Fileless DNS malware used in SEC

DNSMessenger, the new super-stealthy malware, is being sued in a spear phishing campaign targeting SEC filings at financial institutions.

DNSMessenger, the new super-stealthy malware that uses the internet’s address system as a command and control channel is being employed in a financial fraud spear-phishing campaign — targeting executives in large public companies involved with filings to the Securities and Exchange Commission.

Threat researchers at FireEye reported the SEC campaign this week, clearing up the mystery which had surrounded DNSMessenger since it was identified at the weekend by Cisco Talos: Who was it aimed at?

“We view this [attack] as one component of a very sophisticated, financially motivated cybercrime campaign” by an actor FireEye has dubbed Fin7, the company’s Threat Intelligence Manager John Miller told CyberScoop in an interview.

Spear phishing uses carefully crafted fake emails carrying malicious attachments or links — click and the malware is activated. In the case of the new Fin7 campaign, the emails appeared to come from the SEC’s online filing system EDGAR, and the attachment was a word document titled “Important changes to form 10K.”

A 10K is a form that public companies have to submit to the SEC every year, and the targets were people involved in their company’s filings — often meaning their email address was listed on public documents.

Miller said because FireEye’s security systems had thwarted the would-be attackers, there was no way of knowing for sure what they would have done, had they been able to seize control of the computers and accounts of the targeted executives.

But given the track record and the targets, he said it was “very possible that they were interested in securities fraud in some manner.”

FireEye said in its blog posting that the malware had been found attacking 11 companies in several sectors, but mostly financial.

Fin7 emerged several years ago as a threat group using advanced malware to steal credit card data from point-of-sale systems, Miller said. Since then, it has also been associated with the Carbanak malware, which targeted bank ATM systems.

He said they were a “medium-high” sophisticated threat actor, “Maybe around a seven,” on a 1-10 scale.

DNSMessenger is a highly stealthy malware. Rather than installing itself on the targeted computer’s hard drive, it pulls down commands using the domain name system, or DNS, the internet’s address protocol. This makes it very hard to detect, since most enterprises don’t filter or monitor their DNS traffic.

But, like all spear phishing, it initially relies on the user to click: In this case, the victim is asked to “enable content,” on the document when it is downloaded. That allows a Visual Basic script to run which begins the take-over process.

Miller said FireEye had seen no evidence of the multi-stage malware, which FireEye dubs “PowerSource” and “TextMate,” being used outside of the SEC campaign.

But Craig Williams, senior technical leader and global outreach manager of Cisco Talos, told CyberScoop his researchers had found samples with “different background images and different sender,” suggesting the malware was being sued ion other campaigns as well.

Williams said the data Cisco had was anonymized so it lacked contextual information about the targets, but they had seen enough variation in the lures and delivery strategy to make them believe DNSMessenger was “kit-based.”

“They’ve got a little production line going there,” he said, adding “It’s clearly very targeted, we don’t see much of it.”

Miller said that though the malware was fileless in the sense it did not install itself on the hard drive, it did leave “some traces or artifacts in the file system registry.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure