Necurs Botnet Goes Phishing for Banks

The Necurs botnet has resurfaced in a new phishing campaign targeting banks with malicious Microsoft Publisher and PDF files packed with the FlawedAmmyy remote-access Trojan.

Cofense researchers first detected the campaign early on August 15 and have confirmed 3,071 banking domains have been hit so far. Recipients range from small regional banks to some of the world's largest financial institutions.

Necurs, a rootkit first discovered in 2012, became famous in 2016 when it was spotted delivering large volumes of Dridex and Locky ransomware. Now it's resurfacing with new tactics as threat actors experiment with different strategies to see which are most effective.

"As far as this particular campaign, it is a change from what Necurs has been doing," says Jason Meurer, senior research engineer at Cofense. He compared the attack with a marketing campaign, noting that "it felt like there was a little bit of A/B testing going on here."

This campaign differed from Necurs' usual strategy in several ways. For starters, it wasn't your traditional spam — this was a phishing campaign specifically geared toward the banking industry, using malicious attachments to deliver a payload designed to enable remote access. It also leveraged Microsoft Publisher files, a shift from typical Word and Excel documents. A small subset of this campaign used PDF files, which shows the attackers are trying different tactics.

"It's extremely rare" to see Publisher files in phishing attacks, says Cofense co-founder and CTO Aaron Higbee. While this type of file has been used in the past — after all, most employees are required to install Publisher as part of Office 365 — it's not commonly seen in cybercrime.

Digging into the Details
Emails in this campaign are "fairly basic," researchers report, with subject lines including "Request BOI" and "Payment Advice" with a random alphanumeric code tacked on the end. Higbee points out the phishing email was forged to appear as though it came from an employee at an Indian bank. A different Indian bank, Cosmos, recently lost $13.5 million in a cyberattack when hackers broke into its ATM server and stole customer information.

This campaign could potentially indicate a future ATM attack, says Higbee, and network access may be part of the actors' motivation. The malicious .pub documents attached to phishing emails have embedded macros that, when executed, prompt a download from a remote host, explain Cofense's Jason Meurer and Darrel Rendell in a blog post on the campaign.

The final payload is FlawedAmmyy, which is malware based on leaked source code for Ammyy Admin. It gives an attacker with full remote control of a compromised host, which can lead to file and credential theft and enable lateral movement within target organizations.

FlawedAmmyy had gone undocumented until early 2018, when Proofpoint research indicated the Trojan had been used in attacks as far back as January 2016 and as recently as March 2018. At that time, attackers began to use a new distribution method of combining ZIP files with the Server Message Block protocol to deliver FlawedAmmyy onto target systems.

The March campaign dropping FlawedAmmyy appeared to be the work of TA505, the same threat group associated with the Dridex, Locky, and GlobeImposter campaigns. While Cofense has not yet determined the motivation behind the latest Necurs campaign, Higbee says people who have been studying Necurs have linked the botnet to organized crime.

What's Next for Necurs
Now that the campaign has come to a halt, Meurer anticipates the attackers are probably taking a look at their command-and-control infrastructure to gauge the effectiveness of their strategy. Did .pub files work, for example, or were PDF files more effective?

If there was little to no engagement, "they'll go back to the drawing board and look for another file format they can use to deliver the next wave," he says. "If we see Necurs do another phishing campaign using .pub files, it's an indication people behind it were satisfied with the results."

It's a call for banking institutions to stay on their toes. Banks should make sure their perimeter security is in good shape and their email gateways are updated. "The second thing is to make sure banking employees are aware they're targets of cybercriminals, just by the nature of the fact they work at a bank," Meurer adds. "Any employee is a rich target for a cybercriminal."

Related Content

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info.