Blackcat uses malicious WinSCP advertisement

The threat actors group named BlackCat (also known as ALPHV) has been observed using malvertising techniques, to distribute their malware via web pages spoofing the official website of WinSCP, a file transfer application.

According to observations made by the Trendmicro team, malicious actors have recently been abusing malvertising to distribute malware via websites masquerading as legitimate sites. In the specific case involved in this article, the website used by malicious actors is WinSCP, an open-source Windows file transfer application.

The use of advertising platforms by malicious actors to trick users is not a new practice, due to the widespread use of platforms such as Google Ads by companies to promote their applications in a better way. This is no different for WinSCP, with approximately 400,000 downloads per week.

The malicious group BlackCat has been using WinSCP-specific malvertisements in search engines such as Bing or Google. When the user searches for “WinSCP Download” the malicious advertisement is displayed to the user, who upon clicking on it is redirected to a website which displays a tutorial of the application in question.

Once the user is redirected to the website impersonating the original site, they will find a download button which will proceed to download an ISO file from an infected WordPress web page. The downloaded files are identified as “setup.exe” and “msi.dll” the former is the lure for the user to run and the latter is the malware dropper activated by the executable.

When the “setup.exe” file is executed, it calls the “msi.dll” file which extracts a Python folder from the RCDATA DLL section as would be the case in a genuine WinSCP installer. Between the two Python installations is a trojanized “python310.dll” file with the purpose of creating persistence on the compromised systems using an execution key named “Python” and the value “C:UsersPublicMusicpythonpythonw.exe”.

When the pythonw.exe executable starts, it loads a modified python320.dll which contains a Cobalt Strike beacon that starts a connection to the attackers’ command and control (C2) server. From here the main beacon module is obtained.

Next, multiple scheduled tasks are created on the compromised systems to maintain persistence on them. At the same time, once the Cobalt strike module is running on the system, the actions to be taken can be varied by running additional scripts to search for tools that allow lateral movement and allow the attacker to further compromise the system.

As observed by trendmicro researchers, the malicious group BlackCat makes use of some extra tools for the later phases of the attack, among these tools, we can highlight the ones listed below:

• AdFind: Command-line tool used to retrieve Active Directory (AD) information.
• PowerShell commands used to collect user data, extract ZIP files, and execute scripts.
• AccessChk64: Command-line tool used for user and group permissions recognition.
• Findstr: command line tool used to search for passwords within XML files.
• PowerView: PowerSploit script used for AD recognition and enumeration.
• Python scripts used to run the LaZagne password recovery tool and obtain Veeam credentials.
• PsExec, BitsAdmin and Curl, used for lateral movement.
• AnyDesk: legitimate remote management tool abused to maintain persistence.
• KillAV BAT script used to disable or bypass anti-virus and anti-malware programs.
• PuTTY secure copy client used to exfiltrate information collected from the compromised system.

It is worth mentioning the use, by the malicious group, of the anti-virus and anti-EDR detection tool called “Terminator”, a tool that, according to what is indicated in the Russian forums where it is traded, could bypass Windows security tools, through a BYOVD attack; with the purpose of manipulating the protection provided by the agents.

Recommendations

• Implement an awareness and training program on phishing and its consequences, as well as its identification.
• Implement a centralized logging system to collect and analyze logs from various network devices and systems.
• Have defined normal network traffic for normal operations, to detect any alteration or abnormal behavior of the same.
• Implement intrusion detection systems (IDS) to detect command and control activity, as well as any other potentially malicious network activity.
• Do not click on suspicious links or advertisements and avoid visiting unsafe websites.
• Use firewalls and content filtering to block access to known malicious websites and services.

IOC