Multiple Malware Campaigns Spotted Leveraging Pastebin-Like Services

guest · Oct 11, 2020

Malware Families Turn to Legit Pastebin-Like Service
AgentTesla, LimeRAT, W3Cryptolocker and Redline Stealer are now using Paste.nrecom in spear-phishing attacks
October 5, 2020
https://threatpost.com/malware-pastebin-like-service/159838/

Cybercriminals are increasingly turning to a legitimate, Pastebin-like web service for downloading malware — such as AgentTesla and LimeRAT — in spear-phishing attacks.

Pastebin, a code-hosting service that enables users to share plain text through public posts called “pastes,” currently has 17 million unique monthly users and is popular among cybercriminals (such as the FIN5 APT group and Rocke threat group) for hosting their payloads or command-and-control (C2) infrastructure. But now, more malware and ransomware families are starting to utilize another service, with the domain Paste.nrecom[.]net.

This service been around since May 2014, and has a similar function as Pastebin.
Click to expand...

“Although using legitimate web services is not novel, this is the first time that we have seen threat actors use paste.nrecom[.]net,” said Paul Kimayong, researcher with Juniper Networks, in a Monday analysis. “Among the malware we have identified are AgentTesla, LimeRAT, [W3Cryptolocker] Ransomware and Redline Stealer.”

“We have also seen malware hosting their configuration data in the same service,” said researchers.
Click to expand...

Looking ahead, researchers warned that more malware families will turn to legitimate web services to host their malicious infrastructure.

“Using legitimate web-services like pastebin or paste.nrecom for malware infrastructure gives cybercriminals an advantage, as these services cannot be easily taken down due to their legitimate use,” said researchers.
Click to expand...

Juniper Networks: New pastebin-like service used in multiple malware campaigns

How do threat actors use it for malicious purposes?
Because it is a text-only service, one would think that it cannot host an executable file (binary data) into it. However, binary data can be represented as a text file by simply encoding it. The common encoding method is using base64. That is exactly what the threat actors did in this case.
Conclusion
Using legitimate web-services like pastebin or paste.nrecom for malware infrastructure gives cybercriminals an advantage, as these services cannot be easily taken down due to their legitimate use. We recommend Security Operations to add paste.nrecom to potentially web services being abused for malicious purposes. It is recommended to monitor web-services like this one for suspicious content particularly binary data encoded in base64.
Click to expand...

Log in or Sign up

Multiple Malware Campaigns Spotted Leveraging Pastebin-Like Services

guest Guest

Log in or Sign up

Multiple Malware Campaigns Spotted Leveraging Pastebin-Like Services

guest Guest

Useful Searches