Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

9/26/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Adwind RAT Squeaks Past Linux, Windows, macOS Defenses

A newer version of the Adwind 3.0 Trojan can elude the AV defenses of Linux, Windows and macOS systems, according to Talos and ReversingLabs.

The Adwind 3.0 remote access Trojan (RAT) is part of a new campaign where its developers have reconfigured the malware to allow it to gain traction within Linux, Microsoft Windows and Apple macOS systems, according to a new report.

Security researchers at Cisco Talos, along with additional observations made by ReversingLabs, saw a spam campaign that centered on Turkey. Even though ReversingLabs first discovered the campaign in early September, Talos researchers were able to trace the trail of it before then.

The Talos researchers found that the campaign first began on August 26 and peaked two days later.

(Source: Flickr)
(Source: Flickr)

Their research showed that 75% of the requests were made from Turkey. Since the poisoned forged Microsoft Office documents that the attackers are using are in Turkish as well, this fits in well with the overall pattern of the attackers.

Researchers also found that some of the targets lived in Germany. This also fits in the overall pattern when you consider there is a significant Turkish community in Germany, which could be subject to exploitation and attack.

The poisoned attachment purports to be in Turkish. Depending on which dropper is used by the attackers, the Office document can use either the .csv or .xlt extensions for its hidden malicious payload. Both of these will be opened by Excel.

In its report, Talos notes that "Both versions were leveraging a new variant to the DDE code injection attack. Although this method is well-known, this variant is undetected at the time of this writing."

So, not novel but your antivirus software doesn't know about it. Good enough for the attachment to slip in.

All is not lost, however. Excel has some built-in defenses.

It detects that the opened file is not a real XLT document. It does think that the file is probably corrupted. Not only that, it will ask the user if they are sure they want to open it. Like, seriously dude?

And then, there is a second warning which notifies the user that the document will execute the application that is stuffed in there.

The user might pick up on these clues to not open the purported document.

However, if they ignore all three warnings that have been displayed and continue onwards, a Java code archive will be downloaded. The VBScript uses "bitasdmin," which is a tool provided by Microsoft to download or upload jobs, to actually grab the payload file.

The final payload is a multi-platform RAT with several configurations possible. The samples that they tested were configured to achieve persistence on Windows, Linux and Mac OS X. Each platform has its own persistence name in the RAT, so individual control is possible.

So, why should we even care about this? To put it simply, it worked.

The attack snuck under the signature-based AV tools, and installed a functional RAT. The victim got owned, even when Excel complained.

This can happen in other languages besides Turkish.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.