Forest Global Training Partners

Cyber Risks · Cisco Talos

Gozi ISFB Remains Active in 2018, Leverages "Dark Cloud" Botnet For Distribution

Summary: Cisco Talos reported that Gozi ISFB banking trojan campaigns ran through the fourth quarter of 2017 and into 2018, launching new campaigns every week via targeted spam emails with malicious Word attachments that use obfuscated VBA macros to download and execute the malware. Talos found the distribution and command-and-control infrastructure overlapped with the "Dark Cloud" botnet, which uses fast flux with DNS record TTLs typically set to 150, allowing record updates every three minutes.

What's compelling: Talos analyzed more than 100 malicious Word documents in these campaigns and found the vast majority were individualized, with different hashes and altered VBA code, so signature-based detection of the attachment alone will not hold. The same Dark Cloud infrastructure also carried Nymaim command and control, carding resources, and spam, meaning one blocked domain rarely closes off the operation.

Read the original at Cisco Talos ↗

Topics
Malware
Related