Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

9/26/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Adwind RAT Squeaks Past Linux, Windows, macOS Defenses

A newer version of the Adwind 3.0 Trojan can elude the AV defenses of Linux, Windows and macOS systems, according to Talos and ReversingLabs.

The Adwind 3.0 remote access Trojan (RAT) is part of a new campaign where its developers have reconfigured the malware to allow it to gain traction within Linux, Microsoft Windows and Apple macOS systems, according to a new report.

Security researchers at Cisco Talos, along with additional observations made by ReversingLabs, saw a spam campaign that centered on Turkey. Even though ReversingLabs first discovered the campaign in early September, Talos researchers were able to trace the trail of it before then.

The Talos researchers found that the campaign first began on August 26 and peaked two days later.

(Source: Flickr)
(Source: Flickr)

Their research showed that 75% of the requests were made from Turkey. Since the poisoned forged Microsoft Office documents that the attackers are using are in Turkish as well, this fits in well with the overall pattern of the attackers.

Researchers also found that some of the targets lived in Germany. This also fits in the overall pattern when you consider there is a significant Turkish community in Germany, which could be subject to exploitation and attack.

The poisoned attachment purports to be in Turkish. Depending on which dropper is used by the attackers, the Office document can use either the .csv or .xlt extensions for its hidden malicious payload. Both of these will be opened by Excel.

In its report, Talos notes that "Both versions were leveraging a new variant to the DDE code injection attack. Although this method is well-known, this variant is undetected at the time of this writing."

So, not novel but your antivirus software doesn't know about it. Good enough for the attachment to slip in.

All is not lost, however. Excel has some built-in defenses.

It detects that the opened file is not a real XLT document. It does think that the file is probably corrupted. Not only that, it will ask the user if they are sure they want to open it. Like, seriously dude?

And then, there is a second warning which notifies the user that the document will execute the application that is stuffed in there.

The user might pick up on these clues to not open the purported document.

However, if they ignore all three warnings that have been displayed and continue onwards, a Java code archive will be downloaded. The VBScript uses "bitasdmin," which is a tool provided by Microsoft to download or upload jobs, to actually grab the payload file.

The final payload is a multi-platform RAT with several configurations possible. The samples that they tested were configured to achieve persistence on Windows, Linux and Mac OS X. Each platform has its own persistence name in the RAT, so individual control is possible.

So, why should we even care about this? To put it simply, it worked.

The attack snuck under the signature-based AV tools, and installed a functional RAT. The victim got owned, even when Excel complained.

This can happen in other languages besides Turkish.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32812
PUBLISHED: 2021-08-02
Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a kn...
CVE-2021-32787
PUBLISHED: 2021-08-02
Sourcegraph is a code search and navigation engine. Sourcegraph before version 3.30.0 has two potential information leaks. The site-admin area can be accessed by regular users and all information and features are properly protected except for daily usage statistics and code intelligence uploads and ...
CVE-2021-32811
PUBLISHED: 2021-08-02
Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Produ...
CVE-2021-21866
PUBLISHED: 2021-08-02
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger t...
CVE-2021-27499
PUBLISHED: 2021-08-02
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs, which allows man-in-...