Phishing focusing on Polish SMBs continues through ModiLoader

ESET Analysis

ESET researchers detected a number of, widespread phishing campaigns focusing on SMBs in Poland throughout Might 2024, distributing numerous malware households

30 Jul 2024
 • 
,
8 min. learn

Only a few months again, ESET Analysis revealed a blogpost about large phishing campaigns throughout Central and Japanese Europe carried out through the second half of 2023. In these campaigns Rescoms malware (also referred to as Remcos), protected by AceCryptor, was delivered to potential victims with the targets of credential theft and potential achieve of preliminary entry to firm networks.

Phishing campaigns focusing on the area didn’t cease in 2024. On this blogpost we current what latest phishing campaigns seemed like and the way the selection of supply mechanism shifted away from AceCryptor to ModiLoader.

Key factors of this blogpost:

• ESET detected 9 notable ModiLoader phishing campaigns throughout Might 2024 in Poland, Romania, and Italy.
• These campaigns focused small and medium-sized companies.
• Seven of the campaigns focused Poland, the place ESET merchandise protected over 21,000 customers.
• Attackers deployed three malware households through ModiLoader: Rescoms, Agent Tesla, and Formbook.
• Attackers used beforehand compromised electronic mail accounts and firm servers, not solely to unfold malicious emails but in addition to host malware and acquire stolen knowledge.

Overview

Regardless that the phishing campaigns have been ongoing all through the primary half of 2024, this blogpost focuses simply on Might 2024, as this was an eventful month. Throughout this era, ESET merchandise protected over 26,000 customers, over 21,000 (80%) of whom have been in Poland. Along with Poland, the place over 80% of potential victims have been positioned, Italy and Romania have been additionally focused by the phishing campaigns. In complete we registered 9 phishing campaigns, seven of which focused Poland all through Might, as may be seen in Determine 1.

Compared with the campaigns that came about through the finish of 2023, we see a shift away from utilizing AceCryptor as a device of alternative to guard and efficiently ship the malware. As an alternative, in all 9 campaigns, attackers used ModiLoader (aka DBatLoader) as the popular supply device of alternative. The ultimate payload to be delivered and launched on the compromised machines various; we’ve detected campaigns delivering:

• Formbook – info stealing malware found in 2016,
• Agent Tesla – a distant entry trojan and data stealer, and
• Rescoms RAT – distant management and surveillance software program, capable of steal delicate info.

Campaigns

Usually, all campaigns adopted the same state of affairs. The focused firm acquired an electronic mail message with a enterprise provide that may very well be so simple as “Please present your greatest value provide for the hooked up order no. 2405073”, as may be seen in Determine 2.

In different campaigns, electronic mail messages have been extra verbose, such because the phishing electronic mail in Determine 3, which may be translated as follows:

Hello,

We wish to buy your product for our consumer.

Please discover the hooked up inquiry for step one of this buy.

The hooked up sheet comprises goal costs for many merchandise. I highlighted 10 components to give attention to pricing – the remainder of the gadgets are elective to cost (we are going to apply comparable value degree primarily based on different costs).

Please get again to me earlier than 28/05/2024

For those who want extra time, please let me know the way a lot you’ll need.

You probably have any questions, please additionally let me know.

As within the phishing campaigns of H2 2023, attackers impersonated present corporations and their staff because the strategy of alternative to extend marketing campaign success price. On this approach, even when the potential sufferer seemed for the standard crimson flags (other than potential translation errors), they have been simply not there, and the e-mail seemed as respectable because it may have.

Contained in the attachments

Emails from all campaigns contained a malicious attachment that the potential sufferer was incentivized to open, primarily based on the textual content of the e-mail. These attachments had names like RFQ8219000045320004.tar (as in Request for Citation) or ZAMÓWIENIE_NR.2405073.IMG (translation: ORDER_NO) and the file itself was both an ISO file or archive.

In campaigns the place an ISO file was despatched as an attachment, the content material was the ModiLoader executable (named equally or the identical because the ISO file itself) that may be launched if a sufferer tried to open the executable.

Within the different case, when a RAR archive was despatched as an attachment, the content material was a closely obfuscated batch script, with the identical identify because the archive and with the .cmd file extension. This file additionally contained a base64-encoded ModiLoader executable, disguised as a PEM-encoded certificates revocation record. The script is liable for decoding and launching the embedded ModiLoader (Determine 4).

When ModiLoader is launched

ModiLoader is a Delphi downloader with a easy process – to obtain and launch malware. In two of the campaigns, ModiLoader samples have been configured to obtain the next-stage malware from a compromised server belonging to a Hungarian firm. In the remainder of the campaigns ModiLoader downloaded the subsequent stage from Microsoft’s OneDrive cloud storage. We noticed 4 accounts the place second-stage malware was hosted. The entire chain of compromise from receiving the malicious electronic mail till launching the ultimate payload is summarized in Determine 5.

Knowledge exfiltration

Three totally different malware households have been used as a ultimate payload: Agent Tesla, Rescoms, and Formbook. All these households are able to info stealing and thus permit attackers not solely to develop their datasets of stolen info, but in addition to arrange the bottom for his or her subsequent campaigns. Regardless that the exfiltration mechanisms differ between malware households and campaigns, it’s value mentioning two examples of those mechanisms.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Analysis provides non-public APT intelligence studies and knowledge feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

A complete record of indicators of compromise (IoCs) may be present in our GitHub repository.

Information

MITRE ATT&CK strategies

This desk was constructed utilizing model 15 of the MITRE ATT&CK framework.