{"id":23838,"date":"2024-01-31T13:10:43","date_gmt":"2024-01-31T21:10:43","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2024\/01\/31\/news-17568\/"},"modified":"2024-01-31T13:10:43","modified_gmt":"2024-01-31T21:10:43","slug":"news-17568","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2024\/01\/31\/news-17568\/","title":{"rendered":"Nitrogen shelling malware from hacked sites"},"content":{"rendered":"\n

Nitrogen<\/a> is the name given to a campaign and associated malware that have been distributed via malicious search ads. Its signature move is using Python and DLL side-loading to connect to the attacker’s command and control server.<\/p>\n

In this blog post, we look at a recent Nitrogen campaign and specifically at how the initial payload is being served onto victims. The threat actors seem to have a preference for hosting their payloads on compromised WordPress sites, many of which are already hacked with malicious PHP shell scripts.<\/p>\n

We also review the connection between malvertising and ransomware in the context of increased web-based attacks.<\/p>\n

Malicious ads<\/h2>\n

The ads are displayed via Google searches for popular search terms related to programs used by IT and system administrators. The ads are attached to domain names that have a previous history but expired, which allowed the threat actors to register them and bypass certain security checks that involve looking at the age of a domain name.<\/p>\n

\"\"
Malicious ad<\/figcaption><\/figure>\n

The first step upon clicking on the ad consists of filtering visitors. If it doesn’t like your IP address or other client-side setting, it will display a fake page. The content looks like it was generated via Chat-GPT or some other LLM.<\/p>\n

\"\"
Decoy website<\/figcaption><\/figure>\n

Real victims will instead be served a 302 redirect to a decoy site at windirsstat[.]net:<\/p>\n

\"\"
Malicious redirect<\/figcaption><\/figure>\n

The page is designed to look identical to the real website except for the download link which points somewhere else.<\/p>\n

\"\"
Fake WinDirStat website<\/figcaption><\/figure>\n

Compromised sites<\/h2>\n

The threat actor is using a number of hacked sites to host their malicious payloads which they regularly rotate through. This is not a new technique, but it is yet odd to see the fake installers cohabit with various web shells.<\/p>\n

In fact, anyone could easily change the files or even delete them. Here, we’re simply observers and looking at the file managers that are open on the internet.<\/p>\n

\"\"
403WebShell<\/figcaption><\/figure>\n
\"\"
Nega1ve Shell<\/figcaption><\/figure>\n
\"\"
WSOX Shell<\/figcaption><\/figure>\n

Payload<\/h2>\n

Nitrogen uses DLL side-loading via a signed executable to launch its payload:<\/p>\n

\"\"
Side-loading a malicious DLL<\/figcaption><\/figure>\n

It then proceeds with running Python from a newly created folder under %appdata%:<\/p>\n

\"\"
Python running a malicious file<\/figcaption><\/figure>\n

The Python file it executes is heavily obfuscated:<\/p>\n

\"\"
Obfuscated Python file<\/figcaption><\/figure>\n

ThreatDown<\/a> will detect this malicious activity and quarantine the malicious Python file:<\/p>\n

\"\"
ThreatDown detecting and blocking the malicious Python file<\/figcaption><\/figure>\n

Blocking the payload at this step is crucial as it is the point where it will otherwise contact its command and control server (C2):<\/p>\n

\"\"
Network traffic between victim and C2<\/figcaption><\/figure>\n

In recent Zip installers for Nitrogen, we noticed two files likely related to their control panel. It’s worth noting that one of them is in Ukrainian language:<\/p>\n

\"\"
Panel template files<\/figcaption><\/figure>\n

Victims are added to the attackers’ control panel for further processing. The threat actors will need to cleanup their database to remove uninteresting entries such as those generated by malware sandboxes and researchers. The remaining victim can then be divided into a team of specialists that will use post exploitation tools to further gather information and compromise the network, before launching additional payloads.<\/p>\n

Protecting networks from malicious ads<\/h2>\n

What makes Nitrogen a serious threat for businesses is its known connection with ransomware<\/a>. The threat actors who gain access to a compromised machine deploy adversary emulation framework tools such as Sliver<\/a> before dropping ransomware, namely ALPHV\/BlackCat<\/a>.<\/p>\n

Many businesses are not adequately protected when it comes to malicious ads. This is typically reflected in the tools and security software installed on endpoints, which will often focus on spam and phishing emails.<\/p>\n

Threat actors are well aware of this, and they have been using online ads as a delivery vector for malware heavily since late 2022. Based on our own stats from tracked incidents, we have been seeing a rise in reported incidents since summer 2023.<\/p>\n

\"\"<\/figure>\n

ThreatDown<\/a> protects your networks thanks to its web-based and malware blocking features. Being able to block the infrastructure used by criminals to funnel traffic from ads is critical to avoid malware even landing on endpoints.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Threat actors are using all the tools at their disposal to deliver malware. Malicious ads are only one step in the chain, with compromised sites providing the free hosting and changing capabilities that can evade detection. <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[10531,29862,12040],"class_list":["post-23838","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-malvertising","tag-nitrogen","tag-threat-intelligence"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/23838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=23838"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/23838\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=23838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=23838"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=23838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}