Abusing cloud providers including Microsoft Azure and AWS, cybercriminals are setting up malicious infrastructure to hide their operations and avoid detection.
There are two parts to this story about a new cyberattack spotted in the wild by Cisco Talos – first, cybercriminals are leveraging the fast deployment of infrastructure within both Microsoft’s and Amazon’s cloud environment. And second, the attacks don’t just leverage one remote access trojan (RAT) as the payload, but three different RATs.
The use of public cloud infrastructure is smart – it makes it difficult for security solutions to easily identify attacks immediately as being malicious. The hosting mixed with complex obfuscation techniques in the downloader scripts – which have been seen executed as JavaScript, batch file, or VBScript – make it increasingly difficult.
The use of multiple RATs – Nanocore, Netwire, and AsyncRAT, to be specific – signifies the cybercriminals are privy to understanding that they need to use the right tool for the job at hand. Nanocore is a small 32-bit .NET portable executable. Netwire is a data-stealing trojan, and AsyncRAT is focused on remotely monitoring and controlling computers.
This level of advanced execution demonstrates how cybercriminals are really thinking their attacks through, carefully considering how they might be detected, and taking great strides to avoid detection while delivering just the right payload to accomplish the remainder of their malicious actions.
According to Talos, the attacks all start with a simple phishing campaign using a malicious ZIP file as the attachment.
Source: Talos
That’s good news. Any employee that has undergone Security Awareness Training will easily identify that an HTML attachment isn’t going to be used as an invoice – ever. It’s these small indicators of malice that users who undergo training begin to store away and use continually as they interact with email and the web – all to spot a suspicious or malicious attack and stop it by not engaging, before any harm can be done.
Here's how it works:
