Vulnerabilities / Threats

11/3/2017
12:35 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Hackers Poison Google Search Results to Deliver Zeus Panda

Threat actors leverage SEO to ensure malicious links rank highly in Google results to infect targets with Trojan.

Most people use Google to search for answers but don't know the results aren't always safe. Attackers have begun to exploit this reliance on Google by using Search Engine Optimization (SEO) to populate search results with malicious links and distribute the Zeus Panda Banking Trojan through a compromised Word document.

SEO enables hackers to make their links more dominant in search results. In this case, attackers are "poisoning" the results for specific keywords related to banking and finance, effectively narrowing their victim pool to a specific group so they can steal financial information.

"SEO poisoning by itself isn't really new," says Earl Carter, threat researcher for Cisco Talos and one of the authors who detailed this discovery. "People have always been trying to manipulate search results. What was unique is they're using it in the distribution of malware."

Based on the keywords used, it seems the attackers are targeting geographic regions. Some examples of targeted keyword searches include "nordea sweden bank account number," "al rajhi bank working hours during ramadan," and "sbi bank recurring deposit form."

In this campaign, hackers used compromised Web servers to ensure malicious links will appear prominently in these searches. Most of the time, they successfully displayed several poisoned links on the first results page. The links seemed unsuspicious because attackers hid their activity under compromised business websites that already had ratings and reviews.

"As user awareness training becomes more common, [users] are less likely to open unexpected attachments, but those same users may be likely to click result number one on a Google result page," says Talos threat researcher Edmund Brumaghin. Researchers checked other search engines and concluded Google is the attackers' key focus.

Users who browse pages hosted on compromised servers kick-start a multi-stage malware infection. The same redirection and infrastructure has been seen in other attacks; for example, fake antivirus and tech support scams in which users are asked to call a phone number.

Ultimately, targets are redirected to a site hosting a malicious Word document. The doc contains malicious macros that execute when users download and click "Enable Content."

What's inside

Researchers determined the malicious payload in this campaign seems to be a new version of the Zeus Panda banking Trojan, which steals sensitive data like banking information. The sample Talos analyzed is a multi-stage malware payload in which the initial stage has several anti-analysis techniques and prolonged execution to evade detection. While its functionality is still the same, the evasion techniques make it harder for reverse engineers to figure out.

This malware first queries the system's keyboard mapping to determine its language, and terminates if it detects Russian, Belarusian, Kazak, or Ukrainian. Earlier analysis of Zeus Panda also revealed it wouldn't run on systems in Russia, Ukraine, Belarus, or Kazakhstan.

Zeus Panda checks to verify whether it's running within hypervisor or sandbox environments including VMware, VirtualPC, VirtualBox, Parallels, Sandboxie, Wine, or SoftIce. Finally, the malware scans for tools commonly used among analysts for investigating malicious software. If any of these checks turn up positive, the malware removes itself from the machine.

Researchers can't say with certainty whether the Zeus Panda threat actors are also behind this campaign. "The same threat actors, over time, constantly try to find new ways to get in," says Carter. "It could be the same guys, it could be different guys."

Alternatively, they say, this distribution mechanism could be the work of threat actors who are "farming it out" to attackers who want to spread different forms of malware, similar to how the Necurs botnet distributes various campaigns via email.

Carter and Brumaghin emphasize the importance of building on user awareness training to include verifying whether links are trusted. Just because a site appeared high in Google search doesn't mean it's safe.

"Make sure you know what site you're going to when you go to a Google result, or result in any search engine, says Brumaghin.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Venomous Crash
50%
50%
Venomous Crash,
User Rank: Apprentice
11/9/2017 | 12:23:36 PM
Impressive
Im Impressed maybe these hacker dare to take my challenge Times running out Tick Tock

 
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.