Threat Research · blog.talosintelligence.com

Talos Details Phishing and Malware Campaigns Abusing IPFS

Nov 9, 2022 · Original article ↗

Summary

Cisco Talos analyzes phishing and malware campaigns using IPFS to host credential-harvesting pages and payloads, including Agent Tesla, reverse shells, destructive malware, and the Hannabi information stealer.

Key points

IPFS’s decentralized storage and resilient content hosting can make malicious phishing pages and malware payloads harder to remove and block.
In a phishing example, a fake document link led to a Microsoft-lookalike page that sent victims’ credentials to an attacker-controlled server.
An Agent Tesla campaign used an email attachment and .NET downloader to retrieve and execute its next-stage payload through an IPFS gateway.
Other loaders retrieved payloads including a Python information stealer, reverse shells, and a batch file designed to delete files and volume shadow copies.
Hannabi Grabber targets application data, browser passwords and cookies, and Discord and Roblox data, then exfiltrates information through Discord webhooks.
Talos reported an increase in samples using IPFS and provided Snort and ClamAV signatures and other detection and blocking options.

Article Details

Attack Vectors: Phishing kits hosted on IPFS collect victims' email addresses and passwords; victims are directed to them through links in PDFs impersonating DocuSign documents.
Malspam emails deliver ZIP attachments containing .NET downloaders that retrieve next-stage payloads from IPFS gateways.
Loaders, sometimes hosted on the Discord CDN and disguised as video-game cheats or cracks, retrieve payloads hosted on IPFS.
Loaders create hidden, system-flagged files and directories, establish persistence through Windows registry entries in some cases, and execute retrieved payloads.
Hannabi Grabber collects application, browser, Discord, and Roblox data, then exfiltrates it through Discord Webhooks.
Defensive Notes: Organizations should account for legitimate and malicious IPFS activity and assess security controls for detecting or preventing attacks that use IPFS gateways.
The article identifies Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, Firewall Management Center, Snort, and ClamAV as applicable detection or prevention coverage.
Applicable Snort SID: 60728.
The article lists ClamAV signatures for Agent Tesla, phishing PDFs, artifact deletion, reverse shells, loaders, and Hannabi Grabber.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe Agent Tesla next-stage executable is obfuscated, and a reverse-shell script contains multiple layers of base64-encoded content.T1055 · Process InjectionThe Agent Tesla payload is described as reflectively loaded and executed.T1059.001 · PowerShellThe loader uses PowerShell Expand-Archive to extract the downloaded Python archive and, in one example, attempts to start a batch-file payload.T1059.003 · Windows Command ShellThe loader invokes cmd.exe to create directories, download files, set file attributes, and run the next-stage Python payload.T1059.006 · PythonA Python-based Hannabi Grabber and Python reverse-shell payload are described.T1105 · Ingress Tool TransferDownloaders and loaders retrieve malware payloads from IPFS through gateways.T1113 · Screen CaptureHannabi Grabber takes screenshots of the infected machine.T1114 · Email CollectionHannabi Grabber collects email-related and other application data from infected systems.T1485 · Data DestructionA retrieved batch-file payload deletes volume shadow copies and contents from user directories and mounted filesystems.T1547.004 · Winlogon Helper DLLIn some samples, the malware adds persistence entries under the Windows Run and Winlogon registry locations.T1564.001 · Hidden Files and DirectoriesThe loader sets the Hidden attribute on its Network directory, Python ZIP archive, and retrieved payload.T1566.001 · Spearphishing AttachmentA phishing email carries a PDF attachment/link purporting to relate to DocuSign and directs victims to an IPFS-hosted credential-harvesting page.T1567 · Exfiltration Over Web ServiceHannabi Grabber exfiltrates collected data, including a ZIP archive, through Discord Webhooks.

People

Edmund BrumaghinNamed author of the article.

Malware

Agent TeslaAgent Tesla malspam campaign Hannabi Grabberwithin the Network directory using the filename “Packages.txt.” An example of the loader retrieving Hannabi Grabber, an information stealer written in Python is shown below.

Vendors

CiscoCisco Talos has observed multiple ongoing campaigns that leverage the IPFS network to host their malware payloads and phishing kit infrastructure while facilitating other attacks.

Products

Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.ClamAVThe following ClamAV signatures are applicable to this threat:Firewall Management CenterAdditional protections with context to your specific environment and threat data are available from the Firewall Management Center.IPFSThreat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.SecureXSecureX SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.UmbrellaUmbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.

Tools

curlThe malware then attempts to retrieve Python 3.10 from the legitimate software provider using the cURL command.msfvenomincluded a Python-based information stealer, reverse shell payloads that were likely generated using msfvenom, and a batch file designed to destroy victim systems.PowerShellOnce the ZIP archive has been retrieved, it is then unzipped into the directory that was previously created using the PowerShell “Expand-Archive” cmdlet.Py2EXEis common to information-stealing malware. Typically, attackers will attempt to leverage PyInstaller or Py2EXE to compile their Python into a PE32 file format prior to distributing it to victims. This is a case where PyInstallerthat is common to information-stealing malware. Typically, attackers will attempt to leverage PyInstaller or Py2EXE to compile their Python into a PE32 file format prior to distributing it to victims. This is UPXsuch as “Minecraft.” In most cases, the loader was not packed, but we did observe samples packed using UPX.

Related Articles