Buhtrap backdoor and ransomware distributed via major advertising platform

guest · Apr 30, 2019

Buhtrap backdoor and ransomware distributed via major advertising platform
April 30, 2019
https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/

[...] a group using two well-known backdoors — Buhtrap and RTM — as well as ransomware and cryptocurrency stealers, has targeted organizations, mainly in Russia.
The targeting was made possible by posting malicious ads through Yandex.Direct, in an attempt to redirect a potential target to a website offering malicious downloads disguised as document templates.
Code-signing certificates
Multiple code-signing certificates were used to sign malware distributed during this campaign.

The component that first attracted our attention is the previously unseen Win32/Filecoder.Buhtrap. It is a Delphi binary that sometimes comes packed. [...] It implements the expected behavior of ransomware, discovering local drives and network shares and encrypting files found on these devices. It doesn’t require an internet connection to encrypt its victims’ files [...]
Conclusion
This campaign is a good example of how legitimate ad services can be abused to distribute malware.
Click to expand...

Log in or Sign up

Buhtrap backdoor and ransomware distributed via major advertising platform

guest Guest

Log in or Sign up

Buhtrap backdoor and ransomware distributed via major advertising platform

guest Guest

Useful Searches