Underestimate “commodity” malware at your peril Not everybody gets hit with a zero-day vulnerability by a nation-state-sponsored Advanced Persistent Threat (APT). Most attacks involve run-of-the-mill malware delivered by conventional means – which typically involve a spam email, a benign-looking attachment or link, and a lot of encouragement for the target to open that attachment. Sophos receives thousands of telemetry hits per month about such common malware, usually an indication that a computer protected by one of our products has blocked the attack. In unprotected computers, where the malware can fully execute, it will profile the target’s computer; extract any login credentials or saved passwords for websites that control something of value (usually, but not limited to, bank or financial services accounts); then send that information back to its operators and await further instructions, which may arrive in a few seconds...or several days later. But don’t let the fact that these malware families are merely ordinary lull you into a false sense of security. These malicious workhorses can cause huge problems if allowed to persist. As mentioned earlier in our report, the SophosLabs team maintains a “Most Wanted” malware list, with analysts dedicated to those families that remain stubbornly persistent. We’ve put together a short summary of some of them below. Dridex and Zloader One of the most common malware types is the loader. Loaders have features centered around delivering another malware payload on behalf of their operators or people who contract with their operators. The Dridex and Zloader malware families are both mature, established loader platforms. Attackers use both Dridex and Zloader to collect information about the target system and send it back to the criminals, who can decide at their leisure what components or payloads they will deliver, based on the information the bot sends back. The Dridex loader’s core function is to contact its command-and-control (C2) server, retrieve one or more encrypted payloads, and deploy them. It’s very hard for analysts to get those payloads because the threat actors only distribute them on an as-needed basis, such as a hidden VNC (a remote-control application), or a SOCKS proxy. These payloads give attackers the ability to do things in the context of the user’s device. They also allow the criminals to access resources on the victim system that are not directly reachable from their own system. The server-side logic that determines what happens during an infection can be inscrutable, but we can infer some rules because the bots don’t want to infect computers used by malware analysts. The bot sends its operators a list of installed programs; if there are analysis tools, or components of virtual machines, the bots don’t deliver payloads to that machine. In Zloader’s case, the bot’s operators spread the malware via a spam message; if you take too long to infect your computer, within eight to 12 hours after the spam goes out, they stop sending payloads. It also must be a really clean machine, but it can’t be too clean, either. A plain-vanilla Windows installation won’t trigger, but neither will a very full machine with a lot of tools.
Remote Access Trojans, or RATs, and infostealers are among the oldest forms of malware. As the name suggests, RATs offer the attacker the ability to control the infected computer remotely. Infostealers also hew close to their name, engaging in theft and exfiltration of credentials, certificates, and other sensitive information. Two of the “Most Wanted” families we’ve dealt with over the past year are Agent Tesla (an infostealer) and RATicate (a RAT). Like loaders, RATs also usually have a mechanism by which they can deliver additional payloads, including updated versions of themselves. We’ve observed RATicate distributing other malware – including Agent Tesla. We’ve also seen these RAT families being served up from, or communicating with, the same IP addresses or servers, which hints at something shared between otherwise unrelated groups. Trickbot’s takedown Trickbot has been a persistent nuisance malware for at least four years. The infamous botnet pioneered a lot of what are now common behaviors and characteristics: for instance, it communicated with its C2 infrastructure using TLS. The bot is implicated in several high-profile ransomware attacks and is a competent credential thief in its own right.
In October 2020, as we prepared this report, Microsoft and the US Department of Justice announced that they had seized several servers and sent a command via the botnet’s command and control system that caused some 90% of the botnet to stop communicating with the command-and-control infrastructure.
Investigators managed to upload a “poisoned” configuration into Trickbot’s infrastructure that each bot downloaded. The configuration tricked the botnet into believing that its principal command-and-control server was the infected machine it was running on. The botnet then lost contact with the actual C2 servers and could no longer retrieve payloads or instructions. The effort had a drastic impact on Trickbot’s operator, but they’re expected to slowly, eventually, return to normal operation
Access to Innovation
Access to Capital
Access to Talent
Access to Market
Access to Knowledge
