Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/3/2017
12:35 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Hackers Poison Google Search Results to Deliver Zeus Panda

Threat actors leverage SEO to ensure malicious links rank highly in Google results to infect targets with Trojan.

Most people use Google to search for answers but don't know the results aren't always safe. Attackers have begun to exploit this reliance on Google by using Search Engine Optimization (SEO) to populate search results with malicious links and distribute the Zeus Panda Banking Trojan through a compromised Word document.

SEO enables hackers to make their links more dominant in search results. In this case, attackers are "poisoning" the results for specific keywords related to banking and finance, effectively narrowing their victim pool to a specific group so they can steal financial information.

"SEO poisoning by itself isn't really new," says Earl Carter, threat researcher for Cisco Talos and one of the authors who detailed this discovery. "People have always been trying to manipulate search results. What was unique is they're using it in the distribution of malware."

Based on the keywords used, it seems the attackers are targeting geographic regions. Some examples of targeted keyword searches include "nordea sweden bank account number," "al rajhi bank working hours during ramadan," and "sbi bank recurring deposit form."

In this campaign, hackers used compromised Web servers to ensure malicious links will appear prominently in these searches. Most of the time, they successfully displayed several poisoned links on the first results page. The links seemed unsuspicious because attackers hid their activity under compromised business websites that already had ratings and reviews.

"As user awareness training becomes more common, [users] are less likely to open unexpected attachments, but those same users may be likely to click result number one on a Google result page," says Talos threat researcher Edmund Brumaghin. Researchers checked other search engines and concluded Google is the attackers' key focus.

Users who browse pages hosted on compromised servers kick-start a multi-stage malware infection. The same redirection and infrastructure has been seen in other attacks; for example, fake antivirus and tech support scams in which users are asked to call a phone number.

Ultimately, targets are redirected to a site hosting a malicious Word document. The doc contains malicious macros that execute when users download and click "Enable Content."

What's inside

Researchers determined the malicious payload in this campaign seems to be a new version of the Zeus Panda banking Trojan, which steals sensitive data like banking information. The sample Talos analyzed is a multi-stage malware payload in which the initial stage has several anti-analysis techniques and prolonged execution to evade detection. While its functionality is still the same, the evasion techniques make it harder for reverse engineers to figure out.

This malware first queries the system's keyboard mapping to determine its language, and terminates if it detects Russian, Belarusian, Kazak, or Ukrainian. Earlier analysis of Zeus Panda also revealed it wouldn't run on systems in Russia, Ukraine, Belarus, or Kazakhstan.

Zeus Panda checks to verify whether it's running within hypervisor or sandbox environments including VMware, VirtualPC, VirtualBox, Parallels, Sandboxie, Wine, or SoftIce. Finally, the malware scans for tools commonly used among analysts for investigating malicious software. If any of these checks turn up positive, the malware removes itself from the machine.

Researchers can't say with certainty whether the Zeus Panda threat actors are also behind this campaign. "The same threat actors, over time, constantly try to find new ways to get in," says Carter. "It could be the same guys, it could be different guys."

Alternatively, they say, this distribution mechanism could be the work of threat actors who are "farming it out" to attackers who want to spread different forms of malware, similar to how the Necurs botnet distributes various campaigns via email.

Carter and Brumaghin emphasize the importance of building on user awareness training to include verifying whether links are trusted. Just because a site appeared high in Google search doesn't mean it's safe.

"Make sure you know what site you're going to when you go to a Google result, or result in any search engine, says Brumaghin.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Venomous Crash
50%
50%
Venomous Crash,
User Rank: Apprentice
11/9/2017 | 12:23:36 PM
Impressive
Im Impressed maybe these hacker dare to take my challenge Times running out Tick Tock

 
Windows 10 Migration: Getting It Right
Kevin Alexandra, Principal Solutions Engineer at BeyondTrust,  5/15/2019
Artist Uses Malware in Installation
Dark Reading Staff 5/17/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12184
PUBLISHED: 2019-05-19
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
CVE-2019-12173
PUBLISHED: 2019-05-18
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
CVE-2019-12172
PUBLISHED: 2019-05-17
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
CVE-2019-12168
PUBLISHED: 2019-05-17
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
CVE-2019-12170
PUBLISHED: 2019-05-17
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...