Business
Phishing uses Colonial Pipeline ransomware lures to infect victims
The recent ransomware attack on Colonial Pipeline inspired a threat actor to create a new phishing lure to trick victims into downloading malicious files.
The emails are targeted and tailored as urgent notifications to download and install a system update that would defend against the latest ransomware strains.
Well-crafted emails
Threat actors did not lose much time after the Colonial Pipeline incident and used it as a theme in a new phishing campaign deployed a couple of weeks later.
Researchers at cloud-based email security platform INKY analyzed the attack which attempted to compromise computer systems using the Cobalt Strike penetration testing tool.https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3622156405313063&output=html&h=280&slotname=368aed0.a0d1e8d&adk=4064049371&adf=3155453948&pi=t.ma~as.368aed0.a0d1e8d&w=336&lmt=1622832692&psa=1&format=336×280&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fphishing-uses-colonial-pipeline-ransomware-lures-to-infect-victims%2F&flash=0&wgl=1&adsid=ChEI8MHshQYQ5PCP54y7qNiNARI9AHrZIcfsNMmDtCI7ewf2pQu2ZxUdhzIoMJuPCTL57nGLI4lYvu7PKVuNsO3b8UByyNeVf1O6dl0PxeXwlg&uach=WyJXaW5kb3dzIiwiMTAuMCIsIng4NiIsIiIsIjkxLjAuNDQ3Mi43NyIsW11d&dt=1622904680022&bpp=3&bdt=29538&idt=3&shv=r20210601&cbv=%2Fr20110914&ptt=9&saldr=aa&abxe=1&cookie=ID%3De75da5bc4f111e72%3AT%3D1622904655%3AS%3DALNI_MYy3bakkfUupkz_Fy0dEiq4b-vXug&prev_fmts=0x0%2C300x250%2C1349x625&nras=2&correlator=1195415819049&frm=20&pv=1&ga_vid=1698274668.1606030711&ga_sid=1622904653&ga_hid=593573293&ga_fc=0&u_tz=330&u_his=1&u_java=0&u_h=768&u_w=1366&u_ah=728&u_aw=1366&u_cd=24&u_nplug=3&u_nmime=4&adx=90&ady=1963&biw=1349&bih=568&scr_x=0&scr_y=1733&eid=42530671%2C31060975&oid=3&psts=AGkb-H_s2TdDxiBUq-JlFZpnEVG9RiwnQ83eXQ3XhYOYQ3zs5hX-3EA7hIxDLSDHaSb4lJ1P7517FGV_VvTf&pvsid=1817966943680796&pem=736&ref=https%3A%2F%2Fwww.bleepingcomputer.com%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1366%2C0%2C1366%2C728%2C1366%2C568&vis=1&rsz=%7C%7CpoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=12&uci=a!c&fsb=1&xpc=cIeRU4yoJD&p=https%3A//www.bleepingcomputer.com&dtd=16
The fake emails use the Colonial Pipeline attack as an example of the devastating consequences a ransomware incident can have on an organization.
They urge recipients to install a system update from an external link to enable the system to “detect and prevent the latest strains of ransomware.” A deadline for applying the update is also provided, to increase urgency.
Cobalt Strike inside
The threat actor used domains that are easy to mistake for legitimate ones (ms-sysupdate[.]com and selectivepatch[.]com), registered towards the end of May through Namecheap.
INKY researchers note that the two domains were used for sending the malicious emails as well as for hosting the fake “ransomware update” executables.
Furthermore, in both cases the download pages were customized with the target company’s logo and imagery, to make them appear trustworthy.
INKY researchers say in a blog post today that the payload was Cobalt Strike, a threat emulation software developed for penetration testing purposes but often used by malicious actors, too, especially in the ransomware business.
To make matters worse, the source code for Cobalt Strike was leaked in late 2020, which made it accessible to a wider variety of adversaries. Fortunately, the payload used in this phishing campaign is detected by a large number of antivirus solutions.
Attackers in the phishing business are keeping an eye on the news to come up with relevant lures that would increase the success of their campaigns.
Typically, users are more receptive to messages containing familiar information. In this case, the highly publicized attack on Colonial Pipelines brought attention to the ransomware threat and its wider effect when hitting sensitive organizations.
“In this environment, phishers tried to exploit people’s anxiety, offering them a software update that would “fix” the problem via a highly targeted email that used design language that could plausibly be the recipient’s company’s own. All the recipient had to do was click the big blue button, and the malware would be injected” – INKY