Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Ransomware

1/8/2019
08:15 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

New Malvertising Campaign Delivers Vidar Stealer Plus Ransomware

Malwarebytes Labs has uncovered a new malvertising campaign in the wild that delivers a one-two punch: the Vidar data stealer and GrandCrab ransomware.

A new "malvertising" campaign spotted in the wild is delivering a malicious one-two punch to victims: The first is the data stealer Vidar and the second is the GrandCrab ransomware strain, according to a recent report.

Researchers at Malwarebytes Labs first took notice of the malvertising campaign and published their findings in a January 4 blog post. It's not clear who is behind this particular attack or how widespread it is right now, but the report noted that the threat actors are essentially using off-the-shelf tools, including the Fallout exploit kit, which takes advantage of flaws in Adobe Flash and Microsoft Internet Explorer, to deliver these malicious payloads

This campaign has its origins in the advertising that usually accompanies torrent and streaming video. The person or group behind this particular campaign used this poorly regulated system to create a rogue advertising domain and redirect users to different exploit kits, including Fallout.

It's through these exploit kits that the one-two punch is delivered -- the stealer first followed by the ransomware.

How the malvertising campaign works\r\n(Source: Malwarebytes)\r\n
How the malvertising campaign works
\r\n(Source: Malwarebytes)\r\n

At first, the researcher believed that the stealer being used was an older piece of malware called Arkei. However, further tests came up with Vidar, which has only been active since October 2018, but shares similarities with Arkei.

Vidar -- its name has origins in Norse mythology -- is written in C++ and it highly customizable. It has the capability to swipe and steal personal data from any number of web browsers, including Tor. Additionally, it can steal cryptocurrency wallets, data from two-factor authentication software, instant messages and much more, according to an independent analysis.

On the Dark Web, the Vidar kit can be bought for as little as $700.

However, when the researcher traced the campaign back to the command-and-control (C&C) server, they noticed that the attackers had a second malicious payload ready to be delivered once the Vidar stealer started its work.

"Vidar also offers to download additional malware via its command and control server," according to the Malwarebytes blog. "This is known as the loader feature, and again, it can be configured within Vidar's administration panel by adding a direct URL to the payload. However, not all instances of Vidar (tied to a profile ID) will download an additional payload. In that case, the server will send back a response of "ok" instead of a URL."

This then leads to the second part of the attack, GrandCrab, which is what some security researchers refer to as ransomware-as-service, as it relies on third-parties to help spread it. (See Kraken Cryptor Update Points to Rise of Ransomware-as-a-Service.)

GrandCrab ransom email\r\n(Source: Malwarebytes)\r\n
GrandCrab ransom email
\r\n(Source: Malwarebytes)\r\n

Unlike other ransomware, GrandCrab is frequently updated -- the current version is 5.0.4 -- which helps it evade security software. Malwarebytes recommends that businesses update and patch IE and Flash to avoid this particular campaign before the ransomware can be downloaded.

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31476
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2021-31477
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-...
CVE-2021-32690
PUBLISHED: 2021-06-16
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This...
CVE-2021-32691
PUBLISHED: 2021-06-16
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within th...
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).