Adwind RAT Squeaks Past Linux, Windows, macOS Defenses

The Adwind 3.0 remote access Trojan (RAT) is part of a new campaign where its developers have reconfigured the malware to allow it to gain traction within Linux, Microsoft Windows and Apple macOS systems, according to a new report.

Security researchers at Cisco Talos, along with additional observations made by ReversingLabs, saw a spam campaign that centered on Turkey. Even though ReversingLabs first discovered the campaign in early September, Talos researchers were able to trace the trail of it before then.

The Talos researchers found that the campaign first began on August 26 and peaked two days later.

(Source: Flickr)

Their research showed that 75% of the requests were made from Turkey. Since the poisoned forged Microsoft Office documents that the attackers are using are in Turkish as well, this fits in well with the overall pattern of the attackers.

Researchers also found that some of the targets lived in Germany. This also fits in the overall pattern when you consider there is a significant Turkish community in Germany, which could be subject to exploitation and attack.

The poisoned attachment purports to be in Turkish. Depending on which dropper is used by the attackers, the Office document can use either the .csv or .xlt extensions for its hidden malicious payload. Both of these will be opened by Excel.

In its report, Talos notes that "Both versions were leveraging a new variant to the DDE code injection attack. Although this method is well-known, this variant is undetected at the time of this writing."

So, not novel but your antivirus software doesn't know about it. Good enough for the attachment to slip in.

All is not lost, however. Excel has some built-in defenses.

It detects that the opened file is not a real XLT document. It does think that the file is probably corrupted. Not only that, it will ask the user if they are sure they want to open it. Like, seriously dude?

And then, there is a second warning which notifies the user that the document will execute the application that is stuffed in there.

The user might pick up on these clues to not open the purported document.

However, if they ignore all three warnings that have been displayed and continue onwards, a Java code archive will be downloaded. The VBScript uses "bitasdmin," which is a tool provided by Microsoft to download or upload jobs, to actually grab the payload file.

The final payload is a multi-platform RAT with several configurations possible. The samples that they tested were configured to achieve persistence on Windows, Linux and Mac OS X. Each platform has its own persistence name in the RAT, so individual control is possible.

So, why should we even care about this? To put it simply, it worked.

The attack snuck under the signature-based AV tools, and installed a functional RAT. The victim got owned, even when Excel complained.

This can happen in other languages besides Turkish.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.