Cofense Intelligence recently identified a large Sigma ransomware campaign that contained significant deviations from the established TTPs employed by the actors behind this prolific piece of extortionware. These changes improve Sigma’s A/V detection-evasion and demonstrate new social engineering tactics intended to increase the likelihood that a targeted user would open the phishing email and its malicious attachment.
Posted by: Jason Meurer, Researcher, Cofense
As security researchers, we sometimes have very little information to begin our investigations or research activities. A rumor here or there can sometimes spread from a single word attributed to a current phishing or malware campaign. This was exactly the case for us on February 27th, when we identified a phishing campaign but were provided with very limited information to aid us in starting our research.
Adding to a growing trend of phishing attacks wherein Windows and Office functionalities are abused to compromise victim systems, Cofense Intelligence™ has analyzed a recent campaign that uses the URL file type to deliver subsequent malware payloads. This file type is similar to a Windows LNK shortcut file (both file types share the same global object identifier within Windows) and can be used as a shortcut to online locations or network file shares. These files may abuse built-in functionality in Windows to enhance the ability of an attacker to deliver malware to endpoints.
By abusing these built-in functionalities, threat actors can complicate detection and mitigation in these scenarios, because the software is behaving exactly as it was designed to. The proliferation of abuse techniques indicates that threat actors may be increasingly prioritizing the use of such methodologies due to detection difficulties.
The emails analyzed by Cofense Intelligence include a nondescript phishing campaign that informs recipients of an attached bill, receipt, or invoice. The analysis performed for Threat ID 10993 focused on emails that deliver attached URL shortcut files with their target resource identified using the “file://” scheme. Windows environments use this scheme to denote a file resource that is on the hard drive or hosted on a network file share.
However, the target for these Uniform Resource Identifiers (URIs) can also be a remote resource. When a URL shortcut file is written to disk, Windows will attempt to validate the target denoted by the “file://” scheme. If validated, the remote resource can be downloaded to the local machine. The use of this file format and URI scheme may indicate that threat actors seek to abuse the resource resolution functionality associated with these shortcut files to deliver malware onto victims’ machines at the time the URL file is extracted from a Zip archive.
Figure 1 – URL shortcut files can reference remote file shares to deliver malware
Figure 2 – Downloading a payload over SMB is a less-common method for malware delivery
This technique showcases yet another method in which commonplace Windows features are abused by threat actors, adding to the expanding set of delivery applications crafted to distribute malware.
The nature of these files reveals the risk involved with applications that obtain files simply by issuing connection requests without user interaction. Incident responders and network defenders must devise a response plan to address this scenario, especially if enterprises and organizations operate on a Windows environment. This campaign also demonstrates that as threat actors develop new attack methodologies, more emails are likely to reach user inboxes. Therefore, it is crucial that those users can identify and report such campaigns, because they are the final line of defense at that point.
Sign up for free threat alerts. Get phishing and malware trends delivered to your inbox: https://cofense.com/threat-alerts/
Cofense Intelligence™ uncovered a resurgent Sigma ransomware campaign on March 13, 2018 following a noted three-month hiatus of the malware. Although many aspects of this campaign—including its anti-analysis techniques—are consistent with previously analyzed Sigma samples, its return is in and of itself atypical.
Rohyt Belani, CEO & Co-founder, Cofense
So far, it’s been a very exciting 2018 here at Cofense, with our recent acquisition and announcement of our new name and brand. We continued performing well as a company and launching numerous new features across our products.
On February 27th 2007, while on the phone with my friend and co-founder Rohyt Belani, I typed the name phishme.com into GoDaddy™. We couldn’t believe our good luck and immediately registered it. As the co-founder who named this company PhishMe®, the emotional attachment is real. Somewhere in the pile of entrepreneurial startup books, I have a branding book that suggested your name is a vessel that should be big enough to carry your future products and services. We outgrew that boat quite some time ago.
BY MIKE SAURBAUGH AND GEOFF SINGER
Visualize Phishing Relationships with PhishMe Intelligence™ and Maltego
Fishing (without the “P”) is not a lot of fun when you just drop a line in the water and hope for the best. When fishermen want to see where the fish are, they look to the fish finder on the bridge to “look underwater” to find schools of fish. Similarly, when an analyst is looking to “catch” a phishing campaign, correlating the attacker’s campaigns and their payloads can benefit by being able to visually graph and link phishing threats. PhishMe Intelligence combined with Maltego can deliver the “phish finder” that an analyst needs.
Hunting Phished Endpoints with PhishMe Intelligence™ and Carbon Black® Response
While sipping coffee and reading the morning headlines, the CISO notices a global mass-phishing campaign that took place overnight. Picking up the phone and calling the SOC, the CISO asks; “Are there any computers that may have been infected with ‘X’ that I read about this morning? I need answers before my meeting in an hour”.
PhishMe IntelligenceTM Integrates with ThreatQuotient’s ThreatQ Platform
Swimming in a sea of threat intelligence indicators and services, security teams have been working towards effective ways to centralize, de-duplicate, and correlate massive amounts of threat data. The challenge, once this is done, is acting on what matters most. This requires intelligence, not just data.