[ad_1]
Potential connections between a subscription-based crimeware-as-a-service (Caas) resolution and a cracked copy of Cobalt Strike have been established in what the researchers suspect is being supplied as a device for its clients to stage post-exploitation actions.
Prometheus, because the service is named, first got here to gentle in August 2021 when cybersecurity firm Group-IB disclosed particulars of malicious software program distribution campaigns undertaken by cybercriminal teams to distribute Campo Loader, Hancitor, IcedID, QBot, Buer Loader, and SocGholish in Belgium and the U.S.
Costing $250 a month, it is marketed on Russian underground boards as a visitors course system (TDS) to allow phishing redirection on a mass scale to rogue touchdown pages which are designed to deploy malware payloads on the focused techniques.
“Prometheus could be thought-about a full-bodied service/platform that enables menace teams to purvey their malware or phishing operations with ease,” BlackBerry Analysis and Intelligence Staff stated in a report shared with The Hacker Information. “The principle elements of Prometheus embody an internet of malicious infrastructure, malicious e-mail distribution, illicit file-hosting by way of professional companies, visitors redirection and the flexibility to ship malicious recordsdata.”
Sometimes, the redirection is funneled from one in all two predominant sources, specifically with the assistance of malicious advertisements (aka malvertising) on professional web sites, or through web sites which have been tampered to insert malicious code.
Within the case of Prometheus, the assault chain begins with a spam e-mail containing a HTML file or a Google Docs web page that, upon interplay, redirects the sufferer to a compromised web site internet hosting a PHP backdoor that fingerprints the machine to find out whether or not the to “to serve the sufferer with malware or redirect them to a different web page which may comprise a phishing rip-off.”
Earliest exercise related to the operators of the service, who go by the title “Ma1n” on hacking boards, is claimed to have commenced in October 2018, with the creator linked to different illicit instruments providing prime quality redirects and PowerMTA kits for mailing to company mailboxes, earlier than placing up Prometheus TDS on the market on September 22, 2020.
That is not all. BlackBerry additionally discovered overlaps between Prometheus-related exercise and an illegitimate model of the Cobalt Strike adversary simulation and menace emulation software program, elevating the chance that the copy is being “proliferated by the Prometheus operators themselves.”
“It is attainable that somebody related with the Prometheus TDS is sustaining this cracked copy and offering it upon buy,” the researchers stated. “It’s also attainable that this cracked set up could also be supplied as a part of a typical playbook or a digital machine (VM) set up.”
That is substantiated by the truth that various menace actors, together with DarkCrystal RAT, FickerStealer, FIN7, Qakbot, and IceID, in addition to ransomware cartels similar to REvil, Ryuk (Wizard Spider), BlackMatter, and Cerber, have used the cracked copy in query over the past two years.
On high of that, the identical Cobalt Strike Beacon has additionally been noticed along with actions related to an preliminary entry dealer tracked as Zebra2104, whose companies have been put to make use of by teams like StrongPity, MountLocker, and Phobos for their very own campaigns.
“Whereas TDS’es aren’t a brand new idea, the extent of complexity, help and low monetary price provides credence to the idea that this can be a development that’s prone to rise within the menace panorama’s close to future,” the researchers famous.
“The quantity of teams which are utilizing choices such because the Prometheus TDS, converse to the success and efficacy of those illicit infrastructure for rent companies, that are in essence full-fledged enterprises that help the malicious actions of teams no matter their measurement, stage of resourcing or motives.”
[ad_2]
