Vulnerabilities / Threats

8/16/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Necurs Botnet Goes Phishing for Banks

A new Necurs botnet campaign targets thousands of banks with a malicious file dropping the FlawedAmmyy remote-access Trojan.

The Necurs botnet has resurfaced in a new phishing campaign targeting banks with malicious Microsoft Publisher and PDF files packed with the FlawedAmmyy remote-access Trojan.

Cofense researchers first detected the campaign early on August 15 and have confirmed 3,071 banking domains have been hit so far. Recipients range from small regional banks to some of the world's largest financial institutions.

Necurs, a rootkit first discovered in 2012, became famous in 2016 when it was spotted delivering large volumes of Dridex and Locky ransomware. Now it's resurfacing with new tactics as threat actors experiment with different strategies to see which are most effective.

"As far as this particular campaign, it is a change from what Necurs has been doing," says Jason Meurer, senior research engineer at Cofense. He compared the attack with a marketing campaign, noting that "it felt like there was a little bit of A/B testing going on here."

This campaign differed from Necurs' usual strategy in several ways. For starters, it wasn't your traditional spam — this was a phishing campaign specifically geared toward the banking industry, using malicious attachments to deliver a payload designed to enable remote access. It also leveraged Microsoft Publisher files, a shift from typical Word and Excel documents. A small subset of this campaign used PDF files, which shows the attackers are trying different tactics.

"It's extremely rare" to see Publisher files in phishing attacks, says Cofense co-founder and CTO Aaron Higbee. While this type of file has been used in the past — after all, most employees are required to install Publisher as part of Office 365 — it's not commonly seen in cybercrime.

Digging into the Details
Emails in this campaign are "fairly basic," researchers report, with subject lines including "Request BOI" and "Payment Advice" with a random alphanumeric code tacked on the end. Higbee points out the phishing email was forged to appear as though it came from an employee at an Indian bank. A different Indian bank, Cosmos, recently lost $13.5 million in a cyberattack when hackers broke into its ATM server and stole customer information.

This campaign could potentially indicate a future ATM attack, says Higbee, and network access may be part of the actors' motivation. The malicious .pub documents attached to phishing emails have embedded macros that, when executed, prompt a download from a remote host, explain Cofense's Jason Meurer and Darrel Rendell in a blog post on the campaign.

The final payload is FlawedAmmyy, which is malware based on leaked source code for Ammyy Admin. It gives an attacker with full remote control of a compromised host, which can lead to file and credential theft and enable lateral movement within target organizations.

FlawedAmmyy had gone undocumented until early 2018, when Proofpoint research indicated the Trojan had been used in attacks as far back as January 2016 and as recently as March 2018. At that time, attackers began to use a new distribution method of combining ZIP files with the Server Message Block protocol to deliver FlawedAmmyy onto target systems.

The March campaign dropping FlawedAmmyy appeared to be the work of TA505, the same threat group associated with the Dridex, Locky, and GlobeImposter campaigns. While Cofense has not yet determined the motivation behind the latest Necurs campaign, Higbee says people who have been studying Necurs have linked the botnet to organized crime.

What's Next for Necurs
Now that the campaign has come to a halt, Meurer anticipates the attackers are probably taking a look at their command-and-control infrastructure to gauge the effectiveness of their strategy. Did .pub files work, for example, or were PDF files more effective?

If there was little to no engagement, "they'll go back to the drawing board and look for another file format they can use to deliver the next wave," he says. "If we see Necurs do another phishing campaign using .pub files, it's an indication people behind it were satisfied with the results."

It's a call for banking institutions to stay on their toes. Banks should make sure their perimeter security is in good shape and their email gateways are updated. "The second thing is to make sure banking employees are aware they're targets of cybercriminals, just by the nature of the fact they work at a bank," Meurer adds. "Any employee is a rich target for a cybercriminal."

Related Content

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.