Botconf 2020

Unsuspecting online shoppers risk credit card fraud by shopping on legitimate websites due to online credit card skimming. The COVID-19 pandemic forced many to shop online, unwillingly helping the criminals behind the online credit card skimmer operations. Aside from covering different skimmers and the accompanying modus operandi, this talk will focus on the hunt for live skimmers, as well as the results of such a hunt. Additionally, it goes into the research methodology and the economic implications of a digital skimmer infection. The latter two aspects are often left out of reports and investigations, whilst they are equally important.

QuasarRAT is the most famous open source RAT project among many. Since xRAT (the predecessor of Quasar RAT) was released in 2014, many attackers have deployed this RAT in many attack campaigns. Particularly, they take advantage of the open source attack tool which enables conducting attacks in a generic way in order to avoid being attributed. This trend is commonly seen in recent years, and open source tools including QuasarRAT have been used in many cases.
Our investigation has identified many RAT projects related to QuasarRAT. In these projects, QuasarRAT has been upgraded with new functions or transformed into an entirely new type of malware. The Quasar family malware has been used in many attack cases. It is important to understand the details of the Quasar RAT and its family, particularly how each project develops from the QuasarRAT and is being used for new types of attacks.

Botnets, as Botconf’s participants know very well, vary significantly. Their goals differ, as well as their TTPs and implementations. Nonetheless, most of them usually share the property of connecting to a remote attack server. In fact, great knowledge of the botnet can be obtained by looking at the command-and-control communication. Once a C2 server is found, a researcher can learn where the attack infrastructure is hosted, what malware is downloaded onto infected machines, and with enough luck, track down the threat actor.

When we first discovered Fritzfrog in our sensors network, we thought it was yet another cryptomining botnet. As part of our research routines, we kept looking for the C2 servers. It took us quite some time to understand that we were not going to find those servers, simply because they did not exist; Fritzfrog was a peer-to-peer (P2P) botnet.

In a P2P botnet, there is no centralized attack server. Control is distributed among the infected machines, or “nodes”, and each node has peers with which it can communicate. Peers can exchange targets, deploy binary files on each other, run scripts remotely, push and get logs from each other, etc.

The concept of P2P botnets is not new; however, it requires strong skills in design and implementation, which is why it’s been mostly used by state-sponsored and APT groups. Fritzfrog demonstrates that this is no longer the case, as P2P botnets are now used by common criminals to get the cryptomining power and access they are used to pursue.

Android is an open-source operating system which allows OEMs and their subcontractors certain flexibility in adding components to the system. These add-ons may contain new and exciting features, but sometimes they also hide complex malware. This talk will deal with a malware family called ‘Domino’.

Domino was discovered preinstalled on certain Android devices and distributed as a new operating system component on a small fraction of different phone brands, all of them low-cost devices running Android 7 or lower. On these devices, the malware author added additional code to many Android components – such as the default browser, the Settings app and the Android framework – which allows Domino to use system privileges to download additional applications later on and prevent their uninstallation by the user.

Different versions of Domino implement different behaviour, from displaying advertisements to overwriting visited URLs in order to change the default search engine or advertisement campaign referral IDs. The changes introduced by Domino also made it possible to ensure that Domino’s browser was exclusively used to display all links clicked by the user.

Rather unusually, we were able to obtain a compressed archive with Domino’s source code, including code comments and notes for manufacturers on how to embed Domino on their devices. Additionally, this archive includes SELinux policies crafted to allow Domino to persist and run with elevated privileges. We also obtained a test application which tried to interact with the Google Play store in order to test referral substitution and seems to be written by the Domino author to test some coding ideas.

Our research team at ESET has tracked the infamous Turla espionage group for many years. By leveraging unique telemetry data, forensic analysis of infected machines and in-depth malware reverse-engineering, we gained a quite comprehensive knowledge of their operations. Since our last talk in 2018, Turla procedures have evolved and we would like to share fresh information about the group Tools, Techniques and Procedures.
This presentation will first introduce the Turla group. We will present the main attacks publicly attributed to the group, which is mainly interested in high-profile targets such as government bodies and defense companies. We will also share what the attackers are looking for on compromise machines and try to reveal their motives.
Then, we will go more technical and showcase Turla’s implementation of the three classic steps of an APT campaign: infection, lateral movement and long-term persistence in order to reach their espionage objectives.