Thursday, March 28, 2024

Hackers Launching GandCrab Ransomware via New Fallout Exploit Kit using Malvertising Campaign

Cybercriminals now using new Fallout Exploit Kit for launching GandCrab Ransomware via Malvertising Campaign that targets many victims around the world.

This malvertising campaign mainly affected users in  Japan, Korea, the Middle East, Southern Europe, Asia Pacific region and other countries.

Along with this Exploit kit, there are additional domains, regions, and payloads associated with the campaign that helps to successfully deliver the GandCrab ransomware.

Attacker carefully picking up the victims to delivering the malicious content to the target users, if the profile matchs then the users redirected from a genuine advertiser page and finally reaching the EK landing page via multiple 302 redirections.

Attackers keep changing the Exploit kit (EK) landing page to evade the IDS detection based on the pattern and other methods.

Other then this, malvertisement either delivers the exploit kit or it tries to reroute the user to other social engineering campaigns based on the browser/OS profiles and user location.

Social Engineering campaigns & Exploit Kit Landing Page

Fake AV prompt for Mac users to download the new file by posted as  a legitimate update by saying “Your Mac might be infected with latest viruses”

An initial stage of landing page contains a  VBScript vulnerability (CVE-2018-8174) code later embedded code will be added for further more reliable payload execution.

Later the next stage of VBScript code will be decoded by keeps the VBScript code as Base64 encoded text in the ‘<span>’ tag where it loads the Jscript code when pages loads.

The decoded VBScript code exploits the CVE-2018-8174 vulnerability and executes shellcode and the shellcode downloads a XOR’d payload at %temp% location, decrypts it, and executes it.

Its initial loading and final payload execution will be done by malware contain using PE loader code.

According to FireEye Researchers, request sequence leads to GandCrab ransomware being fetched and manually loaded into memory by the malware.

In recent years, arrests and distruptions of underground operations have led to exploit kit activity declining heavily. Still, exploit kits pose a significant threat to users who are not running fully patched systems. FireEye Said.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles