A sophisticated malware family has emerged onto the cyberthreat scene that might foreshadow ransomware attacks that are more successful than usual.
Marcus Hutchins and his colleagues at Expel that discovered it named the malware “SynkLoader,” since it throws so many ideas (“everything but the kitchen sink”) at trying to sneakily dig into corporate systems. It uses some conventional strategies — like executing code in-memory, running a scheduled task, etc. — but layers on a few interesting, novel tactics that make social engineering particularly compelling, and malware analysis especially frustrating.
The program is new, and how its creators intend to use it remains a mystery. But evidence in the code suggests that it might be the baby of a ransomware group or initial access broker (IAB), used to set the stage for follow-on ransomware.
Intro to the SynkLoader Malware
Synkloader’s compilation metadata suggests that it was probably first deployed on July 28. Researchers first discovered it in a client’s network on Aug. 18, Hutchins tells Dark Reading.
That incident began with a phishing email. Instead of typosquatting, or using some similarly cheap trick, the attackers registered their own Microsoft 365 tenant and reached out using an email address with Microsoft’s default onmicrosoft.com domain structure. The address identified itself as the victim’s IT Service Desk and asked that the victim install a fake Powershell system maintenance tool. Again the attackers leveraged Microsoft’s brand name, by hosting the malicious installer on an official Microsoft Azure storage page.
The SynkLoader installer comes with a cascade of malicious doodads: a Powershell script that executes its instructions in temporary memory, a minimalist Python environment, a malicious Python script that beacons back to the attacker’s command-and-control (C2) domains, and a couple handfuls of fake Microsoft runtime dynamic link libraries (DLLs).
All of this is strategic.
“Historically, not a lot of malware has been written in Python, so it reduces one of the endpoint detection and response (EDR) signals, which might raise suspicion if it were another language,” Hutchins explains. “But then a lot of the stuff they’re trying to do is not stuff Python can do, because it’s not a native Windows programming language. So then they’re bringing these weird components that use native DLLs — and they use C — and that’s enabling the malware to do some of the behaviors that just wouldn’t be possible in Python. That bridge creates a way to take malicious behavior but run it inside of a Python process.”
On the flip side, Python can also serve as a useful red flag for identifying SynkLoader attacks.
“When the user installs their own Python environment, it typically goes to either a fixed location or a subdirectory of whatever programming project they’re building,” Hutchins explains. “Whereas this just ships a random Python environment into a random folder and app data. Looking for an out of place Python executable is a pretty strong signal here.”
A Grab Bag of DLL Modules
First among the malware’s many DLL modules is a “system profiler,” which collects a variety of system data including running processes and services, the local user’s privileges, their Active Directory (AD) domain name, and how many other computers belong to their AD network. Worryingly, says Hutchins, “To measure the size of the victim’s network is typically something only of interest to ransom groups. Because an advanced persistent threat (APT) is already going to know about the organization they’re targeting. Whereas getting into a network and then being like: ‘How big, actually, is this network?’ is something that [opportunistic] ransomware actors will do.”
Besides the system profiler there’s also a persistence module, which establishes a recurring Windows task. But instead of doing it the conventional way — invoking the Task Scheduler via the command line — it directly engages the Windows Component Object Module (COM) interface. The point of this, almost certainly, is to avoid the kind of behavior that would get it flagged by an EDR program.
SynkLoader has a module that functions as a remote access Trojan (RAT), and another that streams the victim’s desktop and enables mouse and keyboard takeover. Yet another creates a reverse proxy, enabling them to leverage the victim computer’s IP address to route Internet traffic and reach internal services otherwise only accessible via the victim organization’s local area network (LAN).
The malware’s most unexpected doohickey, though, is probably “PhishLocker.”
Are Screen Lockers Fetch Again?
Back when malware used to be cuter, one thing attackers often did was lock their victims’ screens up. It was easy: Using simple Javascript, they’d trigger a Web browser to enter full screen mode and block the victim from escaping out of the window without entering some kind of credential or even a payment.
“That was one of the earliest forms of ransomware, where the page would make people pay to make this JavaScript nuisance leave them alone,” Hutchins explains. The same tactic was also used for phishing. “You could fullscreen the browser window, and then use HTML to build what looks like the Outlook client or something, and then you take the user’s password when they log in. It’s very similar to a standard phishing attack, except rather than phishing websites, you’re phishing application passwords by simulating fake applications.”
The nuisance was common enough that organizations eliminated the browser feature that enabled it. SynkLoader has figured out a way to bring screen-locking back, though. Instead of a browser, it uses a DLL. The DLL is simply an elaborate graphical user interface (GUI), designed to mimic a Windows lock screen. The lock screen is almost indistinguishable from the real thing, as shown in the side-by-side comparison below:
Source: Expel
Like those earlier screen lockers, the “PhishLocker” DLL prevents victims from exiting out of the screen until they provide their Windows account password. (Fortunately, to date, the malware has no check to determine the veracity of the supplied password.)
Hutchins thinks, “It does seem like quite an effective way to get the user’s system password, because unlike back in the day, when it was used for phishing, now you have like a lot of secure sign-on (SSO)-based networks, where your computer login password is the same password that you use to sign into every company asset. So that’s a very powerful way for a threat actor who wants to move laterally to get the credentials they need to do so.”
Comments are closed