I imagine our readers still remember Stuxnet, a worm that, according to different sources, was developed jointly by the United States and Israel with the goal of sabotaging Iran's nuclear program. Stuxnet possessed very interesting and at the same time worrying technical resources, but it was only a matter of time before variants with similar operation would emerge. That is exactly what the people at Kaspersky have discovered. This “fileless malware” has the ability to remain resident in memory without leaving traces, and it seems to really like corporate networks…
The story began with Stuxnet, then continued with Duqu, and in mid-2015 Duqu 2.0 was discovered. What was initially exclusive technology for government agencies with very high-level budgets has now reached other elements seeking more tangible results… money, to be precise. Security experts call this recent wave of malware “fileless”, since its priority is to remain resident in memory, without leaving traces on hard drives, or hiding them as much as possible. This strategy not only makes the malware almost invisible, but also forces a rethink of all traditional forensic techniques.
The people at Kaspersky explain that infections are even more difficult to detect due to the use of tools considered legitimate, such as Metasploit, Mimikatz, and even Windows' own PowerShell. The company also indicated that the attacks affected the networks of at least 140 organizations, most of them being banks. The United States, France, Ecuador, Kenya, and the United Kingdom form the Top 5 of the most affected countries. Something that Kaspersky has not yet been able to determine is whether a single group is responsible, or if it involves several teams in a race to see who is more successful.
Basically, the main function of the malware (or at least one of them) is the “harvesting” of passwords. It all begins with the injection into memory of Meterpreter (one of Metasploit's payloads) using PowerShell commands. Then, the infected system transmits data to servers controlled by the attacker using the NETSH tool. And the privileges needed for these actions are extracted with Mimikatz.
In an attempt to reduce its footprint and avoid logs or discarded files on the hard drive, the attackers “hide” PowerShell commands within the Windows registry. Kaspersky was able to reconstruct the malware thanks to the fact that one of the domain controllers infected with Meterpreter was not restarted. What Kaspersky still needs to establish is how the malware enters in the first place, but it has already anticipated that it will have more information in April, including the way in which these infections allow withdraw money from ATMs.
On the other hand, as you can see above, and for those who need to know more about the subject, the Comparitech company has designed a useful template to understand how Metasploit works, with all the necessary commands to verify vulnerabilities and understand the functioning of the beast. Super convenient if you have to deal with this malware!
