RIG Exploit Kit Takedown Sheds Light on Domain Shadowing

A coordinated effort to disrupt activities related to the RIG Exploit Kit has once again revealed how extensively threat actors abuse legitimate domains and websites to build the operational infrastructure for their criminal campaigns.

Researchers from RSA Security, domain registrar GoDaddy, and several other organizations worked together to recently take down over 40,000 active shadow domain resources that were being used as infrastructure for the RIG EK.

The campaign has resulted in a complete cessation of activity related to EITEST and PseudoDarkleech, two major RIG EK campaigns for distributing banking Trojans, ransomware, and other malware, says Alex Cox, director of RSA Research. "But it remains to be seen how that will affect the RIG ecosystem as a whole," he says.

Domain shadowing refers to the tactic by threat actors to create malicious subdomains behind a legitimate domain using credentials stolen from the domain registrant. Organizations often do not notice the activity because domain registrant accounts are rarely used or checked once the initial domain registration is completed. Criminals employ the technique to hide malware-laden pages and exploit kits behind legitimate domains, making it hard for defenders to spot and eradicate them.

"Domain shadowing is extremely effective because it allows malicious subdomains to leverage the good reputation of the parent domain, and thus bypass reputation based filters," says Shimon Modi, director of product at security intelligence sharing company TruStar Technology.

In the case of the RIG Exploit Kit, the threat actors used the shadow domains they created to host RIG landing pages. Most victims were directed to the landing pages from previously compromised websites injected with iframes. The landing pages were designed to inspect and exploit incoming client systems and to install a diverse set of malicious payloads on them.

The more than 40,000 RIG EK-related subdomains that RSA and the others succeeded in shutting down affected over 800 legitimate domains, many of them registered with GoDaddy. Most of the subdomains were being served out of near bulletproof hosting providers based in Eastern Europe. The hosting providers often had enough legitimate traffic not to be obvious candidates for blacklisting.

"A common way for defenders to attack these systems is to provide proof of malicious activities to the hosting providers, so they will suspend the systems," Cox says. Criminals understand that and deliberately seek out hosting providers that are willing to go along with or are negligent about the activity. "They’ll re-use these hosts until the defenders pinpoint them and then they’ll move onto others," Cox says.

An inspection of the DNS records associated with each of the shadow domains in the RIG Exploit Kit infrastructure showed that most of them were up for barely five to 10 days before being deleted. The duration for which they were actually used was likely closer to 24 and 48 hours according to RSA. Threat actors often rapidly rotate shadow domain to make it even harder for defender to get them.

There is little that was common among the compromised domains and most of them were likely just victims of opportunistic phishing and malware campaigns to steal login credentials to domain registrant accounts, Cox says.

The domain shadowing issue is a challenging problem to solve with 100% effectiveness, Modi says. "But a mix of block [and] tackle techniques and anomaly detection can help in detecting and preventing domain abuse," he says.

In order to ensure their domains are not being abused, organizations should make sure to monitor for unusual numbers of changes to DNS records, block bad IP address from their ISPs DNS systems and check for subdomains that have unusual alphanumeric character patterns, Modi says.

"Monitor organizational DNS records looking for unauthorized changes or additions on a regular, and preferably automated basis," adds Cox.  

Related content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.