Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

End of Bibblio RCM includes -->
9/26/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb

Adwind RAT Squeaks Past Linux, Windows, macOS Defenses

A newer version of the Adwind 3.0 Trojan can elude the AV defenses of Linux, Windows and macOS systems, according to Talos and ReversingLabs.

The Adwind 3.0 remote access Trojan (RAT) is part of a new campaign where its developers have reconfigured the malware to allow it to gain traction within Linux, Microsoft Windows and Apple macOS systems, according to a new report.

Security researchers at Cisco Talos, along with additional observations made by ReversingLabs, saw a spam campaign that centered on Turkey. Even though ReversingLabs first discovered the campaign in early September, Talos researchers were able to trace the trail of it before then.

The Talos researchers found that the campaign first began on August 26 and peaked two days later.

(Source: Flickr)
(Source: Flickr)

Their research showed that 75% of the requests were made from Turkey. Since the poisoned forged Microsoft Office documents that the attackers are using are in Turkish as well, this fits in well with the overall pattern of the attackers.

Researchers also found that some of the targets lived in Germany. This also fits in the overall pattern when you consider there is a significant Turkish community in Germany, which could be subject to exploitation and attack.

The poisoned attachment purports to be in Turkish. Depending on which dropper is used by the attackers, the Office document can use either the .csv or .xlt extensions for its hidden malicious payload. Both of these will be opened by Excel.

In its report, Talos notes that "Both versions were leveraging a new variant to the DDE code injection attack. Although this method is well-known, this variant is undetected at the time of this writing."

So, not novel but your antivirus software doesn't know about it. Good enough for the attachment to slip in.

All is not lost, however. Excel has some built-in defenses.

It detects that the opened file is not a real XLT document. It does think that the file is probably corrupted. Not only that, it will ask the user if they are sure they want to open it. Like, seriously dude?

And then, there is a second warning which notifies the user that the document will execute the application that is stuffed in there.

The user might pick up on these clues to not open the purported document.

However, if they ignore all three warnings that have been displayed and continue onwards, a Java code archive will be downloaded. The VBScript uses "bitasdmin," which is a tool provided by Microsoft to download or upload jobs, to actually grab the payload file.

The final payload is a multi-platform RAT with several configurations possible. The samples that they tested were configured to achieve persistence on Windows, Linux and Mac OS X. Each platform has its own persistence name in the RAT, so individual control is possible.

So, why should we even care about this? To put it simply, it worked.

The attack snuck under the signature-based AV tools, and installed a functional RAT. The victim got owned, even when Excel complained.

This can happen in other languages besides Turkish.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-34918
PUBLISHED: 2022-07-04
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an u...
CVE-2022-34829
PUBLISHED: 2022-07-04
Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
CVE-2022-31600
PUBLISHED: 2022-07-04
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and informat...
CVE-2022-31601
PUBLISHED: 2022-07-04
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bounds write, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
CVE-2022-31602
PUBLISHED: 2022-07-04
NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can exploit an out-of-bounds write vulnerability, which may lead to code execution, denial of service, data integrity impact, and information disclosure.