Phishing focusing on Polish SMBs continues by way of ModiLoader

ESET Analysis

ESET researchers detected a number of, widespread phishing campaigns focusing on SMBs in Poland throughout Could 2024, distributing varied malware households

30 Jul 2024
 • 
,
8 min. learn

Only a few months again, ESET Analysis printed a blogpost about large phishing campaigns throughout Central and Jap Europe carried out through the second half of 2023. In these campaigns Rescoms malware (often known as Remcos), protected by AceCryptor, was delivered to potential victims with the targets of credential theft and potential acquire of preliminary entry to firm networks.

Phishing campaigns focusing on the area didn’t cease in 2024. On this blogpost we current what latest phishing campaigns appeared like and the way the selection of supply mechanism shifted away from AceCryptor to ModiLoader.

Key factors of this blogpost:

• ESET detected 9 notable ModiLoader phishing campaigns throughout Could 2024 in Poland, Romania, and Italy.
• These campaigns focused small and medium-sized companies.
• Seven of the campaigns focused Poland, the place ESET merchandise protected over 21,000 customers.
• Attackers deployed three malware households by way of ModiLoader: Rescoms, Agent Tesla, and Formbook.
• Attackers used beforehand compromised e-mail accounts and firm servers, not solely to unfold malicious emails but in addition to host malware and accumulate stolen knowledge.

Overview

Regardless that the phishing campaigns have been ongoing all through the primary half of 2024, this blogpost focuses simply on Could 2024, as this was an eventful month. Throughout this era, ESET merchandise protected over 26,000 customers, over 21,000 (80%) of whom had been in Poland. Along with Poland, the place over 80% of potential victims had been situated, Italy and Romania had been additionally focused by the phishing campaigns. In complete we registered 9 phishing campaigns, seven of which focused Poland all through Could, as could be seen in Determine 1.

Compared with the campaigns that passed off through the finish of 2023, we see a shift away from utilizing AceCryptor as a device of selection to guard and efficiently ship the malware. As an alternative, in all 9 campaigns, attackers used ModiLoader (aka DBatLoader) as the popular supply device of selection. The ultimate payload to be delivered and launched on the compromised machines diverse; we’ve detected campaigns delivering:

• Formbook – info stealing malware found in 2016,
• Agent Tesla – a distant entry trojan and knowledge stealer, and
• Rescoms RAT – distant management and surveillance software program, in a position to steal delicate info.

Campaigns

On the whole, all campaigns adopted an identical situation. The focused firm obtained an e-mail message with a enterprise supply that might be so simple as “Please present your greatest value supply for the hooked up order no. 2405073”, as could be seen in Determine 2.

In different campaigns, e-mail messages had been extra verbose, such because the phishing e-mail in Determine 3, which could be translated as follows:

Hello,

We want to buy your product for our consumer.

Please discover the hooked up inquiry for step one of this buy.

The hooked up sheet comprises goal costs for many merchandise. I highlighted 10 components to concentrate on pricing – the remainder of the gadgets are elective to cost (we are going to apply related value degree primarily based on different costs).

Please get again to me earlier than 28/05/2024

In the event you want extra time, please let me know the way a lot you will want.

When you’ve got any questions, please additionally let me know.

As within the phishing campaigns of H2 2023, attackers impersonated current firms and their staff because the strategy of selection to extend marketing campaign success fee. On this approach, even when the potential sufferer appeared for the same old pink flags (apart from potential translation errors), they had been simply not there, and the e-mail appeared as reputable because it may have.

Contained in the attachments

Emails from all campaigns contained a malicious attachment that the potential sufferer was incentivized to open, primarily based on the textual content of the e-mail. These attachments had names like RFQ8219000045320004.tar (as in Request for Citation) or ZAMÓWIENIE_NR.2405073.IMG (translation: ORDER_NO) and the file itself was both an ISO file or archive.

In campaigns the place an ISO file was despatched as an attachment, the content material was the ModiLoader executable (named equally or the identical because the ISO file itself) that might be launched if a sufferer tried to open the executable.

Within the different case, when a RAR archive was despatched as an attachment, the content material was a closely obfuscated batch script, with the identical title because the archive and with the .cmd file extension. This file additionally contained a base64-encoded ModiLoader executable, disguised as a PEM-encoded certificates revocation record. The script is accountable for decoding and launching the embedded ModiLoader (Determine 4).

When ModiLoader is launched

ModiLoader is a Delphi downloader with a easy process – to obtain and launch malware. In two of the campaigns, ModiLoader samples had been configured to obtain the next-stage malware from a compromised server belonging to a Hungarian firm. In the remainder of the campaigns ModiLoader downloaded the following stage from Microsoft’s OneDrive cloud storage. We noticed 4 accounts the place second-stage malware was hosted. The entire chain of compromise from receiving the malicious e-mail till launching the ultimate payload is summarized in Determine 5.

Knowledge exfiltration

Three completely different malware households had been used as a closing payload: Agent Tesla, Rescoms, and Formbook. All these households are able to info stealing and thus enable attackers not solely to increase their datasets of stolen info, but in addition to organize the bottom for his or her subsequent campaigns. Regardless that the exfiltration mechanisms differ between malware households and campaigns, it’s price mentioning two examples of those mechanisms.

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Analysis provides personal APT intelligence studies and knowledge feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

A complete record of indicators of compromise (IoCs) could be present in our GitHub repository.

Recordsdata

MITRE ATT&CK strategies

This desk was constructed utilizing model 15 of the MITRE ATT&CK framework.