Monday, December 4, 2023

Hackers Launching GandCrab Ransomware via New Fallout Exploit Kit using Malvertising Campaign

Cybercriminals now using new Fallout Exploit Kit for launching GandCrab Ransomware via Malvertising Campaign that targets many victims around the world.

This malvertising campaign mainly affected users in  Japan, Korea, the Middle East, Southern Europe, Asia Pacific region and other countries.

Along with this Exploit kit, there are additional domains, regions, and payloads associated with the campaign that helps to successfully deliver the GandCrab ransomware.

Attacker carefully picking up the victims to delivering the malicious content to the target users, if the profile matchs then the users redirected from a genuine advertiser page and finally reaching the EK landing page via multiple 302 redirections.

Attackers keep changing the Exploit kit (EK) landing page to evade the IDS detection based on the pattern and other methods.

Other then this, malvertisement either delivers the exploit kit or it tries to reroute the user to other social engineering campaigns based on the browser/OS profiles and user location.

Social Engineering campaigns & Exploit Kit Landing Page

Fake AV prompt for Mac users to download the new file by posted as  a legitimate update by saying “Your Mac might be infected with latest viruses”

An initial stage of landing page contains a  VBScript vulnerability (CVE-2018-8174) code later embedded code will be added for further more reliable payload execution.

Later the next stage of VBScript code will be decoded by keeps the VBScript code as Base64 encoded text in the ‘<span>’ tag where it loads the Jscript code when pages loads.

The decoded VBScript code exploits the CVE-2018-8174 vulnerability and executes shellcode and the shellcode downloads a XOR’d payload at %temp% location, decrypts it, and executes it.

Its initial loading and final payload execution will be done by malware contain using PE loader code.

According to FireEye Researchers, request sequence leads to GandCrab ransomware being fetched and manually loaded into memory by the malware.

In recent years, arrests and distruptions of underground operations have led to exploit kit activity declining heavily. Still, exploit kits pose a significant threat to users who are not running fully patched systems. FireEye Said.


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles