Over 100 Forum Websites Foist Poorly Detected Malware

More than 100 Forums, Some of them Running on Outdated Versions of vBulletin or IP Board Software, Have been Compromised and Feature Malicious Code that Redirects to Malware which Evades Detection of Most Antivirus Programs. The Malicious Campaign, Discovered Recently by Security Researchers at Cyphort, was still Active on Wednesday and Caused Forum Visitors to be Redirected to a Landing Page Hosting Fiesta Exploit Kit (EK). One of the Affected Forums is DIY Chatroom, a Location Reached by over 8,000 Unique IP Addresses on a Daily Basis that Provides Discussions and Advice on Repair and Home Improvement Matters. The Payload Served is a New Variant of Gamarue, which is Known for Stealing Sensitive Information and Installing a Backdoor on the Compromised Systems.


At the Moment of the Discovery, the Threat Went Undetected by All Antivirus Engines Available on the VirusTotal Online Scanning Service, Cyphort Says. According to the Researchers, One of the Infection Chains Analyzed, Exploited 2 Vulnerabilities, an Old One in Internet Explorer (CVE-2013-2551) and a Newer One (CVE-2015-0313) in Adobe Flash Player v16.0.0.296 and Earlier. The Malware Dropper for Gamarue, Features Protection against Analysis and Doesn't Run if Virtual Environments Created by VirtualBox, VMware or Qemu are Detected. Once Gamarue is Executed on the Affected Machine, it Achieves Persistence by Creating an Autostart Entry in Windows Registry and Initiates a Routine to Disable Security Settings on the System.


Then, it Contacts a Command and Control (C&C) Server Located at “nindziaboy.net” and Awaits for Instructions (Report, Update and Start); All Communication is Carried Out in Encrypted Form, Cyphort Informs. Apart from Gamarue, the Dropper also Adds, 'FleerCivet', a Trojan Whose Purpose is Clickjacking. It Reaches its Goal by Launching Multiple Hidden Instances of Internet Explorer and Opening Certain Websites Where it Clicks on Advertisements. Both Gamarue and 'FleerCivet' are Part of the Main Dropper’s Resources but, a 3rd Malicious Component, Detected as Backdoor.Ruperk, is Added to the System. The Backdoor’s Capabilities include Delivery of System-Related Info (MachineGuid, Version of the Operating System and Name of the Display Device) to a C&C and Downloading Other Files.


Cyphort Researchers Believe that, the End Game of the Entire Watering-Hole Attack is Click Fraud, as the Visitors of the Infected Forums Seem to be Mainly Home Users. By Targeting this Type of Audience, the Operators Ensure that, the Clickjacking is Not Easily Discovered because, Clicks Appear to be Generated via Legitimate Actions. However, since Other Data Can be Downloaded to the Victim’s Machines, the Operators Can also Set Up a Botnet, which Can be Rented to Other Cybercriminals, or they Can Try to Funnel in Banking Trojans and Empty Users’ Accounts. As is Always the Case with Exploit Kits, One of the Best Defenses is to Have, All Browser Components Updated to their Latest Versions. Applied to this Attack, the Door into the System is Opened by Outdated Versions of Internet Explorer and Flash Player.