Researchers at FireEye have recently unearthed a particularly nasty new campaign that is both multi-faceted and dangerous. At the heart of the attack are hacked websites that display a seemingly innocuous pop-up message informing the site visitor that their browser is out of date. It will helpfully provide a one-touch solution to the non-existen21t problem via a button that promises to download the latest version of the browser in question.
Naturally, it does no such thing. Instead, it uses a series of JavaScripts to gather information about the target computer and send the details back to the command and control server.
The server then responds to the findings reported by the initial script by uploading the initial payload. This varies based on the details gleaned, but generally includes some type of banking trojan malware and a backdoor such as Dridex, NetSupport Manager RAT, or similar. If the initial scan reveals that the target computer is part of a corporate network, then an additional payload is also injected onto the target machine, but we’ll get to that in a moment.
The first part of the payload will busily ferret out login credentials and other sensitive information, exfiltrating any files of value back to the command and control server.
Only when this operation has been completed and if the computer is part of a corporate network will the second stage we referenced earlier trigger, which is a strain of ransomware, normally BitPaymer or DoppelPaymer. The ransomware spreads through the network as far as it is able, encrypting files network-wide.
These two ransomware strains are known for their hefty ransom demands, which often run into the hundreds of thousands or even millions of dollars.
This multi-stage approach is dreadfully effective. It not only allows the hackers to squeeze a wide range of sensitive data from infected systems but then, locks them down hard and demands a hefty payment. Be sure your staff is aware. This one’s about as dangerous as they come.
