An international law enforcement operation disrupted a key cog in the cybercrime ecosystem and put a spotlight on the risks to enterprises posed by traffic distribution systems (TDSs).
In the latest installment of the ongoing Operation Endgame, authorities seized 106 servers and many domains tied to SocGholish, a notorious malware framework that has plagued the Internet for nearly a decade as an initial-access broker for ransomware and other threats. The law-enforcement operation also remediated 14,971 websites, primarily hosted on WordPress, that had been compromised by SocGholish operators.
According to the Netherlands’ National Police Corps, SocGholish is “a key infection chain” used by many cybercriminal gangs, most notably the Russian ransomware gang Evil Corp. The multistage JavaScript malware is injected through compromised websites and appear as fake browser updates.
“The malware establishes an initial foothold into victim computers, collectively known as a botnet, and is then used by threat actors for further targeting with ransomware campaigns and espionage,” the FBI Cyber Division said on Thursday in a post on X.
The law-enforcement action also highlights the often-overlooked risks from TDSs. In an accompanying public service announcement, the FBI Cyber Division warned of cybercriminal use of TDSs, which play an integral role in the SocGholish infection chain by feeding unsuspecting Web users to the framework. “Cybercriminals use TDSs to selectively redirect users to compromised or fake login websites that can host phishing pages for online financial fraud or prompt users to download software updates containing malware,” said the FBI Cyber Division.
According to an Infoblox blog post on SocGholish last week, the framework casts a wide net across enterprises and public sectors. While it’s not a “niche threat” focused on a particular vertical industry, the research team found that almost every vertical has had at least one SocGholish domain query — meaning an enterprise user searched for a domain that was controlled by threat actors — over the past five months, with the government, education, banking, healthcare, and non-IT services sectors having the most activity.
How the SocGholish Framework Uses TDSs
SocGholish operators, which are tracked as TA569, have for years used a deceptively simple but effective formula to facilitate cyberattacks. The chain begins with compromising legitimate websites, often hosted on WordPress, through password-spraying attacks or leaked credentials (during the latest Operation Endgame action, authorities found 1.4 million leaked WordPress credentials, according to the Dutch National Police).
From there, TDSs are used to redirect unsuspecting visitors from their intended destinations to the fake browser updates. TDSs, according to the FBI, are used to route Internet users to new destinations after they click advertisement links, sign up for a promotion, or download an application. However, threat actors often abuse these legitimate, commercial TDSs, and even operate their own underground versions, to hijack traffic and redirect it to malicious destinations.
In the case of SocGholish, “affiliates” use the TDSs to drive a steady stream of victims to the malware framework, according to Infoblox.
“It’s a classic commercial relationship: when a user visits the site, the affiliate typically fingerprints them and then passes potential victims to SocGholish through an embedded link,” the blog post said. “In return, the affiliate will be paid for these ‘leads.'”
TA569 uses ParrotTDS and JunkyTDS, among other underground tools, according to Infoblox. Affiliate threat actors have also used Keitaro, a commercial TDS frequently abused by cybercriminals, to drive traffic to SocGholish (Keitaro and parent company Apliteni recently cooperated with researchers at Infolox to disrupt abuse of their platform).
When users click on the fake updates, they deliver a JavaScript file that acts as a stager for future malware deployments. The TDSs provide additional benefits to SocGholish because along with appearing as legitimate advertising technology platforms, they allow threat actors to filter out undesired traffic (including bots, honeypots, researchers, etc.) and fingerprint users’ systems.
For example, Infoblox noted domain-joined systems are valuable to SocGholish because they are likely connected to enterprise identity and management (IAM) environments, which contain valuable log-in information for users.
“Since SocGholish’s primary purpose is to obtain and sell initial access to corporate environments, those systems are more likely to receive follow-on tooling intended to support deeper intrusion activity, data theft, or ransomware deployment,” the report stated. “Lower-value systems, by contrast, such as devices that are not joined to a corporate domain, are commonly monetized through off-the-shelf infostealer malware.”
SocGholish Threats to Enterprises
Renée Burton, vice president of threat intel at Infoblox, tells Dark Reading that Operation Endgame’s seizures included domains for the malicious TDSs, which disrupts a key portion of the SocGholish infection chain. Infoblox said it expects activity to decline in the coming weeks as the disruption to TA569’s infrastructure likely hurt “its reputation as a reliable initial-access provider.”
“As our own analysis shows, nearly 55% of the customer networks in our dataset attempted to reach SocGholish infrastructure during a five-month period,” according to the Infoblox posting. “While the overwhelming majority of those attempts did not progress to an active device compromise, we still identified a small number of customer networks potentially impacted by on-device execution of a SocGholish payload.”
In the meantime, the FBI urged enterprise organizations to take precautions against malicious TDSs, including changing default file associations for JavaScript so that attacks can’t execute malicious payloads delivered through a TDS; monitoring endpoints for suspicious execution of files and PowerShell scripts; keeping content management systems (CMS) and third-party components up to date; and frequently auditing CMS administrator accounts, as well as database, file transfer protocol (FTP) and Web-hosting accounts.
No responses yet