{"id":7023,"date":"2021-09-29T15:28:57","date_gmt":"2021-09-29T22:28:57","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=7023"},"modified":"2024-08-07T12:18:59","modified_gmt":"2024-08-07T19:18:59","slug":"likely-fin7-recon-campaign","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-campaign-briefs\/likely-fin7-recon-campaign\/","title":{"rendered":"Likely FIN7 Recon Campaign"},"content":{"rendered":"

Author: Ma\u00ebl Le Touz<\/strong><\/h3>\n

 <\/p>\n

1. Overview<\/h3>\n

Since late August, Infoblox has been tracking a campaign distributing JavaScript malware. The malware\u2019s command and control (C&C) domain, distribution method, and code are consistent with those of FIN7: a group of Russian cybercriminals who are motivated by financial gain and who have been targeting businesses around the world since 2013.<\/p>\n

2. Customer impact<\/h3>\n

This campaign is focused on U.S. companies and English-speaking individuals. FIN7 are known for their aggressiveness, creative use of social media, blackmailing, and threatening to disclose victims\u2019 personal data.1<\/sup><\/p>\n

The behavior of the malware in this campaign matches that of Griffon: a JavaScript malware attributed to FIN7. The behavior is also consistent with the assessment that this malware is used as a first-stage reconnaissance tool and as an installer for future payloads.<\/p>\n

3. Campaign analysis<\/h3>\n

Some emails in this campaign claim to contain bills from Tinder or T-Mobile. Other emails claim to be from the U.S. government and to contain new regulations and vaccination requirements related to Covid-19. The emails are sent a) to large groups rather than specific targets, and b) from a variety of free or inexpensive email providers rather than from a single, attacker-controlled domain.<\/p>\n

The relatively low volume of emails we observed since 21 August was interrupted by a large spike from 12 to 15 September. On 14 September, the volume had increased by over 1400 percent.<\/p>\n

4. Attack chain<\/h3>\n

Clicking the email\u2019s attachment decompresses the zip archive and opens a file with a long filename and a double extension, .txt.js, which Microsoft Windows hides by default. If the victim double-clicks the file, Windows Script Host starts running the JavaScript code.<\/p>\n

The JavaScript code consists of only 150 lines but is heavily obfuscated. Dynamic analysis revealed that the main purpose of the malware is to reconnoiter the endpoint, send identifying data back to C&C, and set the stage for an offensive operation.<\/p>\n

When executed, the malware uses a WMI query to collect the IP address, active network interface, hostname, DNS configuration, and other information about the machine. It waits for two minutes and then sends this data to its C&C on a random URL. If C&C responds, the malware waits for a random period of time then pings C&C again in a loop and waits for its commands. The main loop also prepares a WScript object for receiving and executing future payloads. Public reports suggest that the C&C queries whoami<\/i> on the local machine and tries to determine whether the user has administrative privileges.<\/p>\n

Although JavaScript is mostly platform independent, the malware targets only Windows machines. If the machine is not running Windows, the script fails silently, to suppress its output and avoid detection.<\/p>\n

To encrypt communications with its C&C as plain text, the malware uses a custom XOR encryption routine and a random encryption key. The malware chooses URLs for its C&C at random, from a list of defined variables. These URLs end with img, new, or pictures, so they might appear innocuous to unsuspecting targets. The malware also delays its actions frequently, probably to avoid detection and triggering of the antimalware on the victim\u2019s machine.<\/p>\n

\"\"<\/a><\/p>\n

5. Vulnerabilities and mitigation<\/h3>\n

Because the malware does not exploit any vulnerabilities but relies on user interaction and default Windows file associations, organizations can follow these recommendations to prevent falling victim to Griffon:<\/p>\n