Fake Browser Updates Push Ransomware and Bank Malware

guest · Mar 1, 2019

Fake Browser Updates Push Ransomware and Bank Malware
February 28, 2019
https://blog.sucuri.net/2019/02/fake-browser-updates-push-ransomware-and-bank-malware.html

Users see a message box that says it’s an “Update Center” for your browser type (in my case it’s Firefox, but they also have such messages for Chrome, Internet Explorer and Edge browsers).

The message reads: “A critical error has occurred due to the outdated version of the browser. Update your browser as soon as possible.” To support the “critical error” claim, the malware shows some garbled text on the background.
The payload is usually well detected by many antiviruses.

Hackers inject either links to an external script or inject the whole script code into the hacked web pages.
Android Version
The most recent version of the fake browser malware also received a payload for Android devices
Click to expand...

Conclusion
This campaign shows how bad actors use compromised websites on various stages of the attacks–from injecting scripts into legitimate web pages to hosting malicious binary downloads.

While the first type of infection can be detected by external scanners, the second one (malicious downloads) can’t be easily detected without access to the server. Blacklists of various antiviruses can be helpful in such cases – client-side antivirus software sees where the malicious downloads originate from.
Click to expand...

guest · Oct 2, 2019

Fake Browser Updates Infect Enterprises with Ransomware, Bankers
October 2, 2019
https://www.bleepingcomputer.com/ne...s-infect-enterprises-with-ransomware-bankers/

Attackers are utilizing hacked web sites that promote fake browser updates to infect targets with banking trojans. In some cases, post exploitation toolkits are later executed to encrypt the compromised network with ransomware.
Between May and September 2019, FireEye has conducted multiple incident response cases where enterprise customers were infected with malware through fake browser updates.

When the downloaded file is executed, a malicious script would be launched that gathers information about the computer and sends it back to the attacker's command and control server.
The server would then respond with an another script that would be executed on the victim's machine to download and install malware. The researchers at FireEye state that they observed malware such as Dridex, NetSupport Manager, AZORult, or Chthonic being installed on the victim's machines.

Using PowerShell Empire, Koadic, mimikatz, and other tools, the attackers would gather credentials and perform lateral movement within the organization's network. In addition, FireEye found that in some cases from September 2019, the attackers used the PoshC2 framework instead of the other frameworks.
Click to expand...

FireEye: Head Fake: Tackling Disruptive Ransomware Attacks

Log in or Sign up

Fake Browser Updates Push Ransomware and Bank Malware

guest Guest

guest Guest

Log in or Sign up

Fake Browser Updates Push Ransomware and Bank Malware

guest Guest

guest Guest

Useful Searches