Banking Trojans go Loonie for Toonies: Dridex, Vawtrak and others increase focus on Canada

Overview

Threat actors behind banking Trojan malware are known to switch targeted geographies from time to time, and it appears that a number have set their sights on Canada within a short time-frame. In the past couple of months Proofpoint has observed a number of campaigns targeting Canadian online banking users varying in scale between dozens of messages across a small subset of our customers to tens of thousands of messages seen more broadly. These campaigns have primarily been using malicious Microsoft Word documents to install banking Trojans on victims' PCs, but we have also seen campaigns use links leading to malware as well.

While it is not uncommon to see email-based malware and phishing campaigns targeting Canadian residents and businesses, the volume and diversity of these campaigns seem to be increasing. The malicious payloads we have been observing include all types of banking Trojans, malware specifically designed to steal funds from online banking users. An individual or business infected with this malware are likely to have (potentially large) amounts of money stolen from their bank accounts if they log in to their online banking system while the malware is active. When deployed, banking Trojans must be configured to work with specific banks, allowing us to detect country-specific targeting based on these configurations as well as the location of businesses receiving malicious emails used to distribute the Trojans.

In particular, we have observed six different banking Trojan families, including Ursnif, Dridex, Kronos, Zeus, Gootkit, and Vawtrak, all targeting customers of Canadian financial institutions. The Dridex banking Trojan alone has been tied to at least $40 million in losses in the US and UK [1].

Trojan Analysis

The spam messages we observed associated with this banking Trojan malware used several different tactics to deliver malicious payloads to users, including malicious macros, packager shell objects (aka OLE objects), and links.

The first example, a campaign observed on May 17, 2016, uses a fake Microsoft security alert social engineering lure to trick the victim into opening a link that leads to an executable download. The user would have to then open the downloaded executable in order to infect their computer. In this case the payload was Kronos, a banking Trojan which was introduced in July of 2014 [1]. This instance of Kronos was configured to target US, Canadian, and Australian financial sites.

The second example, a campaign observed on June 6, 2016, uses a document attachment posing as a Canada Post failed delivery notice and contains macros that, if enabled, download and install Dridex botnet 220. Notably, this campaign was not sent out by the Necurs botnet and occurred during the recent Necurs botnet outage [3]. At this time, Dridex 220 was configured to target a variety of Canadian financial sites.

The third example, a campaign observed on June 26, 2016, uses a document with packager shell objects [4] posing as a Microsoft Excel spreadsheet and a photo, but which are, in fact, JavaScript downloaders. Double-clicking on either object runs the JavaScript which would then download the Gootkit payload [5]. This instance of Gootkit is configured to target Canadian and German financial sites.

The fourth example, a campaign observed on June 28, 2016, uses a fake UPS proof of delivery (including stolen branding) document which contains macros that, if enabled, would download Vawtrak [6] Project 21. Like the examples in Figure 1 and 2 above, the lure leverages well-known brand names and stolen logos to create an air of legitimacy that will trick a user into running the malicious attachment content. This Vawtrak project is configured to target primarily Canadian financial sites, but also includes targeting for UK sites.

Conclusion

Banking Trojans have been circulating for the better part of the last decade. Canada has hardly been immune to these types of malware, but recently we have observed an increase in campaigns and banking Trojan variants targeting Canadian interests.Regardless of their geographic location, organizations and individuals can take several steps to prevent infection and financial losses:

• Be vigilant when reading email messages that contain links or attachments. All of the campaigns described here relied on social engineering to trick users into infecting themselves with malware, even though their systems would have likely presented security warnings when they opened malicious files.
• Never enable macros in documents that arrive via email or download and run executables linked from an email message unless you are absolutely certain the message is authentic.
• Configure online banking accounts with maximum security settings. For example, enabling two-factor authentication and notifications or confirmation for any money transfers can often prevent losses even if a system is infected.
• Organizations should also invest in appropriate security technologies to protect their employees from falling prey to these attacks. Businesses are particularly at risk because their bank accounts typically contain much larger amounts of money and are therefore a higher-priority target for attackers. Larger employee pools also increase the odds of a successful infection.

A double-double of user education and advanced threat security solutions can help Canadian organizations prevent both infection and financial losses related to banking Trojans and other malware.

References

[1] http://www.tripwire.com/state-of-security/latest-security-news/dridex-p2p-malware-nets-cybercriminals-40-million/

[2] http://securityintelligence.com/the-father-of-zeus-kronos-malware-discovered/

[3] https://www.proofpoint.com/us/threat-insight/post/necurs-botnet-outage-crimps-dridex-and-locky-distribution

[4] https://blogs.technet.microsoft.com/mmpc/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/

[5] https://www.proofpoint.com/us/threat-insight/post/gootkit-banking-trojan-jumps-channel

[6] https://www.proofpoint.com/us/threat-insight/post/In-The-Shadows

Indicators of Compromise (IOC)