Scams & Phishing News Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing

[Practical Response]

Content source

https://thehackernews.com/2024/04/attackers-using-obfuscation-tools-to.html

Cybersecurity researchers have discovered an intricate multi-stage attack that leverages invoice-themed phishing decoys to deliver a wide range of malware such as Venom RAT, Remcos RAT, XWorm, NanoCore RAT, and a stealer that targets crypto wallets.

The email messages come with Scalable Vector Graphics (SVG) file attachments that, when clicked, activate the infection sequence, Fortinet FortiGuard Labs said in a technical report.

The modus operandi is notable for the use of the BatCloak malware obfuscation engine and ScrubCrypt to deliver the malware in the form of obfuscated batch scripts.

Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing

Cybersecurity experts uncover a sophisticated multi-stage attack! 🛡️ Malware including Venom RAT, Remcos RAT, and more deployed via invoice-themed ph

thehackernews.com

 

[Trident]

The article seems to be very vague on details and presents the attack as one-click exploit.

However Symantec describes something different.
It seems like users would be presented with a download prompt and instructions how to proceed. They then need to unpack the archive and perform the initial execution.

March 04, 2024
Copy Link
A recent Guloader malspam campaign has been found to be smuggling malicious ZIPs inside of attached SVG files. These SVGs contain JavaScript code that, upon opening the file, generates a malicious ZIP that proceeds automatically display a download prompt. The ZIP file contains a WSF file which downloads the final infection payload.
Example Email Subjects:

• INVOICE-INVOICE#RVBSA09SGSA
• Payment Confirmation
• Solicitud de Cotización #PO-SJ005182824013710
• Please confirm Payment

Symantec protects you from this threat, identified by the following:
Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• ISB.IcedID!gen2
• Scr.Guloader!gen3
• Scr.Malcode!gen
• VBS.Downloader.Trojan

Guloader caught smuggling malicious ZIPs inside SVG images

Guloader smuggling malicious ZIPs inside of SVG

www.broadcom.com

Additional resources:

https://www.mandiant.com/resources/blog/tracking-apt29-phishing-campaigns

SVG Files Abused in Emerging Campaigns

By Max Gannon Scalable Vector Graphic files, or SVG files, are image files that have become an advanced tactic for malware delivery that has greatly evolved over time. The use of SVG files to deliver malware was made even easier when the tool AutoSmuggle, a program used to deliver malicious...

securityboulevard.com

 

[Practical Response]

Scare tactic/social engineering/good habits.

 

[oldschool]

Scare tactic/social engineering/good habits.

And clickbait!

 

[Practical Response]

And clickbait!

This is the best kind of clickbait because it doubles as a "learn from this" platform. It looks scary, designed even to be, but in reality, a simple "awareness" renders this most likely ineffective. If you combine "verifying" to that, most likely becomes almost non existent.

 

[wat0114]

However Symantec describes something different.
It seems like users would be presented with a download prompt and instructions how to proceed. They then need to unpack the archive and perform the initial execution.

Well this threat must be fooling enough dummies into following all the necessary steps for infection, otherwise it wouldn't be in circulation. And from Symantec's vantage point, they are using this to promote their own product:

Symantec protects you from this threat, identified by the following:
Email-based

• Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

File-based

• ISB.IcedID!gen2
• Scr.Guloader!gen3
• Scr.Malcode!gen
• VBS.Downloader.Trojan

 

[Trident]

Well this threat must be fooling enough dummies into following all the necessary steps for infection, otherwise it wouldn't be in circulation. And from Symantec's vantage point, they are using this to promote their own product:

The article is not in their blog but in their coversge bulletin. There they explain briefly how new threats are covered. It’s normal to contain this info.

 

[wat0114]

It’s normal to contain this info.

Oh of course

 

[Practical Response]

Oh of course

Those "dummies" as you put it are actually better referred to as the "unaware" as they are not dumb just uninformed.

As for Norton placing that in a blog, it's reassurance for their customers and not nothing any company would not do.