45
"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.
The Blank Slate campaign sends empty emails containing double-zipped archives with macro-enabled Word documents or JavaScript files that launch PowerShell to download ransomware, primarily Cerber, and occasionally Sage 2.0 or Locky. Unit 42 observed 555 campaign domains over seven months, with actors repeatedly registering new domains and cycling abuse of legitimate hosting providers after takedowns. In a five-day January-February 2017 window, at least eight domains across seven IP addresses were observed hosting Cerber payloads.
26
45
Trends in Web Threats: Old Web Skimmer Still Active Today
Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.
Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.
27
45
30
30
Automatically Detecting DNS Hijacking in Passive DNS
Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.
Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.
45
30
30
30
30
30
45
Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.
A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.
33
30
30
45
30
45
30
Malspam Targeting Brazil Continues to Evolve
Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.
A June 2017 Brazilian malspam campaign spoofed IPTU tax notification emails, using the recipient's address as the sender, and abused Google's URL shortener and Dropbox to deliver a zip containing a malicious Windows shortcut (.lnk) file. The LNK used the Squiblydoo technique (regsvr32.exe) to download and execute a scriptlet with elevated privileges, retrieving a signed G-Buster Browser Defense executable alongside a malicious fltLib.dll loaded via side-loading, likely an information-stealing botnet. Post-infection HTTP traffic exposed over 400 infected Windows hosts, mostly in Brazil, with 2,132 Banload-tagged samples observed in the first half of 2017.
20
30
30
45
30
30
30
30
30
30
45
30
35
30
45
30
30
30
45