Russian threat actors are hijacking popular YouTube channels to propagate infostealing malware
Multiple global software brands spoofed, centred around media production and editing software
Sensitive data (including general authentication and cryptowallet information) is being uploaded from infected computers to attacker-controlled C2 servers.
Background
Infostealer activity is on the rise. Malware-as-a-Service is becoming more and more popular with threat actors operating via rogue states. Russian marketplaces in particular have contributed towards an exponential rise in reports of stolen credentials over the past 12 months.
In December of last year, Accenture published research that documented an increase in infostealer malware available for sale on the dark web, fuelled by the growing popularity of ‘MFA fatigue’ attacks – an unsophisticated yet effective intrusion method which bombards a compromised corporate account with MFA push messages until the victim accepts, and the threat actor gains access to the account.
Attack vectors
Our content scans began picking up various distinct templates hosted on new phishing domains on October 2nd 2022. Homepages began to emerge that distributed popular software packages free of charge.
Photo and video editing tools are common lures, especially for threat actors utilising the Raccoon infostealer, and particularly those used by content creators on media-sharing sites such as YouTube (see below).
Here’s a few of the templates we discovered, all utilising the same basic approach:
Following the emergence of infostealer domains, videos started to appear on compromised YouTube accounts publicising ‘cracked’ (malicious) applications from global brand names in the world of video, photo and sound editing.
Even though creators are able to recover their accounts through YouTube’s support channels, threat actors use a compromised channel’s organic reach to publicize infostealing malware whilst they are in control of publishing content.
The popular soccer-themed YouTube channel, Los Displicentes (youtube[.]com/LosDisplicentes) is one such channel that was recently compromised.
Lead-soft[.]biz is an attacker-controlled domain that claims to distribute FL Studio and Adobe products free of charge, among others:
Lead-soft[.]biz
Los Displicentes, which boasts 2.1 million subscribers, produces content that focuses on the world of Argentinan football, but following an attacker takeover, its most recent upload on Tuesday 22nd February is entirely concerned with promoting ‘Adobe Premier Pro Crack’ software.
The Los Displecentes YouTube channel, with malicious content placed next to legitimate uploads
In the video, an actress mimes the speech of an AI voice overlay that directs users to lead-soft[.]biz:
Video from the Los Displicentes YouTube channel publicising a malicious domain (lead-soft[.]biz)
lead-soft[.]biz/adobe-premiere-pro was created on February 16th. Within 5 days of registration, threat actors managed to gain control of one of Argentina’s most popular YouTube channels and use its 2.1 million subscriber base as a malware distribution service.
Registration information for lead-soft[.]bizYouTube description listing lead-soft[.]biz, directing users to a fake Adobe Premier Pro download site
Analysing the lead-soft[.]biz infostealer malware
Once it’s captured traffic, lead-soft[.]biz directs users to download a .RAR file containing the executable and various .DLL files:
Infostealer executables deploy ‘binary padding’ techniques – a tactic that alters the checksum of the file, in order to circumvent hash-based blocklists and static anti-virus signatures.
Changing the on-disk representation of malware prevents detection by popular online tools such as VirusTotal, and stops any upload to public sandboxes that impose file size limitations.
Once launched, the malware initiates a child process, which uses powershell.exe to execute a 64-bit encoded command that adds the C: directory as a path in the exclusion list referenced by Microsoft Defender:
The executable also attempts to read cryptocurrency wallet paths (see below), along with accessing credentials from browsers and locally-stored accounts in \Users\Admin\AppData\Local\Microsoft\Credentials\:
Analyzing the post request reveals attempts to connect with a C2 server @ 45.15.156[.]239, to import VC++ libraries and upload stolen data:
POST requestResponse from POST request showing import of libraries and upload of system/wallet information (1)Response from POST request (2)
Geographic locations
The majority of C2 servers were hosted on IP addresses from Europe and Russia, using Russian ASN services. The C2 server involved in the lead-soft[.]biz malware also uses a Russian autonomous system called PARTNER-AS.
The Burmilia infostealer
One of the domains (currently offline) linked with a campaign that propagates the Burmilia infostealer uses the Russian IP 94.226.121[.]108 as its C2 server – further evidence of the region’s role as a hotbed of activity for malware distribution:
Domain hosting the Burmilia infostealer, with C2 POST connection attempts to 194.226.121[.]108Enrichment of the above malicious IP in Silent Push Enterprise
Silent Push global feeds feature multiple flags that pinpoint the infrastructure observed in infostealer campaigns across the world.
Our enriched data sources also provides researchers and security teams with additional insights such as active and freely-accessible open directories.
194.226.121[.]108 hosts a C2 server, and an open directory containing a remote access trojan (fdasf.exe):
Open directory on 194.226.121[.]108VirusTotal analysis of fdasf.exe
We also discovered Burmilia’s admin panels, hosted on 194.190.153[.]137 and 178.20.42[.]14:
Burmilia admin panel on 194.190.153[.]137 and 178.20.42[.]14
Summary
Infostealing campaigns are a persistent menace that perpetuate targeted attacks on global software brands serving a broad range of commercial use cases – from financial apps to remote access tools, editing software and creator-focused platforms.
Alongside the campaigns we’ve discussed in this blog, we’ve also investigated the infostealing malware Redline and Rhadamanthys.
We’ll be passing our research on to all of the organizations affected, including YouTube and Adobe.
Silent Push continues to facilitate early detection of infostealing IoCs through multiple layers of intelligence – from point of infection, to download and the identification of C2 infrastructure.
Take advantage of our vast array of threat defense tools by signing up for the free Community App.
Last month we blogged about malvertisement activity involving Russian banking trojans, originating from malicious Google ads.
Attack vectors included search phrases and fake advertisments targeting remote desktop apps and online meeting platforms.
A couple of days after releasing our research the FBI issued a PSA, warning users about brand impersonation activity that uses popular search engines as a tool to distribute malware.
Since then, we’ve been on the lookout for similar activity targeting the type of brands targeted in the initial campaign. We’ve uncovered new attack vectors featuring other spoofing activities not limited to the original campaign.
AnyDesk spoofing
One of the brands targeted in the initial campaign was AnyDesk – the remote desktop platform.
With the help of scanned data from Silent Push’s enrichment query, we’ve kept an eye on the AnyDesk attack vector, among other remote desktop tools.
Throughout our collaboration with MalwareBytes whilst investigating DDOS-Guard, we uncovered a host of phishing domains impersonating AnyDesk software on the same IP infrastructure that hosted multiple spoofing pages targeting MSI After Burner, Trading View, Team Viewer, open source software such as OBS Studio and infostealers including Vidar and Aurora.
Through a combination of enriched data monitoring and granular research into DDOS-Guard’s infrastructure, we’ve kept track of similar infostealer-based threat activity, which has stuck around for the last two months.
In many cases, malware is being hosted on legitimate services such as Dropbox and Discord – domains hosted on 45.15.156[.]55 feature download links to an archive file hosted on Discord.
Domains hosted on 45.15.156[.]55Malicious infrastructure on msalterberners[.]comCode behind MSI Afterburner download activity
New attacks vectors
At the time of publication, both Dropbox and Discord have taken down multiple links involved in the campaign, but we are still seeing evidence of numerous new domains that are dropping similar infostealers.
Threat actors seem to be using DDOS-Guard’s services to propagate malicious activity.
We discovered multiple domains hosted on one of its IPs – 186.2.171[.]7 – targeting open-source software platforms such as Blender 3D, Digital Audio Editor Audacity, the Brave browser and the image editor GIMP, among others.
Even the spoofing domains that do not feature open source platforms – such as numerous typosquatted domains targeting the Steam community marketplace CS.Money – host malicious content similar to the spoofed open-source domains.
Preview of IPs hosted on DDOS-Guard infrastructureBlender spoofing domain, with active download linkGIMP spoofing domain with active download linkA typosquat of the CS.Money domain, appearing to host a fake Audacity variant
Infostealers and crypto wallets
In all these cases, download links prompt an install of a version of the Vidar infostealer, which in turn attempts to connect to a Telegram account (t[.]me/jetbim) and a Steam profile steamcommunity[.]com/profiles/76561199471266194
VT page for the infostealer
The malware is equipped with evasion capabilities, as well as resulting in a timeout in most open-source sandboxes:
Similar infostealers have been involved in spoofing brand domains redirected from Google ads. We anticipate that these brands will soon be targeted with SEO-poisoned malvertisements.
Cybersecurity-focused social media accounts have recently posted about the open-source Brave browser (one of the brands spoofed on this IP), redirected from Google Ads, which connect with the same Telegram and Steam community account highlighted above, hinting that the campaigns could be linked to the same group of threat actors.
Sekoia researcher tweet about a malicious Brave redirect from Google ads
Old campaigns still active with new IoC’s
As global attention turns towards active campaigns, threat actors are showing signs of resilience by moving on to new IoCs and previously unaffected infrastructure.
Banking trojans distributed through fake AnyDesk ads were one of the first malvertisment attack vectors we observed, and new spoofed AnyDesk domains are still being created – wvww.anydeskcom[.]top, featuring the IcedID banking trojan, is only 24 hours old at the time of writing, but the domain is already being distributed through Google ads.
The anydaske[.]website is visible from a Google ad, but the redirect points to a new domain in an attempt to keep one step ahead of researchers and security teams, by creating new IoCs that don’t appear in most global feeds.
Clicking on ‘Download Now’ injects the malicious archive file, containing the IcedID banking trojan.
The domain is hosted on 46.173.218[.]229, which proves the infrastructure consists of domains and brands that were involved in the previous malware distribution campaigns, such as Microsoft Teams, the IRS and Adobe.
Silent Push Query for IP 46.173.218[.]229VT page for the archive with new IcedID Banking Trojan
Through enriched scanning, we have identified pages being spoofed in numerous different languages, indicating typosquatted domains across multiple distinct global regions.
Portuguese language spoofing site
MetaMask browser extension scam
Malware delivery is not the only attack vector utilised by threat actors looking to abuse search engine platforms with SEO poisoning.
During our Google Ads research, we uncovered a campaign targeting users of the Synapse Bridge Protocol – a popular platform that allows for the transfer of crypto assets between blockchains.
The legitimate Synapse domain asks users to manually connect their crypto wallet of choice to facilitate a secure transaction.
The phishing domain, however, attempts to connect directly with a MetaMask wallet, providing that the MetaMask browser extension is already installed.
Alternatively, the malicious domain asks users to install the extension, if it’s not already enabled in their browser. As the user has been redirected from a legitimate search engine, there is a high chance that many would fall victim to it without manually verifying the correct domain name.
Legitimate Synapse Protocol domainPhishing domain spoofing Synapse, redirected from Google Ads
Most domains involved with this scam aren’t flagged on VirusTotal:
Conclusion
SEO poisoning and malvertising are not new techniques, but a recent surge in activity indicates there may be a lot more to come, with numerous new and well-established brands targeted across multiple global regions, languages and applications.
Government authorities such as the FBI have begun to sound the alarm about the rise in cases. Still, the sophistication of the threat actors’ approach and their willingness to switch to new infrastructure means that the number of people affected will inevitably rise.
It’s vitally important for security teams to protect consumers and supply chain operations by deploying proactive modes of defense, including keeping a lookout for any new campaigns utilizing SEO poisoning that are targeting their own or their customers’ infrastructure.
We’ve created a bespoke feed for our paid subscribers to keep one step ahead of threat activity. Our ‘Malvertising Domains’ feed is updated regularly with new IoCs – including suspect domains and IP infrastructure – and we’ll continue to monitor the situation using enriched data from our daily IPv4 scans, featuring billions of nodes across the globe.
Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.
A key component of any attack surface mapping operation lies in an organization’s ability to collect information related to its brand that isn’t exclusively limited to second and top-level domain data.
Subdomain data plays an increasingly important role in corporate ethical hacking endeavours, from red and blue team ops to bug bounties and standard threat management activities.
Let’s delve a little deeper into subdomain enumeration as a modern countermeasure, and explore how Silent Push’s new Subdomain Finder allows you to not only scan for subdomain vulnerabilities using a single query but also provides results with reputational risk scoring generated from automated queries, that are custom-made for a brand’s unique public DNS infrastructure.
What is subdomain enumeration?
Subdomain enumeration is the act of categorizing all subdomains for any given domain.
Enumeration isn’t limited to security functions. Brands often need to collect domain data for a range of organizational purposes, such as audits, inventory, product development cycles or restructuring activities.
From a security perspective, however, subdomain enumeration is explicitly concerned with providing security teams with an actionable list of assets that need to be protected from all manner of conventional and lesser-known exploits.
Why are subdomains so important to security-conscious organizations?
Subdomain takeovers are a growing malady within the world of corporate DNS security. If a subdomain has a CNAME associated with it, but no content is being provided by the host, threat actors can hijack the domain by deploying their own replacement host.
The consequences of such an attack are disproportionate to how easy it can be to perform the takeover in the first place, once a subdomain has been compromised
Threat actors are able to obtain hashed credentials, gain access to SSO-secured systems and applications via hijacked session cookies and perform cross-site scripting attacks that facilitate access to sensitive information and even have the ability to modify a site’s underlying HTML.
Obtaining a comprehensive top-down picture of an organization’s subdomain infrastructure allows security professionals to:
discover and directly address a larger attack surface than was previously acknowledged;
identify lesser-known entry points and vulnerable DNS records;
deal with dormant applications or migrated/expired services.
Subdomain data is one of several factors within Red and Blue Team ops that should be given an equal amount of consideration by both sides during a simulated attack, particularly throughout the reconnaissance phase, or indeed any activity that involves an adversarial assessment of a company’s public DNS infrastructure.
For both Red and Blue Team practitioners, subdomains offer a goldmine of information that facilitate the development of unique attack vectors and allow for robust defense mechanisms which are unique to the target organization, including:
safeguarding host and identity information;
securing organizational data;
identifying open databases or file repositories;
closing bridges to exploitable sites and services
Once a list of subdomains has been obtained, each one can be interrogated to ascertain whether the domain is live and its HTTP status code, further refining the attack surface map and providing specific subdomains that require attention.
How subdomain enumeration is carried out: passive vs. active domain identification
Subdomain enumeration techniques are categorized in two ways: passive enumeration and active enumeration.
Both techniques involve time-consuming and inexact ways of discovering a reliable list of subdomains that are prone to human error and don’t always return a categorical and up-to-date set of results.
Before reading on about passive and active enumeration, it’s important to note that the Silent Push Subdomain Finder achieves a complete list of associated subdomains through a simple search based on a single apex domain, without the need to engage with multiple distinct techniques spread across numerous DNS lookup tools, consoles and scripts.
Passive enumeration
Passive enumeration involves gathering domain data without any direct interaction with the primary domain infrastructure, with the help of third-party tools. Passive enumeration techniques include:
Scanning Certificate Transparency logs
Certificate Transparency logs all the entries of domain certificates in a centralised database, accessible to the public – including a list of domain names, subdomains, and email addresses.
ASN discovery
ISPs purchase unique IP address pools and ASN numbers from the Internet Assigned Numbers Authority (IANA), which distinguishes them from other providers. Security teams identify an ASN number by IP address (or domain name), which then leads them to an address pool. If a PTR record is visible on the DNS setup, subdomains can then be resolved to an IP address, using a variety of tools.
Operator searches on mainstream search engines
Certain subdomains can also be located using widely-used search engines (e.g. Google, Yahoo, Bing). Using the operator ‘site:’ prior to the brand name
Extracting subdomain data from multi-domain SSL certificates
Multi-domain SSL certificates allow a single certificate to secure multiple domains – including subdomains – underneath a single apex domain name (or even a completely different domain name) with the end goal of protecting the subdomains through SSL. Where present, subdomain data can be extracted from multi-domain SSL certificates using tools such as OpenSSL, or custom scripts.
Searching through large public DNS datasets
Various publicly available DNS datasets are available online that cover all manner of DNS data from a large number of visible domains online, from Forward and Reverse DNS lookups to SSL certificates and HTML responses. Each dataset is broken down into categories that contain responses for all records known by that particular repository, and security teams need to create their own filters and search scripts based on the subdomain information they’re looking for.
CDNs are groups of proxy servers linked together using a web application firewall (WAF) to cache content that’s closer geographically (also called a Point of Presence) to the end user who is requesting it, thereby increasing performance and reducing data bottlenecks.
Certain CDNs display DNS data for any target domain that a user is attempting to add, including a list of subdomains for the associated apex domain.
Active enumeration
Active enumeration involves direct interaction with the apex domain – rather than utilising publicly available information or third-party DNS services, in order to gather a list of associated domains:
‘Brute force’ discovery
‘Brute forcing’ (either utilising a unique wordlist or by using permutations of known domain names) involves using third-party tools in an attempt to guess subdomain hostnames through random or sequential strings of characters and/or numbers. This tactic is often used to discover hostnames that have either been overlooked by the controlling organization or to uncover subdomains that aren’t publicly discoverable using standard aggregation tactics.
DNS zone transfers
A zone file is a basic text file that includes data on the various mappings between domain names, IP addresses and other hostname information such as physical network assets.
If zone transfers aren’t properly configured and maintained, and a DNS server is allowed to transfer zone files to anywhere other than a controlled location such as a nameserver or specific IP address, zone files can be read by unauthorised personnel, along with a treasure trove of information relating to public and privately visible subdomains stemming from an apex domain.
Enumeration by CNAME and SPF record
Sender Policy Framework (SPF) is a method used to authenticate an email as originating from a trusted source – i.e. the domain that sent it.
The way that SPF discovery work means that if an accompanying record is not found on an email subdomain (e.g. sales.example[.]com) that validates that subdomain as being able to send email, then SPF will return a negative value without attempting to validate using the second level domain (example[.]com). Tools exist that parse domain and subdomain data from SPF records, allowing threat actors to extract information on how an organization’s public DNS presence is structured.
Canonical Names (CNAMES) are used to map a subdomain to a domain that’s used to host content. Querying CNAMES can be used to reveal information about associated subdomains, and any third-party services attached to them.
Harvesting Content Security Policy (CSP) data
CSPs are HTTP headers that allow domain owners to define what kind of content is able to be loaded on a specific website – e.g. JavaScript, CSS, frames, fonts, image files, and embeddable content such as Java applets, ActiveX, and audio/video files.
CSPs also contain domain and subdomain names that the CSP is applicable to. Various Python tools exist that parse domain names from CSP headers and provide further information, such as whether or not an A record is associated with a particular subdomain and any associated IP addresses.
The Silent Push Subdomain Finder
Obtaining an accurate and complete set of subdomains attached to an associated domain can be a time-consuming, inexact and unreliable process. Online DNS aggregators don’t always return an accurate set of results for a variety of reasons, and even paid-for services are liable to return suspect datasets that are incomplete, out of date and overtly incorrect.
Take this example from a well-known subscription-based service:
Invalid enumeration results
Several subdomains are listed as being first seen, and last updated, on January 1970. The Internet’s DNS architecture wasn’t invented until 1983.
The Silent Push Subdomain Finder utilises a comprehensive set of back-end enumeration techniques to output a complete list of what subdomains actually exist underneath a second-level domain, their associated IP addresses, any attached record and whether or not they are able to be connected to.
The service also scans the endpoint and facilitates a pivot into any other asset, record or piece of data associated with the same IP address.
Silent Push Subdomain Finder
Crucially, Silent Push subdomain enumerations are able to be monitored, with an email alert sent every 24 hours listing any changes, such as additions and removals to your DNS infrastructure (paid subscribers only).
Red and Blue Teams, bug bounty chasers and security professionals require a subdomain enumeration service that doesn’t leave them guessing and eliminates the need to interact with numerous different consoles, scripts, third-party tools, Linux platforms, online aggregators and vast unfiltered data dumps – most of which may be returning conflicting information based off inexact searches, guesswork and the incidental availability of public DNS information.
The Silent Push Subdomain Finder is available for free using the Silent Push Community App – The largest free library of SaaS-based threat defense tools available anywhere in the world.
Evidence of other malware hashes using the same methods
Background
Over the last few days, threat intelligence researchers have started to expose an SEO poisoning/malvertisment campaign, that’s attempting to propagate a well-known modular banking trojan – IcedID.
Threat actors are elevating malicious download pages to the front page of a Google search for popular applications, such as Slack and AnyDesk, by exploiting Google Ads:
Uncovered: New Anydesk/Gozi phishing campaign
Whilst creating custom threat feeds targeting middle domains found throughout the IcedID campaign, Silent Push threat analysts uncovered previously unexplored threat activity featuring a similar set of TTPs, but using the Ursnif/Gozi banking trojan – an early C2C progenitor with its roots in the Russian criminal underworld – distributed via a different group of AnyDesk phishing pages.
Google search manipulation
Performing a Google search using ‘anydesk download’ as the base parameter populates a set of results featuring a malicious Google Ad for an AnyDesk domain at the top of the list (anydesk-access[.]com), with the legitimate domain (anydesk[.]com) populated as a non-sponsored result immediately below it:
URL-based attack vectors
Previous AnyDesk malvertisment campaigns have featured legitimate URLs in the ad text. As evidenced above, this group of threat actors have managed to circumvent Google Ad safeguards and publish a malicious URL direct from the ad itself.
Clicking on the Google Ad led us to a download page for the aforementioned Gozi/Ursnif trojan executable, with the name ‘AnyDesk.exe’:
Fake AnyDesk landing pageFake AnyDesk download link, and file details
It’s interesting to note that the download link only populates via the Google Ad redirect. If the URL is accessed directly, the link doesn’t appear and the domain loads a graphically different webpage:
Undetected in VirusTotal
This browsing anomaly is likely the reason why, when submitted to VirusTotal, the URL is passed off as legitimate by 91 security vendors:
VirusTotal analysis of anydesk-access[.]com
Traffic analysis
A traffic trace using Fiddler shows a malicious domain redirect after the Google Ad populates an iframe from golunki[.]com:
Further investigation reveals another domain loading fake AnyDesk images, where users are led through several 302 redirects to a malicious file download at 4zuki[.]com:
1. golunki[.]com redirects to tradeview[.]moves
2. tradeview[.]moves triggers a script that redirects to a download link, after populating the main site with fake content:
3. The final download destination – 4zuki[.]com/download/AnyDesk.exe
Executable behaviour
Once downloaded, the trojan (f04469b9a67701e9da38b1d86a10546e) attempts to communicate with four C2 servers featuring Russian TLDs:
reggy505[.]ru
iujdhsndjfks[.]ru032p
gameindikdowd[.]ru
jhgfdlkjhaoiu[.]su
The executable also attempts a code injection attack that causes disruption by interacting with various Windows processes.
The software scans for the installation path of Microsoft Outlook:
Charting the executables interaction with system processes (Source – VMRay Analyzer)Meta data from malicious anydesk[.]exeMeta data from legitimate anydesk[.]exe
We also witnessed other pieces of malware being distributed using the same set of domains and malvertisments, not limited to Gozi derivatives, using the hash 61e2f9029baf7ce21d8de2eddea55405f20ed5db26ecbdaea42404ca28a08d7c:
Conclusion
This isn’t the first time that AnyDesk users have been the target of a phishing campaign featuring malicious remote access software. Large IT service companies need to be constantly aware of similar attack vectors featuring malicious replicas of popular software applications.
We’re passing our research onto Google and AnyDesk, and populating our custom threat feeds with the Gozi download URLs, related IPs and C2 servers we discovered.
Visit silentpush.com to find out more about the world’s leading early-detection platform.
Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.
Download our Community version and take advantage of the largest free library of SaaS-based threat defence tools available anywhere on the Internet.
Poorly managed public DNS infrastructure is low-hanging fruit for threat actors across the globe.
Silent Push CTO, John Jensen, gave a talk on domain takeovers and dangling DNS records at the Mandiant Worldwide Information Security Exchange (2023). In this webinar, John answers:
Malwarebytes recently published a blog post uncovering a malvertisment campaign that used domain cloaking tactics to redirect users to fake Microsoft Windows Defender support pages, that act as a front for a tech support scam.
Our Threat Analysts have conducted further research and discovered that the majority of malicious domains included in the report’s IoCs were hosted on the same four IP addresses, featuring similar network IDs:
188.114.97[.]3
188.114.97[.]2
188.114.96[.]12
188.114.96[.]2
Using Silent Push to reveal additional IoCs
Through enriched scans of the threat actor’s public DNS information, we uncovered a large amount of previously unexplored data, along with IoCs relating to the original campaign – both on the same IP ranges and hosted on separate infrastructure.
Our research uncovered numerous additional attack vectors, not limited to the original tech support scam.
We found a variety of fake support page formats, malicious executables and fake browser extensions, suggesting a far broader threat landscape than that which was included in Malwarebyte’s original report.
Let’s take a look at what we found, and how we found it.
Navigating the attackers’ domain infrastructure
To target previously undocumented IoCs, we performed a customised scan of the above IPs, which flagged olalee[.]sbs as a malicious domain:
olalee[.]sbs
olalee[.]sbs redirects to 51.159.142[.]92, providing us with an entire subnet to investigate.
Exploring the threat landscape using Silent Push Reverse A record lookups
Using Silent Push’s Reverse A lookup tool (available on our free Community app), we discovered that all TLDs on the 51.159.142[.]92 subnet containing the characters .xyz, .sbs, .click, .cfd, and .cyou hosted malicious campaigns on their associated domain names (see below example):
Reverse A lookup of 51.159.142[.]92/24 returning alasred[.]clickEvidence of malicious activity on alasred[.]click
We also discovered another group of TLDs – .ga, .gq and .tk – either currently residing on 188.114.9x.x (see above), 104.21.17.x and 172.67.176.x, or showing evidence of having used those particular groups of network IDs at some point in the past.
Legitimate hosting platforms affected
The attacker’s infrastructure isn’t limited to suspect hosting sites. We found evidence of fake tech support pages set up through well-known hosting providers such as Cloudflare (originalcenter.pages[.]dev), 000WebHost (unnourished-region.000webhostapp[.]com) and Netlify (microsoft-windows[.]netlify.app):
Malicious domain hosted via 000WebHostMalicious domain hosted via CloudflareMalicious domain hosted via Netlify
Analysing the malicious installers
As we navigated through the threat actors’ public DNS infrastructure, we encountered domains that played host to a variety of malicious activities, including fake executable installers, fake browsers and hoax Chrome extensions, with many of the scam domains being passed off as safe by security vendors (see below).
Example installer domain – mantis.edition-eltern[.]com
During our research, we came across mantis.edition-eltern[.]com, masquerading as an Asian discussion forum with branding similar to the now-defunct Yahoo Answers, which shut down in May 2021:
Malicious domain – mantis.edition-eltern[.]com
Following the ‘Windows Defender’ link, users are redirected to the below site, prompting a download of what appears to be a Windows Defender installer:
Installer redirect from mantis.edition-eltern[.]com
Once clicked, the ‘Download Now’ button redirects again to a malicious Chrome extension:
Malicious Chrome extension
Querying mantis.edition-eltern[.]com across 91 security vendors returned zero flags:
mantis.edition-eltern[.]com flagged as secure with 91 security vendors
The Chrome extension fared slightly worse, but only just, appearing in a solitary vendor’s list of malicious apps:
Malicious file passed as legitimate by 71 out of 72 security vendors
Picking apart the installer’s functions
After conducting further analysis of ChromSetup.exe, we discovered several malicious characteristics:
An invalid signer
Invalid signer
Forcefully adding itself as a Chrome extension through registry changes:
Using Powershell commands to create its own text file, in a local directory, and adding the file to ‘Powershell ExecutionPolicy Bypass’, allowing the extension to ignore a built-in safety feature that controls the conditions under which PowerShell loads configuration files and runs scripts.
The attackers haven’t limited themselves to malicious software downloads.
There’s also evidence of hoax payment portals (redirected from the above streaming site) that initiate browser-hijacking sessions, and embed adware such as static.hotjar:
Hoax payment pop-upAdware code from the above domain
Uncovering other fake support campaigns
Using enriched data harvested from our daily scans of millions of domains across the entire IPv4 range, we performed further granular searches that identified numerous other fake support pages.
These pages differ visually from the original Windows Defender campaign (or attempt to spoof another vendor entirely) but feature the same angle of attack – a hoax tech support line.
Here’s an example featuring a different language, and an EU telephone number:
French/German tech support scam
Other examples show the attackers targeting McAfee, instead of Microsoft:
McAfee fave AV scam
Silent Push custom threat feeds
We’ve passed our research on to all the affected organisations – including the legitimate hosting providers that are being used to host malicious content.
We’re currently in the process of creating a custom feed that lists all associated malicious infrastructure, that paid subscribers can integrate with their existing security stack, ensuring early detection and enabling proactive monitoring of the attack surface with data that isn’t seen in other global feeds.
Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.
To download our free Community app – the largest free library of SaaS-based threat defence tools available anywhere in the world, including some of the queries we’ve mentioned in this report – visit Silent Push Community App — Silent Push Threat Intelligence
We recently published a blog that uncovered an online retail scam involving popular brands such as Ralph Lauren, Nike, Adidas, and Prada.
As promised, our analysts have conducted further research, and we’d like to share what we’ve discovered.
Fake Ralph Lauren site
To extract money from unsuspecting users, the operation uses three distinct phishing/social engineering techniques:
Redirection to a PayPal page, with an attacker-controlled recipient email.
Catphishing users with a PayPal invoice.
Harvesting data to a local or intermediate server.
In our first blog, we described how the attackers skim payment card details and PII to a malicious server.
Let’s take a look at how the scam uses PayPal to extract money – either via direct payment or through a legitimate PayPal invoice.
Method 1 – Redirection to a PayPal payment page
After they’ve been fooled into visiting a hoax website, the user is prompted to enter personal information into a web form to create an ‘account’.
They’re then redirected to a payment page, such as the one below:
Fake Spyder Checkout Page
Once the user has entered their payment card details, the site redirects them to a PayPal login page, with the order ID and amount to be debited included as pre-configured parameters.
The minimum order amount appears to be $95-$99, with smaller orders following a different redirection path.
The attackers also don’t bother calculating an exact order amount. Once a minimum order threshold of $95-$99 is reached, any exceeding amount is ignored.
After analyzing the POST request generated by the card submission, we discovered that users are routed through another URL (belonging to ipn.suiku[.]top) before arriving at PayPal:
POST details
The URL then populates a PayPal page, with an attacker-controlled recipient email (see below for a list of associated emails) and the amount to be debited pre-loaded via a few lines of code:
PayPal redirection
Method 2 – Legitimate PayPal invoices
Instead of relying solely on payment card details, some of the sites use a legitimate PayPal invoice to extract money from unsuspecting users.
This type of technique should immediately raise concerns. Online consumer checkouts rarely – if ever – request payment via an invoice. Such methods of payment are almost exclusively reserved for B2B transactions.
This fake Reebok checkout page generates a PayPal invoice for $97, rather than asking for a direct card payment:
Fake Reebok payment sitePayPal invoice following redirection
Once users agree to pay the invoice, they’re then redirected to a PayPal login page to complete the transaction, as seen in method 1 above.
When analyzing the POST request code from a traffic capture after the checkout form has been submitted, we can see that the invoice page URL is directly embedded in the HTML:
Paypal invoice directly embedded in POST request submission
Next steps…
We’re adding a custom threat feed to the Silent Push platform that paid subscribers can use to stay one step ahead of the scam. We’ll also be passing our findings on to PayPal.
PayPal has safeguards in place that remind users of the need to be vigilant online, but as we’ve seen, this group of threat actors is casting their net far and wide with a variety of attack vectors that exploit some of the biggest names in online retail.
Visit silentpush.com for more information on how Silent Push can help to protect your infrastructure in the run-up to the holidays.
Register for the Community version to take advantage of the largest free library of SaaS-based threat defense tools available anywhere in the world.
Our Threat Analysts have uncovered a worldwide e-commerce fraud, featuring thousands of fake websites and payment portals for numerous big-name clothing and footwear brands, in the run-up to the holiday season.
Companies affected include Versace, Prada, Puma, Nike, Ted Baker, Converse, Ralph Lauren, Lacoste, Quicksilver Timberland, Vans, The North Face, La Perla, and Ugg.
A large group of threat actors are registering domain names that mimic a brand’s online presence, and tricking users into handing over Personally Identifiable Information and payment card details, through fake registration and payment forms, and hoax product pages.
The fake sites, featuring valid SSL certificates and HTTPS, all share some common denominators:
Textual errors, including spelling mistakes and branding/image anomalies.
Fake products ‘retailing’ for between $50-$300, often at huge discounts.
A focus on high-end goods from big-name online retailers.
A lack of product reviews.
Malfunctioning contact forms and social media buttons linking to standardized login pages.
The fake sites are put together using a standardized template, with some sites currently ranking on the front page of popular search engines, such as Bing, Yahoo, and DuckDuckGo.
We’ve published a list of IP ranges affected and are actively working on uncovering more Indicators of Compromise, including domain derivatives and site characteristics, as the threat landscape unfolds.
Scammers harvesting personal information and payment card details from fake websites.
Big name clothing and footwear brands affected in multiple countries.
Dangers for global consumers in the run-up to Cyber Monday and Black Friday.
Hoax websites appearing on the first page of search results.
The holiday season is nearly upon us. With Black Friday and Cyber Monday fast approaching on the 25th and 28th November, and with 60% of adults planning to start their Christmas shopping before December, the accelerated digitization of shopping habits throughout the COVID-19 pandemic has retailers crossing their fingers for an early rush to online checkouts.
Unfortunately, it’s not only big name brands that are vying for consumers’ attention.
Fake Ralph Lauren website
Silent Push Threat Analysts have uncovered an enormous fake ecommerce network – featuring high-end brands and thousands of hoax websites – that’s fooling unsuspecting shoppers into handing over personal data and payment card information in a global online shopping scam, affecting household names from around the world of retail, including:
Versace
Prada
Puma
Nike
Ted Baker
Converse
Nautica
Ralph Lauren
Lacoste
Quicksilver
Timberland
Vans
The North Face
La Perla
Ugg
The method
Capturing traffic
To redirect consumer traffic away from genuine companies, the scammers register domain names that mimic a brand’s legitimate online presence – usually by adding words to the company name, spelling words differently, or targeting a brand’s presence in a particular country.
Once the site is live, the scammers install an SSL certificate, allowing them to hide behind what appears to be a valid identity, using HTTPS and a padlock icon to build legitimacy with unsuspecting visitors:
Fake Prada websiteLegitimate Prada website
To make matters worse, the scammers have managed to get their websites listed on the front page of prominent search engines such as Bing, Yahoo and DuckDuckGo.
A search on Bing for a popular product from global fashion retailer Reiss displays a scam website (sweetpondcottage[.]com) on the front page, underneath the company’s legitimate website, and well-known outlets such as John Lewis and Millets:
To get at consumer’s payment card details, the websites present visitors with what appear to be legitimate high-end products, offered at a significant discount (usually within the $50-$200 price range) compared to their standard RRP.
An Arc’teryx Alpha Parka winter coat sells for €1,000 on the company’s official website (arcteryx[.]com). Scammers have set up a similar domain targeting Irish consumers at arcteryxireland[.]com, featuring a product page that’s relatively similar to the original:
As well as fake sign-up forms, the scam also features phony payment pages – used to harvest payment card details – that re-direct consumers to suspect third-party payment services, which in turn have the potential to obtain money directly from a user’s bank account.
Investigating the payments operation
Let’s delve a little deeper into the mechanics behind the payment fraud, and investigate how the scammers were utilising customers’ payment card details and PII.
We used a dummy card to attempt to make a purchase on several domains. When the scam sites processed our fake payment, our scans showed that data was harvested the moment it was submitted.
On one fake domain featuring the popular outdoor apparel brand Jack Wolfskin (jackwolfskinoutlet[.]com), visitors are redirected to a seperate payment URL at the checkout – atsupport[.]com/ckgkt/ckout.asp.
Malicious payment site
The portal is designed to look like a genuine online checkout that’s verified by a legitimate third-party service, but once payment details are entered, the site uploads the card number, the CVV code and all other personal details to its own server, and other malicious servers.
Malicious POST informationMalicious POST informationMalicious POST information
Once the scammers have captured the data, they’re able to use it for all manner of purposes, including resale on the dark web, or to make purchases with directly.
Common denominators
Thankfully, all is not lost. As with most scam operations, there are tell-tale signs that should set the alarm bells ringing and alert users to the fact that they’re being taken for a ride.
1. Social media buttons not linking to official sources
Fake websites always avoid linking directly to a brand’s main social feeds.
To understand how potential customers are engaging with their brand, it’s standard practice for marketing departments to analyse traffic to their social media accounts.
Scammers know this, and return links to social media login pages or lists of Tweets by a company, rather than run the risk of being detected by a traffic algorithm.
Here’s an example. Note how the fake Facebook button is coded to provide a link to the user’s Facebook login page, rather than the official Arc’teryx page:
Scam website linking to a Facebook login pageGenuine website linking to a official Facebook page
2. ‘Contact Us’ form missing or incorrect
Threat actors aren’t in the business of encouraging communication from their marks, but that doesn’t stop them adding in a link to a ‘Contact Us’ form, in order to attempt to appear legitimate to anyone casually browsing the site.
All of the websites we encountered throughout the campaign had customer contact forms that either didn’t work, or triggered no response once completed (i.e. no auto-acknowledgment emails received after a message was sent).
3. Textual anomalies
Be on the lookout for spelling mistakes, grammatical errors, and strange text formats (fonts and spacing) that, for one reason or another, just seem out of place.
This kind of scam relies on teams of threat actors creating websites from a pre-configured template that allows them to pump out the maximum amount of fake content, in the least amount of time.
This leads to similarities within the same campaign, from site-to-site, that become relatively easy to spot once you know what you’re looking for.
Several of the fake sites we investigated placed a small amount of text under the brand name, and included a small marketing message in the top banner, directly under the address bar, that looks completely out of place on the website of a big name clothing brand.
Here’s a fake Nike Ireland page advertising (in italics on their ‘homepage’) the fact that they offer a ‘30-day money back guarantee’, between two dollar sign characters.
You’ll notice that the menu font for ‘Men’ and ‘Women’ is also not branded, and looks equally out of place:
Fake Nike homepage, with templated text
The message box stays in the same place throughout all the fake website – sticking to the template – but usually displays different text, depending on what page the user is on.
Here’s the same domain displaying a different message, on a different page, this time adapting the text to the main body content – promoting ‘Fast Delivery’ between two aeroplane icons (replacing the dollar signs from the homepage) on a pair of suspiciously cheap Nike trainers:
4. Suspect product pricing
It would appear that the architects of the scam have decided that offering goods for the same price range across all the fake websites – whatever brand they’re from, and whatever type of product they are – is the best way to grab a user’s attention.
Most of the fake online stores that we encountered advertised goods for ‘sale’ usually between $70 and $300, with items marked down at a huge discount, and an RRP displayed prominently alongside the ‘actual’ price.
Here’s a set of Ugg boots (that retails for £145 on the official website) being sold for £65 on a scam site, and an entire range of Timberland clothing advertised at around £40 a piece.
The scammers are swinging for the fences and focusing their efforts on big-name brands that sell high quality goods, allowing them to leverage their strategy of applying huge discounts on well-known product lines that are advertised twice, three times or quadruple the price anywhere else they’re available.
If it looks to good to be true, it almost always is.
Fake ecommerce operations rarely waste their time on low-end products that generate tiny amounts of revenue.
This particular campaign is intent on capturing the attention of consumers with a level of disposable income that allows them to shop at expensive outlets such as Versace, Prada and Ralph Lauren.
6. No product reviews
Product reviews – or a lack thereof – are always a dead giveaway.
We’ve already discovered thousands of websites spread across potentially hundreds of brand names, and that’s just the tip of the iceberg. Setting up this kind of campaign is a numbers game, and threat actors simply don’t have the time to create fake product reviews for every item they feature on their websites.
Unlike legitimate shopping portals, barely any of the products we encountered had an accompanying review section, and if they did, the link was broken.
Here’s the product page for the Arc’teryx jacket we analysed earlier on. The real website encourages you to read user reviews. The fake website doesn’t:
Legitimate user review linkFake website with no reviews
Extent of the campaign
Given that the operation relies on templated websites that can be quickly populated with images, text and links without a great deal of effort, there are currently thousands of IP addresses and domain names active within the campaign, affecting prominent brands across the world.
Our Threat Analysts are working on producing a custom feed that’ll proactively track activity on the Silent Push platform across all the various iterations of domain names and IP addresses.
We discovered Chinese characters in some malicious code on several prominent scam sites, and numerous domains we encountered were registered in China, but without definitive evidence across the majority of IoCs in the campaign, we need to keep an open mind as to where the scam originated:
Chinese characters in malicious website codeMalicious domain registered in China
We’re currently conducting further research into the operation that delves into the technical specifics, and sheds even more light on how threat actors are deploying domains and websites, what to look out for and, potentially, who’s behind it.
We’ll be publishing a deep dive over the next week or so. Follow us on LinkedIn and Twitter, and keep an eye out for more blogs.
Silent Push is an industry-leading extended threat intelligence solution that generates game-changing insights, and identifies new threats to your organization before they launch.
We scan the Internet’s entire IPv4 range every day, and alert you to new threats and rogue assets before they emerge, providing you with the most comprehensive view of Internet activity available anywhere in the world.
Silent Push Community App
The Silent Push Community App allows you to deploy a vast array of powerful domain/IP queries, record lookups and anti-exploit tools free of charge.
Give your teams full access to the Explore and Query Buildersections of the Silent Push App – including access to the Silent Push API – with zero subscription costs.
Silent Push for Enterprise
Silent Push for Enterprise enriches your security stack, providing industry-leading intelligence that you can use to proactively hunt and identify threats to your organization way in advance of your competitors.
Take our product tour and discover how Silent Push will transform the way your organization protects its corporate assets, and analyzes risk.
Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.
Our Threat Intelligence Team was on the lookout for PayPal typosquatting domains, when one particular domain (paypalsec[.]us) led them to a far larger discovery – an entire network of threat activity, masquerading as numerous global brand names and infecting machines with a malicious file disguised as a remote monitoring tool – WinDesk.Client.exe.
The initial discovery
We found the domain (registered through NameSilo on 2022-08-18) using the Silent Push Live Unsanctioned Assets query – an A record search by qanswer, netmask and various other network parameters.
The domain had some text and images that mimicked Paypal’s actual website, but most of the content populated as unrelated placeholders, which suggested that the site had been built using a multi-purpose template, rather than coded from scratch.
Fake websitePayPal’s actual website
Threat actors aren’t in the business of coding individual websites for hundreds of malicious domains, and sometimes rely on communal site builders to put together phishing websites that target different brands.
The ‘Cancel Now’ button on this particular domain prompted a download of an executable file – WinDesk.Client.exe – that we offer further analysis of below.
The delivery method
Once we’d confirmed the identity of the domain, we analyzed WHOIS, IP and PADNS data in an attempt to find out what other activity it was linked to, leading us to another domain connected to the same Paypal phishing website – help01[.]us (also registered through NameSilo on 2022-08-18).
We repeated the process for the IP address associated with help01[.]us, and discovered 30 other domains connected to similar phishing websites, impersonating big name brands such as Amazon, Microsoft, Geek Squad, and Paypal, using the same basic phishing techniques with some subtle differences (see IoC list at the bottom of this article).
Instead of a ‘Cancel Now’ button, these websites featured an ‘Enter Code’ field.
After a few attempts, we entered a code that was accepted as valid, which started the download of WinDesk.Client.exe.
Fake Amazon pageFake GeekSquad page
Analysing the trojan
WinDeskClient.Exe actively tries to stop itself from being run in a sandbox environment, using a combination of debugging restrictions and sleep timers, but our Threat Analysts were able to run it in a test environment in order to ascertain what the file actually does, and more importantly, where it sends information to.
Once run, WinDesk.Client.exe facilitates the install of a parent process – dfsvc.exe – with two further executables initiated from the level above:
> dfsvc.exe
> ScreenConnect.WindowsClient.exe
> screenconnect.clientservice.exe
In its legitimate guise, ScreenConnect.WindowsClient.exe is an executable file which belongs to the ScreenConnect platform (now known as ConnectWise Control), a widely-used remote access tool for customers of ConnectWise.
Process tree (Credit – app.any.run)
ScreenConnect.WindowsClient.exe does have the potential to record keystrokes, but its the final drop – screenconnect.clientservice.exe – that reveals the most information.
The service attemps to establish a connection with 104.168.5[.]29, which resolves to firsto[.]cc.
We weren’t able to ascertain precisely what data the client process is attempting to send, but the security implications are clear and obvious.
Links to Norton and GeekSupport scams
A passive DNS replication check shows that the server is linked to to another IP – 198.23.212[.]167 – which is connected to phishing sites that are actively impersonating brands such as Norton and GeekSupport:
firsto[.]top
firsto[.]cc
mslxt[.]xyz
ncareback[.]xyz
backup02[.]xyz
gkscare[.]com
geeksupportcare[.]com
xpchelps[.]us
support2norton[.]us
xpchelp[.]us
Network communication from screenconnect.clientservice.exe
The attack vector likely originates via email, with threat actors gaining the trust of users before fooling them into entering a code (usually via a telephone conversation) that prompts the download.
A few weeks ago, GeekSquad customers fell victim to a scam featuring a fake website, that asked them to contact a phone number to cancel a fake subscription. Norton customers experienced the same basic scam in June,
It’s safe to assume that the version of WinDeskClient.Exe we analysed, and where it’s attempting to send information to, was an integral part of both scams.
Further investigation uncovered over 350 domains hosted among 42 IP addresses over the last month, impersonating not just Norton and GeekSquad, but big names such as Amazon and MacAfee (see IoC list at the bottom of this article).
The majority of these domains had three things in common:
They were all registered on NameSilo;
The used *.dnsowl.com nameservers;
The were hosted on low-density IP addresses on AS-COLOCROSSING(30823)
Thankfully, this particular group of threat actors spent too much time playing fast and loose with legitimate websites, and failed to secure their own internal infrastructure, leading us to some interesting discoveries.
The front end operation
We’ve already blogged about open directories – they’re the ultimate quick win for anyone looking to secure entry into restricted file systems, without having to worry about phishing, social engineering or payloads.
Using the Silent Push Open Directory search, we quickly discovered an open index on 192.227.173.35, that contained a single compressed file – desk.zip.
The file contained a directory of website assets, including images, components, and, crucially, a database with username and password tables for accessing the control panel of the phishing page builder used to construct the malicious websites we’d already uncovered.
Phishing website builderPhishing website builder
Unfortunately, we didn’t uncover anything further on the front end of the control panels, besides different variations of the phishing website and the domains used to download the malware (which we’d already uncovered), but nonetheless, it was an interesting insight into how threat actors put together their operation, and provided us with a significant amount of intel to pass on to our customers.
Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.
Indicators of Compromise
This list will not be updated after the initial blog post. For live tracking of malicious infrastructure subscribe to our enterprise service. Sign up for a trial.
