Hackers are using search-engine optimization (SEO) tactics to lure business users to more than 100,000 malicious Google sites that seem legitimate, but instead install a remote access trojan (RAT), used to gain a foothold on a network and later infect systems with ransomware, credential-stealers, banking trojans and other malware.
eSentire’s Threat Response Unit (TRU) discovered legions of unique, malicious web pages that contain popular business terms/particular keywords, including business-form related keywords like template, invoice, receipt, questionnaire and resume, researchers observed, in a report published Wednesday.
Attackers use Google search redirection and drive-by-download tactics to direct unsuspecting victims to the RAT—tracked by eSentire as SolarMarker (a.k.a. Jupyter, Yellow Cockatoo and Polazert). Typically a person who visits the infected site simply executes a binary disguised as a PDF by clicking on a purported “form” — thus infecting his or her machine.
“This is an increasingly common trend with malware delivery, which speaks to the improved security of applications such as browsers that handle vulnerable code,” researchers wrote. “Unfortunately, it reveals a glaring blind spot in controls, which allows users to execute untrusted binaries or script files at will.”
Indeed, the campaign is not only far-reaching but also sophisticated.
The common business terms serve as keywords for the threat actors’ search-optimization strategy, aptly convincing Google’s web crawler that the intended content meets conditions for a high page-rank score, which means the malicious sites will appear at the top of user searches, according to the report. This increases the likelihood that victims will be lured to infected sites.
“Security leaders and their teams need to know that the threat group behind SolarMarker has gone to a lot of effort to compromise business professionals, spreading a wide net and using many tactics to successfully disguise their traps,” said Spence Hutchinson, manager of threat intelligence for eSentire.
Financial-Sector Cyberattack
Researchers describe a recent incident they observed in which a victim in the financial industry was searching for a free version of document online and was redirected via Google Search to a Google sites page controlled by threat actors that included an embedded download button.
Indeed, a person working in the financial industry would be a “high-value target” of the campaign, giving attackers various methods to compromise an organization and commit cybercrime, researchers noted.
“Once a RAT has been installed on a victim’s computer, the threat actors can upload additional malware to the device, such as a banking trojan, which could be used to hijack the online banking credentials of the organization,” they said. Threat actors also could install a credential-stealer in this way, to harvest the employee’s email credentials and launch a business email compromise (BEC) scheme.
“Unfortunately, once a RAT is comfortably installed, the potential fraud activities are numerous,” researchers noted.
The TRU team also peeked under the hood of the RAT itself, which they said is written in the Microsoft .NET framework and has used various decoy applications that download to a victim’s computer and would appear to belong there. Most recently, TRU observed that the Slim PDF reader software was the decoy being downloaded.
“This serves as a distraction, as well as an additional element to help convince the victim that they are downloading a PDF,” researchers wrote.
Over the last months of 2020, attackers used other file formats for the decoy app, including docx2rtf.exe, photodesigner7_x86-64.exe, Expert_PDF.ex, and docx2rtf.exe, according to the report.
Ever wonder what goes on in underground cybercrime forums? Find out on April 21 at 2 p.m. ET during a FREE Threatpost event, “Underground Markets: A Tour of the Dark Economy.” Experts from Digital Shadows (Austin Merritt) and Sift (Kevin Lee) will take you on a guided tour of the Dark Web, including what’s for sale, how much it costs, how hackers work together and the latest tools available for hackers. Register here for the Wed., April 21 LIVE event.
