Microsoft Spots Nodersok Malware Campaign That Zombifies PCs

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/microsoft-spots-nodersok-malware-campaign-that-zombifies-pcs/

A new fileless malicious campaign, dubbed Nodersok by Microsoft Defender ATP Research Team researchers who discovered it, drops its own LOLBins to infect Windows computers with a Node.js-based malware that will turn the devices into proxies.

Unlike other fileless malware attacks that only use living-off-the-land binaries (LOLBins) present on the devices they compromise, the attackers behind Nodersok have been observed while also delivering the legitimate Node.exe Node.js framework and the Windows Packet Divert (WinDivert) network packet capture tool to devices they target.

The campaign attacked thousands of machines within several weeks, with a focus on home users from U.S. and Europe, with roughly 3% of all attacks also targeting organization from industry sectors such as education, business and professional services, healthcare, finance, and retail.

Microsoft Spots Nodersok Malware Campaign That Zombifies PCs

A new fileless malicious campaign, dubbed Nodersok by Microsoft Defender ATP Research Team researchers who discovered it, drops its own LOLBins to infect Windows computers with a Node.js-based malware that will turn the devices into proxies.

www.bleepingcomputer.com

Bring your own LOLBin: Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware | Microsoft Security Blog

A new fileless malware campaign we dubbed Nodersok delivers two very unusual LOLBins to turn infected machines into zombie proxies.

www.microsoft.com

 

[Andy Ful]

The infection chain:

Easily prevented by known on MT hardening tools. Hardly detected as 0-day by AVs due to multistage infection chain with several non-malicious files (mshta.exe, powershell.exe and downloaded legal tools node.exe, Windivert.dll/sys).

 

[notabot]

The infection chain:

View attachment 225860

Easily prevented by known on MT hardening tools. Hardly detected as 0-day by AVs due to multistage infection chain with several non-malicious files (mshta.exe, powershell.exe and downloaded legal tools node.exe, Windivert.dll/sys).

probably missed by WD's behavioural blocker though and 3. probably missed by AMSI, else the attackers wouldn't worry about disabling Defdender at stage 4.

 

[Andy Ful]

probably missed by WD's behavioural blocker though and 3. probably missed by AMSI, else the attackers wouldn't worry about disabling Defdender at stage 4.

Not in the opinion of Microsoft: Bring your own LOLBin: Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware - Microsoft Security

 

[notabot]

Not in the opinion of Microsoft: Bring your own LOLBin: Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware - Microsoft Security

View attachment 225861

If Defender was on and AMSI caught it at step 3, why have a step 4 to disable it

Their statement is "We have known this for quite a while, that’s why we have invested a good deal of resources into developing powerful dynamic detection engines and delivering a state-of-the-art defense-in-depth through Microsoft Defender ATP "

so before it was known malware and they invested a good deal of resources, when it was fairly new, the fact that the attacker only needed to disable at step 4 implies steps 1-3 ( and step 4 ofc ) had a free ride

 

[Andy Ful]

If Defender was on and AMSI caught it at step 3, why have a step 4 to disable it

Their statement is "We have known this for quite a while, that’s why we have invested a good deal of resources into developing powerful dynamic detection engines and delivering a state-of-the-art defense-in-depth through Microsoft Defender ATP "

so before it was known malware and they invested a good deal of resources, when it was fairly new, the fact that the attacker only needed to disable at step 4 implies steps 1-3 ( and step 4 ofc ) had a free ride

You can read this as if the malware was delivered by skipping the previous stages of infection.
The first scripts are only to misguide AVs. The infection can start for example directly from PowerShell commands embedded in Office document via VBA macro.
Of course, anything can be bypassed, but assuming it by default is not justified.

Edit.
I think that the infection chain and several malware file classifications are based on data from Machine Learning models when the malware was detonated in the sandbox.

 

[oldschool]

Not in the opinion of Microsoft: Bring your own LOLBin: Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware - Microsoft Security

And M$ technical writers can appear very convincing when so inspired. It's too bad they don't offer such clear articles on consumer versions of Windows Defender. Instead, we rely on those like yourself to dig through all the available info scattered over the web and make some sense of it. Thanks as always @Andy Ful.

 

[[correlate]]

Microsoft: New Nodersok malware has infected thousands of PCs

New Nodersok malware installs Node.js to turn systems into proxies, perform click-fraud.

www.zdnet.com

 

[silversurfer]

Divergent: "Fileless" NodeJS Malware Burrows Deep Within the Host

Update (09/27/2019): Additional information regarding the malware interaction with various online advertisements has been included to highlight the click-fraud related network communications associated with Divergent. Executive summary Cisco Talos recently discovered a new malware loader...

blog.talosintelligence.com