#malware campaign

Last week, the Google Play store disrupted a large malvertisement scam targeting Android users. The campaign was discovered by HUMAN’s Satori Threat Intelligence, which dubbed its operation ‘SlopAds’ since many of the apps associated with the attack were mass produced (in much the way ‘AI slop’ is). This was a worldwide malware campaign, with the highest concentration in the US (30%). So far, 224 malicious apps have been uncovered, accounting for millions of downloads.

If a user installs one of the apps through the Play store, it behaves normally. However, if the download was via the affected ads, it would use Firebase Remote Config to begin the infection.

The first act of the app is a determination if it was installed on a legitimate user’s device, as opposed to research analysis or a security sandbox. If it determined this to be the case, it remains inactive and therefore undetected. But if the app passes those checks, it downloads four PNG images using steganography to hide pieces of its payload. This is the practice of representing information within another message or physical object, in such a manner that the presence of the concealed information would not be evident to an unsuspecting person's examination (source: Wikipedia). An example of this that most people would be familiar with is a color chart during an eye exam to determine the presence and/or type of color blindness. An image, usually a number, ‘hidden’ in layers of similar colors. In this case, the images being downloaded contain hidden code within encrypted layers.

Once decrypted, the reassembled images complete the ‘FatModule’ payload, a malicious APK. APK is the file format used by Android and Android based OS’s to distribute and install apps. FatModule’s function is the collection of device and browser data, using hidden WebViews to generate fraudulent ad clicks and impressions to the threat actor(s) owned domains and cashout sites, thereby providing revenue for the threat actor(s). Given the large number of affiliated apps, many of whom share the same AI theme, hence the operation name, it can be assumed that this campaign was intended to have a massive scope.

This type of malvertising is becoming more prevalent and sophisticated. And while the Google Play store was able to remove all the apps identified as being compromised so far, and users are protected by Google Play Protect, I doubt this is the last we’ll see of this type of attack. The infrastructure of this campaign is such that it is difficult to ascertain how it works until after the fact, making prevention a challenge. But the first rule of the internet remains relevant: never click an untrusted link. Going directly to the source of any app is almost always going to be safer than clicking an ad. And your friendly neighborhood WISP is here to provide the awareness to be forewarned and forearmed.

Brute force attacks are not a topic I’ve covered before, and with fairly good reason. Most campaigns these days rely on mimicry, social engineering and obfuscation to get into a system. But that doesn’t mean that the spray and pray tactic is completely gone, as evidenced by Check Point Research’s article on a botnet version currently active in the wild.

I covered the topic of weak passwords in November of last year, citing research from Comparitech that collected the most common passwords used by accounts that had been hacked, some 2 billion of them. This current campaign is not nearly so widespread...yet. GoBruteforcer was first reported on in 2023, targeting web servers running phpMyAdmin, MySQL, FTP and Postgres services. As the designation implies, it’s written in Golang and uses brute force to gain entry. Brute force is the ‘trial and error’ model whereby an attacker guesses at login credentials until they find one that works. Before exploitation of vulnerabilities became the norm for malware deployment, this was a more common strategy that led to many web services to implementing the security feature of only allowing three attempts to login before locking the user out.

The current version is still targeting the same services, but has changed infrastructure slightly. It is using a two pronged approach, an Internet Relay Chat bot that enables remote control of the compromised host, and a brute force scanner for public IP addresses. The brute force has been automated and restructured to follow the logic paths of LLM’s, as that is pre-collated data. CPR’s article points out that this is not likely a deliberate targeting of AI itself; it’s simply using that framework of already collected data to make its scanning more successful. The attack is also focusing on particular configurations, such as those found in tutorials, demonstrations or preinstalled FTP and default credentials that administrators may not know are there, and therefore don’t ever change. Once inside a system or server, the IRC bot then takes over command and control, generally for ransomware purposes.

The campaign has been observed in small batches, usually rotating a list of 200 credentials at a time. While that doesn’t sound particularly threatening, given the sheer volume of users on a global scale, Comparitech’s list proves that far too many login/password combinations are laughably weak and would not stand up against a focused attack aiming for them. And all it takes is one success to gain entry to a larger array of information in a server setting. Think of how cloud storage operates, holding data from a variety of sources with often just one security checkpoint for access. It is the same issue as ever with trusting a third party vendor in the supply chain. If that third party is compromised, everything it has access to is also compromised.

CPR highlights that GoBruteforcer attacks legacy web server software like Unix and XAMPP, still in use by a large number of websites. There are not many malware campaigns that can hack Linux systems and programming due to its high level of personalized configuration, but that only works if those configurations are actually personalized. This is targeting configurations that were never changed from default, which sadly occurs more often than one might think. An ounce of prevention is worth a pound of cure, and the best way to keep GoBruteforcer out is to change those logins and passwords to something other than ‘user’ and ‘admin’.

With the holidays upon us, it’s been fairly quiet on my feeds. But there is some news to report on from over the weekend. And with Christmas rapidly approaching, this will be my only report this week.

Cisco has published an advisory affecting the Cisco AsyncOS software used on Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, according to Arctic Wolf. This vulnerability is on an unpatched zero-day vulnerability, which only affects deployments with the Spam Quarantine feature enabled. It allows arbitrary commands with root privileges on affected devices, but is not active by default.

The Register reports that the Venezuelan gang, Tren de Aragua (TdA), is collectively charged by the US Department of Justice with 54 counts of ATM hijacking across the country, targeting certain banks and credit unions.

Helpnetsecurity reports over 115,000 internet-facing WatchGuard Firebox firewalls may be vulnerable to compromise via CVE-2025-14733, a remote code execution vulnerability actively targeted by attackers. This vulnerability is an Out-of-bounds Write and can be exploited without user action. It affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.

Currently only observed in Uzbekistan, Android APK droppers – malware disguises as legitimate apps – are deploying Wonderland (formerly known as WretchedCat) across mobile platforms. It’s being executed through fake Google Play Store web pages, ad campaigns on Facebook, bogus accounts on dating apps, and messaging apps like Telegram, according to The Hacker News. This campaign is combining droppers, SMS theft, and RAT capabilities.

And finally, in good news, Docker has released hardened open source images for every developer and organization, according to Bleeping Computer. These images include a software bill of materials (SBOM), public Common Vulnerabilities and Exposures (CVE) data, provenance met at Software Supply Chain Levels for Software Artifacts (SLSA) Build Level 3, and cryptographic evidence of authenticity.

I wish all my readers a happy and healthy holiday season. I’ll be back next Monday for another weekend (and week) recap in time for New Years.

It’s a tough economy out there. There are more job seekers than positions, and the process for applying to them has changed dramatically over the last few years (thanks, covid). There is also an aspect of many companies not actually knowing what they need or want out of an applicant. Or they’re using AI to filter applications, very often disregarding qualified people because of missing keywords, which is another rant entirely that I won’t get into here. All of this means that more research into a potential job is being required by applicants than ever before. The act of finding a job has become a job in and of itself. And threat actors are taking advantage of it.

Trend Micro released a report yesterday detailing their findings on ValleyRAT, a remote access Trojan currently being deployed in a campaign targeting those actively job hunting. Aside from the usual email phishing tactics containing malicious attachments, ValleyRAT is also utilizing a weaponized Foxit PDF reader, thereby creating a dynamic-link library (DLL) side load to gain access to a device for the purpose of data scraping.

I feel like this is a particularly insidious campaign, making victims of those who are likely already frustrated by a job market that sees them as disposable. I’ve been in the trenches of unemployment, and to consider suffering the indignity and stress of that compounded by the risk of having all my personal data stolen is enraging. I will acknowledge, however, that the tactic is a clever one. The aforementioned stress and frustration aids in lowering caution, and works to the benefit of whoever is behind this attack to spread the RAT more comprehensively. People desperate for work will reach out for whatever they can find, diligence thrown to wayside.

Legitimate PDF’s download in a specific file format, .pdf. Anything that downloads as .exe means it’s an executable file and should be considered a huge red flag for something that should not be executing anything. It’s the sort of simple difference that was once common knowledge, but in an era when basic computer literacy is dropping, it bears reiterating. Most RAT’s sneak into a device this way, as an executable disguised as something else. That’s why they’re called Trojan horse viruses, after all.

Trend Micro’s report has diagrams detailing the chain of infection and metrics of their study, as well as an image of a decoy being used in the campaign. Besides the executable nature of the download, I also immediately saw a typographical error in the decoy, another red flag (‘commition’ instead of commission).

ValleyRAT contains files with Python scripts hidden within zip executables masked as document files. These files and commands establish persistence, with the user unaware that it’s running in the background stealing their browser data. Trend Micro also found a number of other typical characteristics of a RAT, most of which are familiar to anyone in the industry, but less well known by the layperson: self-signed authentication structures, outdated versions of TLS, long validity periods, and of course, the hijacked legitimate source.

It is a tough economy out there. But it never pays to let down your guard when you’re job hunting. RAT’s are at least easier to remediate than many other malware families. And your friendly neighborhood WISP is always here to help.

Malware is usually a short form game. Get in, deliver the payload, create profit for the threat actor. Obfuscation and evasion from security are part and parcel of malicious activity. It’s all for nothing if one gets caught, after all. But evidently, that brevity is not always the case. Koi researchers have uncovered a long, long campaign targeting Microsoft’s Chrome and Edge browsers. Dubbed ‘ShadyPanda’, this attack has been ongoing for seven years, spanning multiple generations of updates and operating systems.

It began with a handful of extensions offered as productivity tools, slowly amassing downloads and use, gaining Verified and even Featured status. And there, those extensions waited. Collating data the way any analytical tool would. Monitoring traffic, watching patterns emerge, collecting keystrokes, histories, even mouse clicks accurate down to pixel sized coordinates. As Koi put it, this wasn’t a fixed function malware; it was creating a backdoor. One that accumulated hundreds of thousands of installations. The key to the success of this covert intrusion was trust. Years of seemingly legitimate – and therefore harmless – activity garnered from initial approval that was never followed up on to make sure it was still behaving properly. Due to its verified status, it became part of the automatic update schedule, a persistence tactic with no action required from it.

But this was just one phase of this campaign. ShadyPanda tested the waters in 2023, with 145 extensions mimicking wallpaper and productivity apps. Every click inserted tracking codes and used Google’s own analytics to monetize browsing data. This was direct affiliate fraud. ShadyPanda learned some things from this campaign: the review process focused solely on submission and not continuing activity, how to gain trust from users, and that patience pays off.

The next phase of the campaign went from covert monetization to active control. In early 2024, the malware began hijacking core functionality in the browser. Links were redirected, cookies were exfiltrated. This was an asynchronous attack, meaning it did not require human oversight to execute. This phase did not last long. Corrupted extensions were discovered and removed within weeks of deployment.

But ShadyPanda had been quietly gathering all this data in order to unleash the main event: pushing the active malware now that it had been verified and trusted. The five extensions first submitted and approved back in 2018-19 now carried the same payload, automatically updated by Chrome and Edge themselves. Utilizing its asynchronous nature, the malware runs a remote code extension every hour in infected systems, via arbitrary JavaScript to execute with full API access in the browser. This is the backdoor it’s been all along.

Currently, the payload monitors every website visit and exfiltrates encrypted data to ShadyPanda's servers, including each URL visited with full browsing history, HTTP referrers showing navigation patterns, timestamps, complete browser fingerprints (language, platform, timezone, screen resolution, user agent) and more. All of this is delivered to the CleanMaster store, the extension most known for carrying the malware. It exhibits both anti-analysis evasion (reverting to ‘legitimate’ behavior if developer tools are opened) and man-in-the-middle attacking.

And this still isn’t all ShadyPanda is doing. Other extensions were released in 2023, all of which are still active in Microsoft’s marketplace. Two are known to be spyware, and one of them (We Tab) has over 3 million downloads alone. We Tab collects and exfiltrates data to 17 separate domains, most of which are in China.

This is a sophisticated, muli-layered campaign, leveraging a long standing vulnerability inherent in any app store: trust. A single threat actor (that we know of) has compiled extensive amounts of data on millions of users on a global scale to use however they want. Koi is confident that this is the work of one overarching malware; code signing similarities, overlapping infrastructure and identical obfuscation techniques evolving over time link these attacks together.

Details of the apps, coding and commands are laid out in Koi’s article (which I’ve linked above). This is a sign that app stores need to not only check submissions for fraudulent behavior, but also check in from time to time to make sure they’re still safe.

A client’s website was experiencing random pop-ups as server side scanner logs revealed a JavaScript injection related to Sign1, which is a malware campaign that targets websites and has infected over 2,500 websites in the past two months and uses challenging techniques to evade detection.   Daily server-side scans are crucial to detect changes like new malware, examine website logs, and identify…

माइक्रोसॉफ्ट का अलर्ट: गूगल क्रोम, फायरफॉक्स या दूसरे वेब ब्राउजर पर आया मैलवेयर; अगस्त तक डेली 30 हजार डिवाइसेस पर अटैक किया

Hindi News Tech auto Google Chrome, Firefox, Other Browsers Impacted By Widespread Malware Campaign: Microsoft Ads से है परेशान? बिना Ads खबरों के लिए इनस्टॉल करें दैनिक भास्कर ऐप नई दिल्ली33 मिनट पहले कॉपी लिंक कंपनी के मुताबिक एड्रोजेक नाम का मैलवेयर इस साल मई में आया था माइक्रोसॉफ्ट ने इस साल करीब 159 यूनिक डोमेन को ट्रैक किया है माइक्रोसॉफ्ट ने ब्राउजर इस्तेमाल करने वाले यूजर्स के लिए…