Formbook—Cheap Password Stealing Malware Used Inwards Targeted Attacks

It seems sophisticated hackers accept changed the means they bear targeted cyber operations—instead of investing inwards zero-days as well as developing their malware; unopen to hacking groups accept at nowadays started using ready-made malware only similar script kiddies.

Possibly, this could last a smart motility for state-sponsored hackers to avoid beingness attributed easily.

Security researchers from multiple safety firms, including FireEye, independently discovered a serial of malware campaigns primarily targeting aerospace, defense forcefulness contractors as well as manufacturing sectors inwards diverse countries, including the United States, Thailand, Republic of Korea as well as India.

What's common? All these assail campaigns, conducted past times diverse hacking groups, eventually install same information as well as password stealer malware—dubbed FormBook—on the targeted systems.

FormBook is zip but a "malware-as-as-service," which is an affordable slice of data-stealing as well as form-grabbing malware that has been advertised inwards diverse hacking forums since early on 2016.

Anyone tin rent FormBook for only $29 per calendar week or $59 per month, which offers a attain of advanced spying capabilities on target machines, including a keylogger, password stealer, network sniffer, taking the screenshots, spider web shape information stealer as well as more.

According to the researchers, attackers inwards each drive are primarily using emails to distribute the FormBook malware every bit an attachment inwards unlike forms, including PDFs amongst malicious download links, DOC as well as XLS files amongst malicious macros, as well as archive files (ZIP, RAR, ACE, as well as ISOs) containing EXE payloads.

Once installed on a target system, the malware injects itself into diverse processes as well as starts capturing keystrokes as well as extracts stored passwords as well as other sensitive information from multiple applications, including Google Chrome, Firefox, Skype, Safari, Vivaldi, Q-360, Microsoft Outlook, Mozilla Thunderbird, 3D-FTP, FileZilla as well as WinSCP.

FormBook continuously sends all the stolen information to a remote command as well as command (C2) server which too allows the assailant to execute other commands on the targeted system, including outset processes, shutdown as well as reboot the system, as well as stealing cookies.

"One of the malware's close interesting features is that it reads Windows’ ntdll.dll module from disk into memory, as well as calls its exported functions directly, rendering user-mode hooking as well as API monitoring mechanisms ineffective," FireEye says.

"The malware writer calls this technique "Lagos Island method" (allegedly originating from a userland rootkit amongst this name)."

According to the researchers, FormBook was too seen downloading other malware families such every bit NanoCore inwards the final few weeks.

The attackers tin fifty-fifty utilization the information successfully harvested past times FormBook for farther cybercriminal activities including, identity theft, continued phishing operations, depository fiscal establishment fraud as well as extortion.

FormBook is neither sophisticated, nor difficult-to-detect malware, then the best means to protect yourself from this malware is to maintain skillful antivirus software on your systems, as well as e'er maintain it up-to-date.

Share This :