Attacks/Breaches

Modular Malware Brings Stealthy Attacks to Former Soviet States

A new malware technique is making phishing attacks harder to spot when they succeed.

Modular downloaders aren't new to the world of malware, but a new campaign featuring modular software launched by a major criminal group is drawing the attention of threat researchers. The attacks, so far targeting Russia and the former Soviet republics of the Commonwealth of Independent States (CIS), could presage new tactics aimed at victims around the world.

Researchers at Proofpoint discovered a pair of modular downloaders this summer and noticed two unusual factors in their use. First, the loaders were conducting reconnaissance on the infected system to decide whether the full payload will be downloaded. Second, the loaders, with very small and carefully obfuscated footprints, were being launched by the Cobalt Group, a major criminal organization previously tied to activities such as ATM jackpotting and to other large criminal groups.

"This is the first time we've seen a real shift to have a number of major actors using these tiny downloaders," says Chris Dawson, threat intelligence lead at Proofpoint. The new modular downloader — dubbed "CobInt" by researchers at Group-IB for the organization launching the attack and the name of a .DLL used in the malware — is "small, it's stealthy, and it's pretty well-obfuscated," he adds. "It's difficult to detect if you don't know what you're looking for."  

The process of infecting a target machine is a three-step flow, with each step adding functionality, Dawson explains. The first module is an email with an attachment carrying the initial exploit. If the exploit code, typically a .VBS exploit, can execute, it immediately sends a request for the second-stage downloader. This downloader, written in C, will do reconnaissance on the target system to determine whether certain security measures are running, the system is within a sandbox, or has qualities indicating that it might trap the malware. If the system is "clean" (from the malware's perspective), then it downloads the final payload and establishes persistence on the computer.

Each of the three modules is small and uses multiple layers of obfuscation to avoid detection. "It's unusual to see this level of obfuscation, and we've seen it three times in a row by high-profile actors," says Dawson, referring to separate campaigns researchers have found using the same modular software in the space of a few weeks.

And while the process has multiple steps, it doesn't mean that security professionals can look for the malware at their leisure. "The total time is seconds — it's very quick," Dawson says.

So far, the specific code in use is particular to one criminal organization, and Dawson thinks it will stay that way. "This is likely going to remain a Cobalt Group tool. Aside from using Cobalt Strike, which is a readily available tool, they use custom software," he explains.

But in the world of criminal IT activity, the Cobalt Group's success will be noticed. "We've seen these techniques spreading through other groups," Dawson says. "We see a group that tends to be a good barometer using the technique, and if TA505 is using this, it indicates that others with follow in their wake."

Asked whether he sees these campaigns spreading outside the CIS states, Dawson points out that they are, so far, very specific. "In general, it's Russian language [phishing] hitting organizations in the region," he says. But there's no technical reason that another group can't adopt the technique — if not the actual code — for use anywhere in the world.

Related content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.