DNS Abuse by Cybercriminals – RATs, Phish, and ChickenKillers

This week in our malware intelligence meeting, our analysts brought up DNS abuse by cybercriminals. Two malware samples were seen this week which had the domain “chickenkiller.com” in their infrastructure.

I thought this sounded familiar, but my first guess was wrong.  Chupacabra means “goat sucker” not “chicken killer”.  So, we did a search in the PhishMe Intelligence database and were surprised to see not only that “chickenkiller.com” was used in two different malware samples in the past week, but that there were also more than sixty phishing sites that linked to that domain!

What we’re seeing here is a combination of “Free subdomains” and “Dynamic DNS.”

The Anti-Phishing Working Group reports on the use of Subdomain Services for Phishing in its twice yearly Global Phishing Survey.  In their last report, released on May 27, 2015, they found that free Subdomain services were used for phishing in approximately 6% of all reports.  About half (49.5%) of all those occurrences involve DNS abuse by cybercriminals, specifically, free “altervista.org” subdomains.

PhishMe’s Phishing Operations team would certainly agree that Altervista.org hosts a large quantity and variety of phishing subdomains!  Already in 2015, we’ve seen altervista.org used in eleven different malware campaigns delivered via spam email, the majority of which distributed fake antivirus software and CryptoLocker ransomware. Additionally, 724 phishing sites on 424 different hostnames have been identified. Those phishing sites spoof 42 different online brands, and all are freely provided by Altervista.org.

When a “Free subdomain” is provided, it just means that rather than registering your own domain name and having to pay for it, you can add a hostname to an existing domain name that the free subdomain provider is giving out.  Often the quid pro quo for the free subdomain is that advertising may appear on the website that offers the free service.

Dynamic DNS

“Dynamic DNS” is something else.  For various reasons, people may want to have a name for their computer which follows them wherever they go.  This is common, for instance, with the online gaming community.  If I’d like my fellow gamers to be able to use a gaming server on my computer and I have DHCP, it is possible that my IP address might change from time to time. I could therefore register my computer with a Dynamic DNS service.  If I were to register a box for gaming, I may name it something like “GaryGamingBox.hopto.org”.   Each time my computer came online, it would reach out to the Dynamic DNS service at “hopto.org” and let that Dynamic DNS service know my current IP address.  The Dynamic DNS service would then publish a record so that anyone looking for “GaryGamingBox.hopto.org” would know my current IP address and could play a game.

While the service is valuable, it is open to DNS abuse by cybercriminals.  Rather than having to risk exposing their identity by purchasing a domain name, cybercriminals can set up a phishing site on a laptop computer, link that computer to a Dynamic DNS service, and visit a nearby Internet café or hack someone’s Wi-Fi and connect anonymously to the Internet.  The problem is also very common with cybercriminals who run a class of malware called Remote Administration Trojans or RATs.

In June of 2014, there was a great deal of controversy when the Microsoft Digital Crimes Unit disrupted two very large Remote Administration Trojan groups which they called Bladabinid (more commonly known as njRAT) and Jenxcus (better known as H-Worm.)

In order to disrupt the RATs, the Microsoft Digital Crimes Unit obtained a court order allowing them to seize control of the Dynamic DNS service Vitalwerks Internet Solutions, d/b/a NO-IP.com.  While the seizure was quickly reversed due to public outcry, the truth remained that many hacking websites and documents on how to set up your own RAT begin with instructions on how to link your Botnet Controller to a Dynamic DNS service.

The “builder” that lets a malware author create his own customized RAT prompts the criminal for the hostname that an infected victim should “call back” to in order to provide the Botnet criminal with remote control of the targeted machine.  These RATs are used for a variety of purposes, including in many cases, controlling the webcam and microphone of the victim which can lead to “sextortion” and blackmail.

ChickenKiller?

While the Microsoft takedown and the APWG report identify many of the most popular domain names used for Dynamic DNS, ChickenKiller.com is a gateway to a much larger and more varied community.  When we visit “ChickenKiller.com” we are provided with this screen, informing us that ChickenKiller.com is one of the 90,000 Free DNS domains operated by Afraid.org, currently serving 3.7 million subdomains and processing 2,000 DNS queries per second.

The Afraid.org domain list provides 91,647 domains that users can choose to host their free subdomain.  Since they are ordered by popularity, we checked the most popular ones against our phishing database:

mooo.com = 21 phishing campaigns, the most recent of which was a Wells Fargo phish wellsfargo.com-login-online.mooo.com. Others included Poste Italiene, Paypal, Carta Si, Bank of America, QuickBooks (Malware), Netflix, and Banco de Reservas.

chickenkiller.com = 59 phishing campaigns for a variety of brands, most recently Poste Italiane and Taobao.

us.to = 311 phishing campaigns, most of which were Paypal related, including some PayPal phishing campaigns from today on info-limit.us.to. Others included Facebook (warnku.us.to) and National Australia Bank.

strangled.net= 10 phishing campaigns, most recently a PayPal phish on www.paypal.service.com.strangled.net, but also Apple, Sicredi, Visa, MasterCard, and Taobao.

crabdance.com = 8 phishing campaigns, most recently an Apple iTunes phish.

info.tm = 75 phishing campaigns, including a Paypal phish from this week, paypal-serviced.info.tm and paypal.verfield.info.tm

While many of the phishers are taking advantage of Afraid.org’s offer of “Free subdomain AND domain hosting!” others are being more subtle with their use of the free services.  For example, a recent Paypal phisher used the host “pplitalyppl.chickenkiller.com” in order to avoid having the true location of his phishing site shared in the spam emails that he was sending.  The spam contained the ChickenKiller link, which had a simple PHP forwarder that redirected the user to the phisher’s hacked website in the Netherlands.  In other cases the phishing page is on a “normal” hacked website, but the ACTION script that processes the stolen credentials, usually emailing them to a criminal, is hosted on a Free or Dynamic DNS subdomain.

The bottom line is that business customers need to be aware of DNS abuse by cybercriminals. Free subdomain and dynamic DNS services are often used by criminals for their Trojans AND their phishing pages.  These types of domains are also fairly unlikely to be used for legitimate B2B purposes, so their presence in your log files are likely to be highly suspect.  Also, be aware that Afraid.org is a white hat hacking group.  Josh Anderson who runs a wide variety of interesting DNS services at that site, hates to have his domains abused as much as anyone else.  If you see a suspicious subdomain address and the nameservers are set to “NS1.AFRAID.ORG” be sure to report it by emailing “abuse@afraid.org”. It could be yet another case of DNS abuse by cybercriminals.

Two Attacks… Two Dyres… All Infrastructure

Over the last few days, we have seen two waves of Dyre. The attackers have changed things up a bit and made it harder to analyze. By using memory forensics techniques, we took a peek into their command and control (C2) infrastructure. The #1 rule of memory forensics…everything has to eventually be decoded, and we’re going to use this to our advantage. Here’s a quick look at the waves of emails we received. (Figures 1 and 2)

Figure 1 phishing fax

Figure 1 — First wave of Dyre

.NET Keylogger: Watching Attackers Watch You

Throughout life, there are several things that make me smile. Warm pumpkin pie, a well-placed nyan nyan cat, and most of all – running malware online – never fail to lift my mood. So imagine my surprise to see, after running a malware sample, that the attackers were watching me. Here’s a screenshot of a phishing email we received, which contained a keylogger written in .NET.

Figure-1-Phishing-Screenshot

Figure 1 — Screenshot of phishing email

Bash Vulnerability CVE-2014-6271 – Worm-able and Possibly Worse Than Heartbleed

Post Updated 9/30/2014

Several months ago, the Internet was put to a halt when the Heartbleed vulnerability was disclosed. Webservers, devices, and essentially anything running SSL were affected; as a result, attackers were able to collect passwords, free of charge.

With Heartbleed, the exploit made a splash and many attackers started to use the vulnerability. One of the more high-profile attacks of Heartbleed was the CHS attack, where the attackers siphoned 4.5 million patient records by attacking a Juniper device, then hopping onto their VPN.

So how can something be bigger than Heartbleed? I’m glad you asked.

Four Ways Phishing Has Evolved in 2014

Phishing isn’t exactly a new kid on the block. Phishing is one of the most common email-based threats. It is a tried and tested tactic that continues to deliver impressive results for cybercriminals. That’s why phishing continues to grow in popularity. In the month of June 2014 alone, phishing activities totaled $400 million in losses, which could be annualized at $102 million per year.

While it has been around for years, phishing has evolved considerably and has increased in efficiency and effectiveness. In the last six months (as compared to 2013), we’ve seen several differences in the type, size and sophistication of phishing attacks. In this post, we’ll explore the notable differences in the modern phish and discuss new phishing trends that we have seen in 2014 thus far.

#1:  There has been an increase in application-targeted attacks.

One of the primary trends that we are seeing in the phishing space, are attacks directed at commonly-used applications like Google Docs, Gmail or Yahoo. In the past, we saw a lot of big brands being attacked. However, today’s criminals are now going after things that are not directly related to the target company. The reason for this is the prevalence of password reuse. While large banks have improved their phishing defenses, personal email accounts provide a channel through which cybercriminals can gain access to individual bank accounts.

This trend is not limited to email programs, however. Considering that financial institutions have increased their defenses, cybercriminals are looking elsewhere and are diversifying their attacks. File sharing websites like Dropbox are major targets, as cybercriminals are able to use bogus links to intercept usernames and passwords. There has also been an increase in attacks targeting industries such as gaming, logistics and travel.

#2: Smaller brands are now being targeted.

While large brands still get a lot of attention, small brands, such as charities, are increasingly on the radar of cybercriminals. Similarly, there are also a lot of university phish. This trend began in 2013, but it has become more prevalent this year. Again, these brands provide a gateway for password reuse that allows cybercriminals to gain access to other things.

Targeted attacks against alumni have also become common in the university space. In most cases, the phisher will attempt to gain control of a university email account in order to reach out to trusted parties (such as boards of directors).

 #3: Attack frequency has increased, but size has decreased.

The number of attacks has increased, but the average size of a typical attack has dipped. While those “monster” attacks still exist, most phishing emails are now sent to a fewer number of targets than we saw last year.

#4: Phishing Emails are more believable.

Phishing emails are now much more sophisticated. We’re seeing fewer spelling mistakes and more professionalism in email design, which make the email campaigns much more believable and likely to be successful. Commoditization is driving down prices of phish kits, resulting in a much higher quality presentation.

In summary, each of these trends reflect that fact that cybercriminals are very opportunistic. Today’s cybercriminal is more professional and targeted than ever before. Not only does phishing persist as an attack method, it is increasingly more successful.

How does your organization plan to address the rise in phishing activity? Share your comments below.

Small but powerful — shortened URLs as an attack vector

Using tiny URLs to redirect users to phishing and malware domains is nothing new, but just because it’s a common delivery tactic doesn’t mean that attackers aren’t using it to deliver new malware samples. We recently received a report of a phishing email from one of our users here at PhishMe that employed a shortened google URL, and led to some surprising malware.

Through the power of user reporting, we received the report, discovered the malicious nature of the shortened URL, and reported the issue to Google – all within a span of 30 minutes. Google reacted quickly and took the link down shortly after our report.

Attackers using Dropbox to target Taiwanese government

While we have previously mentioned cyber-crime actors using Dropbox for malware delivery, threat actors are now using the popular file-sharing services to target nation-states. According to The Register, attackers targeted a Taiwanese government agency using a RAT known as PlugX (also known as Sogu or Korplug).

From an anti-forensics perspective, PlugX is a very interesting piece of malware. One of the main ways it loads is by using a technique similar to load order hijacking.

Dyre Banking Trojan: What You Need to Know

Beware of the Dyre banking Trojan! – A new malware threat that steals financial information such as login credentials. News of rhe Dyre banking Trojan has been circulating the web recently, following its discovery.

Dyre or Dyreza as it is also known exhibits classic banking Trojan behaviors such as using “man-in-the-middle” attacks to steal private information from victims. It is also being used on customers of certain banks in targeted attacks.

PhishMe identified this new malware on June 11, 2014. The Trojan is distributed via spam email messages that used similar email templates to other banking Trojan and malware distribution campaigns. Rather than infection occurring via a malicious attachment, the messages contained a link to a file hosted on Cubby.com: A free cloud storage provider. This campaign follows a recent trend in which cloud-hosting providers such as Cubby.com and Dropbox are used to host the malicious payloads.

As others within the blogosphere have noted, the Dyre banking Trojan is unique and represents a new type of malware being used by cybercriminals to steal banking credentials. Despite this novelty, its basic functionalities follow those that have long been employed by malware authors to exfiltrate private information from compromised systems. It’s a case of “the more things change, the more they stay the same.”

The Dyre banking Trojan works by ensuring that its hostile code is linked to the code of the victim’s web browser. As victim’s browse the Web, their web browser is effectively turned against them. This is part of the classic “man-in-the-middle” attack used by many malware types, including the prolific and notorious Zeus banking Trojan. As seen below, the binary data from this hostile code references browsers by name.

Part of the functionality is provided by “hooking” this malicious code into the browser’s runtime. Malicious actions then occur when the victim visits specific URLs or domains. This method has been seen before. Zeus Trojan variants and other banking Trojans such as Cridex use similar tactics. This can be seen in the malicious code itself as a list of URLs for popular banking websites, including the following:

  • businessaccess .citibank .citigroup .com/assets/
  • cashproonline .bankofamerica .com/assets/
  • www .bankline .natwest .com/
  • www .bankline .rbs .com/
  • www .bankline .ulsterbank .ie/

The “hooking” and the focus on a set of banks are examples of ways in which this new banking Trojan reuses methods common to many other types of malware. These methods are expected of many modern banking Trojans and are not out of the ordinary.

How is this threat actor likely to attack your organization? The source code of the malware provides a clue—in fact, it is the source of the name “Dyre”.

The hostile code “hooked” to browser processes by the malware contains a reference to the location of a “.pdb” or program database file. Compilers store data for debugging using this file type. More important to those seeking threat intelligence, it provides some information about how the malware writer or writers created this malicious software.

In the fight against malware distributors, knowledge is a powerful weapon. Leveraging actionable threat intelligence gives you the opportunity to identify the source of the infection. Armed with that information it is easier to mitigate the threat. PhishMe analyses these and other threats and uses the information to deliver active threat reports to help organizations take fast action to prevent malware attacks.

Machine-readable threat intelligence (MRTI) is provided in multiple formats to ensure that organizations are better prepared for malware and phishing attacks, thus preventing them from disrupting business processes and causing financial harm. Of course, not all organizations require threat intelligence to be fed through other systems. We also provide human-readable reports on the latest threats, allowing deeper analysis of the latest, and most serious threats. After all, being forewarned is being forearmed.