Multi-Stage Malware Delivery via Invoice Phishing

by dmaric | Apr 9, 2024 | Information Security, Threat Intelligence

Attackers continuously refine their methods to bypass conventional security measures. A recent discovery has shed light on a sophisticated multi-stage malware attack that leverages invoice-themed phishing emails to deploy a variety of malicious programs. This article delves into the intricacies of this threat and emphasizes the need for advanced defensive strategies.

Understanding the Threat: Multi-Stage Malware

Cybersecurity experts have identified an alarming trend where cybercriminals use deceptive invoice phishing emails to initiate a chain of malware infections. These emails typically contain attachments with Scalable Vector Graphics (SVG) files. When unsuspecting users click on these files, they trigger the malware’s infection sequence.

The Infection Mechanism

The process begins with an SVG file that, once activated, downloads a ZIP archive containing a batch script. This script is likely developed using an obfuscation tool known as BatCloak, which effectively disguises the malicious code to avoid detection by traditional antivirus solutions.

BatCloak and ScrubCrypt play pivotal roles in these attacks. BatCloak, which has been available for sale since late 2022, originated from another tool called Jlaive. Its main purpose is to load a secondary payload that can bypass standard detection technologies. ScrubCrypt, identified by Fortinet FortiGuard Labs in early 2023, is a crypter linked to cryptojacking campaigns by the 8220 Gang and is one of the iterations of BatCloak.

The Execution Phase

Once the initial script is executed, it unpacks a ScrubCrypt batch file, setting the stage for the final payload delivery. This includes the deployment of Venom RAT, a fork of Quasar RAT, which allows attackers to take control of the compromised systems. The malware sets up persistence on the host and implements techniques to bypass Anti-Malware Scanning Interface (AMSI) and Event Tracing for Windows (ETW) protections.

Venom RAT is designed to maintain communication with its command-and-control (C2) server to fetch additional plugins for a range of activities, including keylogging and data theft. Notably, it can also deploy other RATs like NanoCore, XWorm, and Remcos via its plugin system.

Impact on Data Security

The deployment of Venom RAT and its associated plugins results in significant threats to data security. One of the plugins is a stealer that targets information from wallets and applications such as Atomic Wallet, Electrum, and Telegram. This data is then exfiltrated to remote servers, putting sensitive information at risk.

Comprehensive Defense Strategies against Multi-Stage Malware

To counter such sophisticated attacks, organizations must implement a multi-layered security strategy that includes:

• Education and Awareness: Regular training sessions for employees to recognize phishing attempts and suspicious emails.
• Advanced Detection Tools: Utilizing security solutions that go beyond traditional antivirus programs to detect obfuscated scripts and encrypted payloads.
• Incident Response: Developing a robust incident response plan that can be swiftly executed upon detection of a potential breach.
• Regular Updates and Patches: Keeping all systems updated to mitigate vulnerabilities that could be exploited by attackers.

The recent findings highlight the complexity and adaptability of modern cyber threats. By understanding the mechanisms behind these attacks and implementing comprehensive security measures, businesses can better protect themselves against the evolving tactics of cyber adversaries. It’s imperative to stay informed and vigilant, as the methods employed by attackers grow more sophisticated by the day.

For the latest insights on protecting your business from cyber threats and to learn more about our comprehensive security solutions, follow us on LinkedIn. You can also contact us directly through our website, or book a free consultation session to discuss how we can assist you in achieving the business security and resilience your organization needs.

Threat of Kasseika: The Latest Ransomware Menace

by dmaric | Jan 23, 2024 | Information Security, Threat Intelligence

Kasseika Ransomware

The cybersecurity world is facing a new formidable challenge with the advent of Kasseika ransomware. This malicious entity stands out for its innovative approach in circumventing traditional antivirus measures, marking a concerning evolution in cyber threats.

Kasseika’s Unique Offensive Strategy

What sets Kasseika apart is its employment of the Bring Your Own Vulnerable Driver (BYOVD) tactic. This method leverages the exploitation of vulnerable system drivers, specifically targeting the Martini driver from TG Soft’s VirtIT Agent System. By disabling key antivirus products, Kasseika gains an unobstructed path to encrypt files on the targeted system.

The BlackMatter Connection

In-depth analysis by Trend Micro reveals striking similarities between Kasseika and the infamous BlackMatter ransomware. The parallels in their operational tactics and source code hint at Kasseika’s possible origins: it might be the brainchild of ex-BlackMatter members or developed by seasoned ransomware creators who procured BlackMatter’s code. This connection raises alarms due to BlackMatter’s history of destructive cyber campaigns.

The Modus Operandi of Kasseika

Kasseika initiates its attack chain with carefully crafted phishing emails aimed at employees. These emails are designed to pilfer login credentials, granting the attackers initial access to the victim’s corporate network. Subsequently, the ransomware exploits the Windows PsExec tool to deploy malicious .bat files across the network, enabling it to spread laterally.

A key step in the attack involves shutting down the ‘Martini.exe’ process and introducing the compromised ‘Martini.sys’ driver. This driver plays a pivotal role, empowering Kasseika to terminate a list of predefined processes, primarily targeting security and antivirus programs.

How Kasseika Executes Its Plan

Post-preparation, Kasseika proceeds to run its main ransomware executable, named smartscreen_protected.exe, effectively sidelining antivirus processes. The ransomware uses a combination of ChaCha20 and RSA encryption algorithms to lock down files, mirroring tactics used by BlackMatter. Each file is tagged with a unique pseudo-random string, and the victims’ desktops are altered with ransom notes.

The Ransom Demand and Cleanup

The demands made by Kasseika are steep: victims are given a 72-hour window to transfer 50 Bitcoins (valued at about $2,000,000). The ransom increases for every 24-hour delay in payment. Furthermore, victims are instructed to post their payment proofs in a designated Telegram group to obtain the decryption key. In a final act to cover its tracks, Kasseika wipes the system event logs, erasing evidence of its presence and activities.

Proactive Measures and Trend Micro’s Contribution

In response to this escalating threat, Trend Micro has compiled and released a set of indicators of compromise (IoCs) associated with Kasseika. These IoCs are critical for organizations globally to identify and defend against this sophisticated ransomware.

Kasseika ransomware emerges as a daunting new player in the cybercrime arena. Its advanced tactics and connection to BlackMatter underscore the need for enhanced vigilance and adaptive security strategies. The release of IoCs by Trend Micro serves as an essential tool for organizations to shield themselves against this and similar cybersecurity threats. more details on: https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html

GitHub Under Siege: The Hacker’s Playground

by dmaric | Jan 15, 2024 | Information Security, Threat Intelligence

GitHub is critical platform that’s fallen prey to sophisticated cybercriminal tactics. Initially designed as a hub for collaboration and code sharing, GitHub’s open nature has inadvertently made it a target for malicious activities. The exploitation ranges from hosting harmful files to orchestrating phishing scams, showcasing the dual nature of technology as both a tool for advancement and a weapon for cybercrime.9

Subtle Threats: The Art of Camouflage

The tactics employed by these cybercriminals are not just advanced; they are insidiously woven into the fabric of GitHub’s legitimate operations. The concept of living-off-the-land (LotL) has evolved into a more covert strategy known as “living-off-trusted-sites” (LOTS). This approach cleverly disguises malicious activities, making them nearly indistinguishable from regular, benign traffic. It’s a method that blurs the lines between the legitimate and the illicit, making detection a daunting task for even the most astute security professionals.

Ingenious Methods: DDR and C2 Networks

Among the techniques utilized, dead drop resolving (DDR) and command-and-control (C2) networks stand out. DDR involves leveraging GitHub’s legitimate infrastructure to hide information about malicious domains, effectively turning the service into a beacon for further cybercriminal activities. Similarly, C2 networks find a veil in GitHub’s traffic, making these malicious operations appear as harmless as any regular data exchange on the platform.

The Road Ahead: A Complex Challenge

Confronting these threats requires more than just traditional security measures. Advanced detection methods, enhanced visibility, and diverse detection angles are essential in this fight against cybercrime. However, the complexity and sophistication of these threats mean that a quick resolution is not on the horizon. The responsibility for detecting and mitigating these risks may gradually shift towards larger internet services, signaling a new era in cybersecurity where vigilance and innovation are paramount.

The detailed insights into this pressing issue can be found in the TechRadar article: GitHub is being hijacked by hackers, and it isn’t going to be fixed any time soon.