Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/29/2019
03:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Retadup Worm Squashed After Infecting 850K Machines

An operation involving French law enforcement, the FBI, and Avast forces Retadup to delete itself from victim machines.

Retadup, a malicious worm that infected more than 850,000 Windows machines, has been taken down by an international operation involving the French National Gendarmerie's Cybercrime Fighting Center (C3N), US Federal Bureau of Investigation, and security firm Avast.

The worm was first exposed by Trend Micro back in 2017, when it was spotted targeting Israeli hospitals and stealing information. A few months later, another Retadup variant was seen targeting industries and governments in South America. Two years later, Avast analysts are sharing details of a separate campaign in which victim machines were targeted with a cryptocurrency miner.

Avast researchers began to closely monitor Retadup activity in March 2019, when malicious Monero cryptocurrency miner XMRig caught their eye with its advanced abilities to bypass detection. Further investigation into the distribution of XMRig led them to Retadup, the worm being used to deliver XMRig to machines mostly in Spanish-speaking countries in Latin America.

Retadup primarily spreads by dropping malicious LNK files onto connected drives. It iterates over all connected drives where the assigned letter is not "c," goes through all the folders in the root folder of a selected drive, and for each one creates an LNK file to mimic the real folder and trick victims into clicking it. When executed, the malicious LNK file will run the malicious script. Neither Avast nor Trend Micro researchers have determined the infection vector for XMRig.

XMRig doesn't use all of a CPU's power when it mines cryptocurrency, says Avast malware researcher Jan Vojtesek. This helps it fly under the radar. Victims whose machines are running a fully powered cryptominer will notice their machines slow down, he explains. The malware also avoids mining when taskmgr.exe is running, so it's difficult to detect raises in CPU usage.

In addition to XMRig, researchers noticed instances of Retadup distributing Stop ransomware and Arkei password stealer. The ransomware seemed to be a "test trial," Vojtesek says. "They probably were trying to figure out how much they could make from ransomware."  

Closer analysis of Retadup showed its command-and-control (C2) communication infrastructure was "quite simple," Vojtesek explains in a report. Analysts identified a design flaw in the C2 protocol that enabled them to remove Retadup from infected machines if they assumed control over the C2 server, he explains. By doing this, they could purge XMRig from victims' devices without asking them to do anything. They'd simply need to connect to the server to destroy the threat.

Setting Up the Takedown
Because most of Retadup's C2 infrastructure was located in France, Avast contacted the French National Gendarmerie to share their research and proposed disinfection strategy of abusing the flaw in the C2 server to neutralize the attack campaign.

"We spent some time analyzing the threat," Vojtesek says. "Only after we were confident it could actually be disinfected, and we had a solid plan on how to carry out the disinfection, then we contacted them."

While French law enforcement presented the strategy to the prosecutor, Avast continued to analyze Retadup. Researchers tested the disinfection process, discussed potential risks, and reviewed a snapshot of the C2 server's disk obtained by the Grandarmerie that did not contain victims' data. Attackers sent a great deal of data about infected to the machines to the C2 server; researchers learned the exact amount of infections and geographical locations.

The teams got the go-ahead to launch their disinfection operation in July 2019 and replaced the malicious C2 server with a "disinfection server" that made connected instances of Retadup self-destruct. When bots connected to the server, the disinfection server responded and destroyed. So far it has neutralized more than 850,000 devices that connected to the attackers' C2 server.

Some parts of the C2 infrastructure were located in the US, so the Gendarmerie alerted the FBI, which took those down. By July 8, Retadup's authors no longer had control over the malware. Because infected machines received orders from the C2 server, they no longer had new jobs, meaning they were unable to continue stealing victims' power to fuel their monetary gain.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Fuzzing 101: Why Bug-Finders Still Love It After All These Years."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Naturopathe
50%
50%
Naturopathe,
User Rank: Apprentice
9/3/2019 | 3:59:54 AM
Re: Pending Review
Why can't I see your comment ?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16192
PUBLISHED: 2020-08-05
LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.
CVE-2020-17364
PUBLISHED: 2020-08-05
USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.
CVE-2020-4481
PUBLISHED: 2020-08-05
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181848.
CVE-2020-5608
PUBLISHED: 2020-08-05
CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered c...
CVE-2020-5609
PUBLISHED: 2020-08-05
Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to cre...