Deep Dives

Deep Dive into the Latest Phishing Campaign Leveraging Remote Access Trojans

by n8n admin

Daniel Osei — SOC Lead & Malware Analyst

Key Takeaways

  • Recent phishing attacks utilized custom-built Remote Access Trojans (RATs) to compromise financial institutions.
  • Indicators of Compromise (IOCs) included unique email addresses and malicious URLs used in the phishing payloads.
  • Detection strategies must focus on anomalous network behavior and specific file activity in target environments.

Executive Summary

During our investigation into a series of cyber incidents affecting financial organizations over the past month, we observed a sophisticated phishing campaign designed to deliver custom-built Remote Access Trojans (RATs). Analyzing the malware samples, we uncovered a series of obfuscated scripts and unique domain generation algorithms (DGAs) used for command and control (C2) communications. The primary objective of this attack chain appeared to be data exfiltration and system compromise.

Initial Access

The initial attack vector employed in these incidents was a well-crafted phishing email targeting employees of the financial institutions. We identified that the emails leveraged social engineering tactics, convincing users to click on a seemingly legitimate attachment or link. The email headers contained spoofed addresses resembling legitimate communication channels, enhancing the plausibility of the tactics. Following the user’s interaction, the attachment executed a PowerShell script coded to download the main RAT, which we named BankStealer.

Execution & Persistence

Upon execution, the BankStealer RAT deployed a series of hidden persistence mechanisms. Our analysis showed that it created a new service under the name Windows Security Update using the command sc create, enabling it to auto-start with system boot. The service targeted C:\Windows\System32\bankstealer.exe as its primary executable path. Additionally, we found evidence of registry modifications under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, which allowed the actor to maintain persistence even after initial cleanup efforts.

Command and Control

The BankStealer utilized a dynamic C2 mechanism utilizing DGAs to hide its location and make detection difficult. Our team uncovered that the malware generated thousands of potential C2 domains that would rotate on a daily basis, making it challenging for defenders to pinpoint the actor’s infrastructure. Using public WHOIS data, we linked several of these domains to known malicious actors, although some domains appeared to leverage compromised registrars. The initial connection from the infected system to the C2 occurred over HTTPS, utilizing encryption to obscure the payload exchanges and further complicate traffic monitoring efforts.

Lateral Movement & Discovery

During lateral movement, we identified that the BankStealer employed T1075 – Pass the Hash technique to move laterally across the network. By leveraging stolen credential hashes obtained from common target applications, the actor could access additional systems seamlessly. Our examination revealed that lateral movement typically targeted systems identified using T1086 – PowerShell, enabling actors to execute remote commands on compromised hosts. This was coupled with the same extit{PowerShell} script initially used for execution, which was then repurposed to scan and exfiltrate data from shared drives.

Impact & Objectives

The main objectives of this attack chain appeared to center around data exfiltration and establishing a foothold within the network. Our analysis identified numerous instances of sensitive data upload, including personally identifiable information (PII) and banking credentials, to external servers operated by the actors. The campaign’s impact was significant, leading to disruptions in business operations, loss of customer trust, and potential regulatory scrutiny as institutions scrambled to mitigate the fallout. The actors also demonstrated an ability to adapt, changing their tactics quickly as detection methods increased.

MITRE ATT&CK Mapping

  • T1566 – Phishing: The email-based delivery mechanism used to gain initial access.
  • T1059 – Command and Scripting Interpreter: Utilization of PowerShell for malicious commands.
  • T1075 – Pass the Hash: Lateral movement using stolen credential hashes.
  • T1090 – Connection Proxy: Employing DGAs for dynamic C2 communications.

Detection Opportunities

  • Implement email filtering solutions to detect and quarantine emails containing known malicious payloads.
  • Monitor network traffic for unusual outbound connections, particularly those that are HTTPS-based and utilize DGAs.
  • Enhance endpoint detection through monitoring of registry keys associated with persistence, especially within HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.

Analyst Notes

As we delve deeper into the implications of the BankStealer RAT and its associated campaign, it becomes crucial for organizations to implement layered defenses. Continuous monitoring, user education on phishing techniques, and active incident response procedures are essential strategies to combat such sophisticated attack patterns. The ever-evolving nature of these threats underscores the need for organizations to regularly update their threat intelligence to stay one step ahead of potential attackers.

Source: Original Report

Related Posts