clues to not open the purported document.

However, if they ignore all three warnings that have been displayed and continue onwards, a Java code archive will be downloaded. The VBScript uses "bitasdmin," which is a tool provided by Microsoft to download or upload jobs, to actually grab the payload file.

The final payload is a multi-platform RAT with several configurations possible. The samples that they tested were configured to achieve persistence on Windows, Linux and Mac OS X. Each platform has its own persistence name in the RAT, so individual control is possible.

So, why should we even care about this? To put it simply, it worked.

The attack snuck under the signature-based AV tools, and installed a functional RAT. The victim got owned, even when Excel complained.

This can happen in other languages besides Turkish.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises Are Assessing Cybersecurity Risk in Today's Environment
The adoption of cloud services spurred by the COVID-19 pandemic has resulted in pressure on cyber-risk professionals to focus on vulnerabilities and new exposures that stem from pandemic-driven changes. Many cybersecurity pros expect fundamental, long-term changes to their organization's computing and data security due to the shift to more remote work and accelerated cloud adoption. Download this report from Dark Reading to learn more about their challenges and concerns.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-21690
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components ...
CVE-2022-21692
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant.
CVE-2022-21694
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this...
CVE-2022-21700
PUBLISHED: 2022-01-18
Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used ...
CVE-2022-21691
PUBLISHED: 2022-01-18
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.