Ransomware creators use malicious fake ads for updates Microsoft Teams, with the intention of infecting with backdoors Cobalt Strike systems to endanger the rest of the network.
Ransomware attacks have long targeted organizations in various industries, but the most recent ones have focused on education, which depends on video conferencing solutions due to the limitations of Covid-19.
FakeUpdates attacks appeared in 2019 with the delivery of ransomware DoppelPaymer. But this year, malicious advertising campaigns dropped the WastedLocker ransomware and showed a technical breakthrough.
More recently, hackers exploited the ZeroLogon critical vulnerability (CVE-2020-1472) to gain administrator access to the network. This happened via the SocGholish JavaScript framework, found earlier this year in dozens of hacks websites newspapers belonging to the same company.
The placement of malicious fake ads that entice unsuspecting users to click on it to install an update was trapped by injection.
In at least one attack detected by Microsoft, the crooks targeted the Teams software. They were sharing Teams ads with malicious links. Clicking the link would download one payload which ran a PowerShell script to retrieve more malicious content.
It was also installing a legal one copy of Microsoft Teams in the system, so that the victims do not suspect.
Microsoft says that in many cases the initial payload was the Predator the Thief infostealer, which sends intruder sensitive information such as credentials, browser and payment data. Other malware distributed in this way includes the Bladabindi (NJRat) backdoor and the ZLoader stealer.
The malware also downloaded other payloads, with the Cobalt Strike beacons among them, allowing the attacker to discover how it could move sideways on the network.
Microsoft warns that the same patterns seen in FakeUpdates campaigns that use the Teams Update lure have been found in at least six other types of attacks. In some variants of the same attack, the attacker used the IP Logger URL shortening service.
Microsoft recommends using web browsers that can filter and block malicious sites (fraud, cyberbullying, malware, and hosting) along with the use of strong, random passwords for local administrators.
Restricting administrator privileges to key users and avoiding service-wide accounts that have the same rights as an administrator are also on the list of measures that will reduce the impact of an attack.
To minimize the risk, Microsoft recommends blocking executable files that do not meet certain criteria, such as age or if they are not in a regularly maintained trusted list.
Blocking JavaScript and VBScript code from downloading executable content also adds important defenses.
