Hackers Launching GandCrab Ransomware via New Fallout Exploit Kit using Malvertising Campaign

Cybercriminals now using new Fallout Exploit Kit for launching GandCrab Ransomware via Malvertising Campaign that targets many victims around the world.

This malvertising campaign mainly affected users in  Japan, Korea, the Middle East, Southern Europe, Asia Pacific region and other countries.

Along with this Exploit kit, there are additional domains, regions, and payloads associated with the campaign that helps to successfully deliver the GandCrab ransomware.

Attacker carefully picking up the victims to delivering the malicious content to the target users, if the profile matchs then the users redirected from a genuine advertiser page and finally reaching the EK landing page via multiple 302 redirections.

Attackers keep changing the Exploit kit (EK) landing page to evade the IDS detection based on the pattern and other methods.

Other then this, malvertisement either delivers the exploit kit or it tries to reroute the user to other social engineering campaigns based on the browser/OS profiles and user location.

Social Engineering campaigns & Exploit Kit Landing Page

Fake AV prompt for Mac users to download the new file by posted as  a legitimate update by saying “Your Mac might be infected with latest viruses”

An initial stage of landing page contains a  VBScript vulnerability (CVE-2018-8174) code later embedded code will be added for further more reliable payload execution.

Later the next stage of VBScript code will be decoded by keeps the VBScript code as Base64 encoded text in the ‘<span>’ tag where it loads the Jscript code when pages loads.

The decoded VBScript code exploits the CVE-2018-8174 vulnerability and executes shellcode and the shellcode downloads a XOR’d payload at %temp% location, decrypts it, and executes it.

Its initial loading and final payload execution will be done by malware contain using PE loader code.

According to FireEye Researchers, request sequence leads to GandCrab ransomware being fetched and manually loaded into memory by the malware.

In recent years, arrests and distruptions of underground operations have led to exploit kit activity declining heavily. Still, exploit kits pose a significant threat to users who are not running fully patched systems. FireEye Said.