An increasing number of adversaries are adopting malvertising and search engine optimization (SEO) poisoning as techniques to redirect users to fake websites and download trojanized installers of popular software. Recently, a threat actor has been observed leveraging Google Ads to deliver a new Windows-based financial Trojan and information stealer called LOBSHOT. This article will discuss the distribution and functionality of LOBSHOT, the role of the TA505 threat group in expanding their malware operations, and the methods used by threat groups to bypass traditional security measures.
LOBSHOT
LOBSHOT is distributed via rogue Google ads for legitimate tools such as AnyDesk, which are hosted on a network of lookalike landing pages maintained by the operators. These pages are designed to resemble the legitimate tool’s website and can be difficult to differentiate from the real website. After the victim clicks on the ad and downloads the tool, LOBSHOT piggybacks on the legitimate tool’s installation process to install itself.
Functionality of LOBSHOT
Once installed, LOBSHOT makes changes to the Windows Registry in order to set up persistence and collect data from over 50 cryptocurrency wallet extensions present in web browsers. This data includes private keys, seeds, and passwords used to access cryptocurrency wallets. LOBSHOT also has the ability to remotely access the compromised host through an hVNC module and perform actions on it without attracting the victim’s attention. This module enables the threat actor to take control of the victim’s computer and perform any desired action, such as installing additional malware or stealing sensitive data.
The role of the TA505 threat group
TA505, which is associated with the Dridex banking Trojan, is once again expanding its malware arsenal to perpetrate data theft and financial fraud. The latest development is significant because it indicates that TA505 is resuming its malware operations. This group is known for using sophisticated tactics to evade detection and has been involved in several high-profile attacks in the past. The use of LOBSHOT suggests that TA505 is continuing its pattern of developing new malware to target financial institutions and cryptocurrency wallets.
Malvertising tactics
Threat groups continue to leverage malvertising techniques to disguise legitimate software with backdoors like LOBSHOT. These kinds of malware may seem small, but can pack significant functionality that helps threat actors move quickly during the early stages of access with fully interactive remote control capabilities. The findings also underscore how an increasing number of adversaries are adopting malvertising and SEO poisoning techniques to redirect users to fake websites and download trojanized installers of popular software.
Implications for cybersecurity
The use of LOBSHOT highlights the risk of relying solely on traditional security measures to detect and prevent cyberattacks. Malware like LOBSHOT is designed to be stealthy and evade detection, making it difficult to detect using traditional antivirus solutions. Given the increasing sophistication of threat actors, new approaches to cybersecurity are needed to safeguard against attacks like these.
The attack chain is designed such that the malware can only be downloaded once per day from the hijacked sites in order to elude discovery by incident responders. This highlights the need for a more proactive and adaptive approach to cybersecurity that can detect and prevent attacks in real-time. As threats continue to increase in sophistication, it is essential for organizations to stay ahead of the curve and adopt techniques that help them stay secure against this new wave of attacks. With the threat of LOBSHOT and the ever-evolving tactics of cybercriminals, staying informed and proactive is more important than ever.
