Blog
/

Email

/
August 2, 2024

The Rise in “Safelink Smuggling”: How to Enhance Your Resilience Against Malicious Links

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
02
Aug 2024
Safelink Smuggling is not necessarily a new phenomenon, but Darktrace analysts have seen a notable increase recently. Read this blog to learn how threat actors are deploying this technique in email attacks, how vendors can mitigate Safelink Smuggling attempts, and why defense-in-depth is the solution.

Darktrace security members and researchers have recently seen a rise in what we are calling Safelink Smuggling. Safelinks are URLs rewritten by security solutions to enable additional analysis when the URL is clicked. Once analyzed, they may prompt a user, redirect the browser back to the original URL, or block further access if deemed necessary.

What is Safelink Smuggling?

Safelink Smuggling is a technique that involves an attacker purposely getting their malicious payload rewritten by a security solution’s Safelink capability to then propagate the rewritten URL to others. This technique is a way for attackers to not only avoid detection by traditional email security and other solutions, but also to instill mistrust in all email security solutions. As a result, Safelinks from a range of popular email security providers are often seen in phishing or supply chain attacks. In fact, Darktrace has observed over 300,000 cases of Safelinks being included in unexpected and suspicious contexts over the last 3 months.

How does Safelink Smuggling work?

Safelink Smuggling has two key stages: Getting a malicious link rewritten by an email security solution, then propagating that rewritten link to other victims.

Step one:

Obfuscated a malicious payload through a Safelink capability rewriting the link; Darktrace has seen this attempted through two methods – Compromised Account or Reply-Chain.

  • Method 1: Compromised Account

If an attacker can gain access to a compromised account – whether that’s through brute force, malware or credential theft – they can infiltrate it with malicious links, and then exfiltrate the Safelinks created as the email passes through security filtering. In other words, attackers will send a malicious payload to the compromised inbox, with the intent that the malicious URL gets rewritten. Unlike a normal phishing email where the threat actor wants to avoid having their email blocked, in this case the objective is for the email to get through to the inbox with the link rewritten. As observed by Darktrace, attackers often send the link in isolation as any additional components (i.e., body text or other content in the email) could cause a more severe action such as the email security solution holding the message.

  • Method 2: Reply-Chain

With this method, the attacker sends a malicious link to an email security vendor’s customer in an attempt to solicit a reply from an internal user. This allows them to grab the re-written URL within the reply chain. However, this is a risky tactic which can fail at several points. The attacker has to be confident the initial email won't be blocked outright; they also risk alerting security vendors to the address and the URL intended to be used for the main campaign. They also must be confident that the checks made when the re-written URL is clicked will not lead to a block at the final destination.
Regardless of the method used, the end result will appear as follows:

For example, the original malicious URL may look like this,

faceldu[.]org/Invoice112.zip

(negative surface indicators: recently registered domain, file extension)

And after being rewritten,

securityvevndor[.]com/safe?q=aNDF80dfaAkAH930adbd

(positive surface indicators: established domain, positive reputation, associated with safe content)

Step Two:

Now that the attacker has access to a malicious URL that has been obfuscated by a safe rewrite, attackers can forward or craft an email leveraging that same link. In fact, we have even seen multiple layers of Safelink Smuggling being used to mask a payload further.

The Challenge of Link Rewriting

Traditional email security solutions rewrite all links sent to an organization, but there is an inherent risk to this methodology. Rewriting every link, whether harmless or harmful, leads employees to lose context and creates a false sense of security when interacting with rewritten links in emails. Furthermore, it provides attackers with many opportunities to exploit Safelinks. As demonstrated in Method 2 above, if an email security solution does not rewrite every link, executing such attacks would be significantly more challenging.

Traditionally, rewriting every link made sense from a security perspective, as it allowed servers to thoroughly analyze links for known attack patterns and signatures. However, this approach relies on identifying previously recognized threats. Conversely, Darktrace / EMAIL gathers sufficient information about a link without needing to rewrite it, by analyzing the context and content of the email and the link itself.

In fact, Darktrace is the pioneer in applying selective rewriting to URLs based on suspicious properties or context, a method that other solutions have since adopted. While traditional solutions rewrite links to assess them only after they are clicked, Darktrace / EMAIL takes immediate action to neutralize threats before they reach the inbox.

Darktrace achieves high success rates in detecting malicious links and emails on the first encounter using Self-Learning AI. By understanding 'normal' behavior in email communications, Darktrace identifies subtle deviations indicative of cyber threats and selectively rewrites only those links deemed suspicious, ensuring a targeted, proportionate, and non-disruptive response.

Why do traditional email security solutions miss Safelink attacks?

Traditional security solutions that focus on learning attack patterns will miss Safelink threats as they are often utilized in attacks that have a variety of layers which help the email seem legitimate. Leveraging all the classic techniques seen in a supply chain attack to disguise the sender's intent, taking advantage of the users' inherent trust in familiar sources, the user is more likely to lower their defenses.

For more information: https://darktrace.com/products/email/use-cases/supply-chain-attack

In terms of the URL, if the payload is malicious, why is it difficult for email security solutions to catch it? Primarily, other security vendors will focus on the payload in isolation, attempting to find known attack patterns or signatures such as a domain name or IP with a bad reputation. Unfortunately, with this technique, if the URL has a legitimate domain, it will return a clean track record. Common obfuscation techniques such as captchas, short-links, and click throughs can all be deployed to add layers of complexity to the analysis.

Safelink Smuggling relies heavily on link redirects, which means that web analysis tools will falter as they will only analyze the first redirect. Consequently, when more in-depth analysis on the link itself is performed, the first place the URL takes the user is not the malicious site but rather the default on-click analysis of the vendor in question. Therefore, any traditional browser or link analysis will also return a negative result.

Finally, the context itself is important. In contrast to traditional email security solutions, Darktrace / EMAIL asks who, what, when, where, and why for every single email, and compares it to the pattern of life of both the internal recipient and the external sender, rather than attempting to match patterns with historical threat data. When analyzing an email from an inbound perspective, Darktrace reveals potential deviations from normal, that, when considered sufficiently anomalous, will result in taking a proportional action to the threat assessed.

To illustrate the above, let’s take a look at an example email that Darktrace recently caught.

The following is an email a Darktrace customer received, which Darktrace / EMAIL held before it reached the inbox. In this case, the smuggled Safelink was further obfuscated behind a QR Code. The accompanying document also presented some anomalies in terms of its intent, perceived as a potential social engineering attempt. Finally, the lack of association and low mailing history meant there was no prior context for this email.  

Example of a Safelink Smuggling attack using a popular email security solution’s safelink.
Fig 1: Example of a Safelink Smuggling attack using a popular email security solution’s safelink.

How to mitigate against Safelink Smuggling?

It's difficult for email security vendors to do anything about their links being reused, and reuse should almost be expected by popular operators in the email security space. Therefore, the presence of links from a vendor’s domain in a suspicious email communication rarely indicates a compromise of the link rewrite infrastructure or a compromise of the third-party vendor.

Email security vendors can improve their defense-in-depth, especially around their email provider accounts to avoid Method 1 (Compromised Account attacks) and become more selective with their rewrites to curtail Method 2 (Reply Chain attacks).

Primary protection against Safelink Smuggling should be offered by the email security vendor responsible for inbound email analysis. They need to ensure that techniques such as Safelink Smuggling are not evaded by their detection mechanisms.

Darktrace has long been working on the betterment of security within the email community and innovating our link analysis infrastructure to mitigate against this attack methodology (read more about our major update in 6.2 here), regardless of whether the receiving organization are Darktrace customers.

How does Darktrace deal with Safelink Smuggling today?

Darktrace has been dealing with Safelink Smuggling since launch and has a standardized recommendation for customers who are looking to defend against this threat.

Customers want to avoid being 1) the propagators of this threat and potentially damaging their brand reputation, and 2) being victims of the supply chain attack thereafter.

The principal recommendation to protect customer accounts and consequently their brands is to ensure defense-in-depth. As accounts establish themselves as the crown jewels of any modern enterprise, organizations should vigilantly monitor their account activity with the same rigor they would analyze their network activity. Whether that is through the base account takeover protection offered by Darktrace / EMAIL, or the expanded defense offered by Darktrace / IDENTITY, it is crucial that the accounts themselves have a robust security solution in place.

Secondly, to avoid falling victim to the supply chain attack that leverages a third-party vendor’s link rewrite, it is imperative to use a solution that does not rely on static threat intelligence and link reputation analysis. Rather than chasing attackers by updating rules and signatures, Darktrace leverages Self-Learning AI to learn the communication patterns of both internal and external messages to reveal deviations in both content and context.

Finally, for those customers that already leverage Darktrace / EMAIL we recommend ensuring that lock links are enabled, and that the default warning page is displayed every time a link is rewritten, no matter the perceived severity of the link. This will allow any potential user that clicks on a rewritten Darktrace / EMAIL link to be alerted to the potential nature of the site they are trying to access.

Safelink smuggling example caught by Darktrace

While most cases involve other vendors, analysts recently saw a case where Darktrace's own links were used in this type of attack. A small number of links were leveraged in a campaign targeting both Darktrace and non-Darktrace customers alike. Thankfully, these attempts were all appropriately actioned by those customers that had Darktrace / EMAIL deployed.

In the example below, you will see how Darktrace Cyber AI Analyst describes the example at hand under the Anomaly Indicators section.

Example of Safelink Smuggling attack on Darktrace using the Darktrace Safelink Infrastructure.
Fig 2: Example of Safelink Smuggling attack on Darktrace using the Darktrace Safelink Infrastructure.

First, the display name mismatch can be interpreted as an indicator of social engineering, attempting to deceive the recipient with an IT policy change.

Second, the link itself, which in this case is a hidden redirect to an unusual host for this environment.

Finally, there is a suspected account takeover due to the origin of the email being a long-standing, validated domain that contains a wide variety of suspicious elements.

Darktrace / EMAIL would have held this email from being delivered.

Conclusion

By investigating Safelink Smuggling, Darktrace wants to shine a light on the technique for security teams and help raise awareness of how it can be used to dupe users into lowering their defenses. Challenge your email security vendor on how it deals with link analysis, particularly from trusted senders and applications.

Interested in Darktrace’s approach to defense-in-depth? Check out Darktrace / EMAIL

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Carlos Gray
Product Manager

Carlos Gonzalez Gray is a Product Marketing Manager at Darktrace, based in the Madrid Office. As an email security Subject Matter Expert he collaborates with the global product team to align each product with the company’s ethos and ensures Darktrace are continuously pushing the boundaries of innovation. His prior role at Darktrace was in Sales Engineering, leading the Iberian team and specializing in both the email and OT sectors. Additionally, his prior experience as a consultant to IBEX 35 companies in Spain has made him well-versed in compliance, auditing, and data privacy. Carlos holds an Honors BA in Political Science and a Masters in Cybersecurity from IE University.

Stephen Pickman
Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

October 15, 2024

/
No items found.

Navigating buying and adoption journeys for AI cybersecurity tools

Default blog imageDefault blog image

Enterprise AI tools go mainstream

In this dawning Age of AI, CISOs are increasingly exploring investments in AI security tools to enhance their organizations’ capabilities. AI can help achieve productivity gains by saving time and resources, mining intelligence and insights from valuable data, and increasing knowledge sharing and collaboration.  

While investing in AI can bring immense benefits to your organization, first-time buyers of AI cybersecurity solutions may not know where to start. They will have to determine the type of tool they want, know the options available, and evaluate vendors. Research and understanding are critical to ensure purchases are worth the investment.  

Challenges of a muddied marketplace

Key challenges in AI purchasing come from consumer doubt and lack of vendor transparency. The AI software market is buzzing with hype and flashy promises, which are not necessarily going to be realized immediately. This has fostered uncertainty among potential buyers, especially in the AI cybersecurity space.  

As Gartner writes, “There is a general lack of transparency and understanding about how AI-enhanced security solutions leverage AI and the effectiveness of those solutions within real-world SecOps. This leads to trust issues among security leaders and practitioners, resulting in slower adoption of AI features” [1].  

Similarly, only 26% of security professionals report a full understanding of the different types of AI in use within security products.

Given this widespread uncertainty generated through vague hype, buyers must take extra care when considering new AI tools to adopt.  

Goals of AI adoption

Buyers should always start their journeys with objectives in mind, and a universal goal is to achieve return on investment. When organizations adopt AI, there are key aspects that will signal strong payoff. These include:  

  • Wide-ranging application across operations and areas of the business
  • Actual, enthusiastic adoption and application by the human security team  
  • Integration with the rest of the security stack and existing workflows
  • Business and operational benefits, including but not limited to:  
  • Reduced risk
  • Reduced time to response
  • Reduced potential downtime, damage, and disruption
  • Increased visibility and coverage
  • Improved SecOps workflows
  • Decreased burden on teams so they can take on more strategic tasks  

Ideally, most or all these measurements will be fulfilled. It is not enough for AI tools to benefit productivity and workflows in theory, but they must be practically implemented to provide return on investment.  

Investigation before investment

Before investing in AI tools, buyers should ask questions pertaining to each stage of the adoption journey. The answers to these questions will not only help buyers gauge if a tool could be worth the investment, but also plan how the new tool will practically fit into the organization’s existing technology and workflows.  

Figure 1: Initial questions to consider when starting to shop for AI [2].

These questions are good to imagine how a tool will fit into your organization and determine if a vendor is worth further evaluation. Once you decide a tool has potential use and feasibility in your organization, it is time to dive deeper and learn more.  

Ask vendors specific questions about their technology. This information will most likely not be on their websites, and since it involves intellectual property, it may require an NDA.  

Find a longer list of questions to ask vendors and what to look for in their responses in the white paper “CISO’s Guide to Buying AI.”

Committing to transparency amidst the AI hype

For security teams to make the most out of new AI tools, they must trust the AI. Especially in an AI marketplace full of hype and obfuscation, transparency should be baked into both the descriptions of the AI tool and the tool’s functionality itself. With that in mind, here are some specifics about what techniques make up Darktrace’s AI.  

Darktrace as an AI cybersecurity vendor

Darktrace has been using AI technology in cybersecurity for over 10 years. As a pioneer in the space, we have made innovation part of our process.  

The Darktrace ActiveAI Security Platform™ uses multi-layered AI that trains on your unique business operations data for tailored security across the enterprise. This approach ensures that the strengths of one AI technique make up for the shortcomings of another, providing well-rounded and reliable coverage. Our models are always on and always learning, allowing your team to stop attacks in real time.  

The machine learning techniques used in our solution include:

  • Unsupervised machine learning
  • Multiple Clustering Techniques
  • Multiple anomaly detection models in tandem analyzing data across hundreds of metrics
  • Bayesian probabilistic methods
  • Bayesian metaclassifier for autonomous fine-tuning of unsupervised machine learning models
  • Deep learning engines
  • Graph theory
  • Applied supervised machine learning for investigative AI  
  • Neural networks
  • Reinforcement Learning
  • Generative and applied AI
  • Natural Language Processing (NLP) and Large Language Models (LLMs)
  • Post-processing models

Additionally, since Darktrace focuses on using the customer’s data across its entire digital estate, it brings a range of advantages in data privacy, interpretability, and data transfer costs.  

Building trust with Darktrace AI

Darktrace further supports the human security team’s adoption of our technology by building trust. To do that, we designed our platform to give your team visibility and control over the AI.  

Instead of functioning as a black box, our products focus on interpretability and sharing confidence levels. This includes specifying the threshold of what triggered a certain alert and the details of the AI Analyst’s investigations to see how it reached its conclusions. The interpretability of our AI uplevels and upskills the human security team with more information to drive investigations and remediation actions.  

For complete control, the human security team can modify all the detection and response thresholds for our model alerts to customize them to fit specific business preferences.  

Conclusion

CISO’s are increasingly considering investing in AI cybersecurity tools, but in this rapidly growing field, it’s not always clear what to look for.  

Buyers should first determine their goals for a new AI tool, then research possible vendors by reviewing validation and asking deeper questions. This will reveal if a tool is a good match for the organization to move forward with investment and adoption.  

As leaders in the AI cybersecurity industry, Darktrace is always ready to help you on your AI journey.  

Learn more about the most common types of machine learning in cybersecurity in the white paper “CISO’s Guide to Buying AI.”

References

  1. Gartner, April 17, 2024, “Emerging Tech: Navigating the Impact of AI on SecOps Solution Development.”  
  1. Inspired by Gartner, May 14, 2024, “Presentation Slides: AI Survey Reveals AI Security and Privacy Leads to Improved ROI” and NHS England, September, 18, 2020, “A Buyer’s Guide to AI in Health and Care,” Available at: https://transform.england.nhs.uk/ai-lab/explore-all-resources/adopt-ai/a-buyers-guide-to-ai-in-health-and-care/  
Continue reading
About the author
Nicole Carignan
VP of Strategic Cyber AI

Blog

/

October 16, 2024

/

Inside the SOC

Triaging Triada: Understanding an Advanced Mobile Trojan and How it Targets Communication and Banking Applications

Default blog imageDefault blog image

The rise of android malware

Recently, there has been a significant increase in malware strains targeting mobile devices, with a growing number of Android-based malware families, such as banking trojans, which aim to steal sensitive banking information from organizations and individuals worldwide.

These malware families attempt to access users’ accounts to steal online banking credentials and cookies, bypass multi-factor authentication (MFA), and conduct automatic transactions to steal funds [1]. They often masquerade as legitimate software or communications from social media platforms to compromise devices. Once installed, they use tactics such as keylogging, dumping cached credentials, and searching the file system for stored passwords to steal credentials, take over accounts, and potentially perform identity theft [1].

One recent example is the Antidot Trojan, which infects devices by disguising itself as an update page for Google Play. It establishes a command-and-control (C2) channel with a server, allowing malicious actors to execute commands and collect sensitive data [2].

Despite these malware’s ability to evade detection by standard security software, for example, by changing their code [3], Darktrace recently detected another Android malware family, Triada, communicating with a C2 server and exfiltrating data.

Triada: Background and tactics

First surfacing in 2016, Triada is a modular mobile trojan known to target banking and financial applications, as well as popular communication applications like WhatsApp, Facebook, and Google Mail [4]. It has been deployed as a backdoor on devices such as CTV boxes, smartphones, and tablets during the supply chain process [5]. Triada can also be delivered via drive-by downloads, phishing campaigns, smaller trojans like Leech, Ztorg, and Gopro, or more recently, as a malicious module in applications such as unofficial versions of WhatsApp, YoWhatsApp, and FM WhatsApp [6] [7].

How does Triada work?

Once downloaded onto a user’s device, Triada collects information about the system, such as the device’s model, OS version, SD card space, and list of installed applications, and sends this information to a C2 server. The server then responds with a configuration file containing the device’s personal identification number and settings, including the list of modules to be installed.

After a device has been successfully infected by Triada, malicious actors can monitor and intercept incoming and outgoing texts (including two-factor authentication messages), steal login credentials and credit card information from financial applications, divert in-application purchases to themselves, create fake messaging and email accounts, install additional malicious applications, infect devices with ransomware, and take control of the camera and microphone [4] [7].

For devices infected by unofficial versions of WhatsApp, which are downloaded from third-party app stores [9] and from mobile applications such as Snaptube and Vidmate , Triada collects unique device identifiers, information, and keys required for legitimate WhatsApp to work and sends them to a remote server to register the device [7] [12]. The server then responds by sending a link to the Triada payload, which is downloaded and launched. This payload will also download additional malicious modules, sign into WhatsApp accounts on the target’s phone, and request the same permissions as the legitimate WhatsApp application, such as access to SMS messages. If granted, a malicious actor can sign the user up for paid subscriptions without their knowledge. Triada then collects information about the user’s device and mobile operator and sends it to the C2 server [9] [12].

How does Triada avoid detection?

Triada evades detection by modifying the Zygote process, which serves as a template for every application in the Android OS. This enables the malware to become part of every application launched on a device [3]. It also substitutes system functions and conceals modules from the list of running processes and installed apps, ensuring that the system does not raise the alarm [3]. Additionally, as Triada connects to a C2 server on the first boot, infected devices remain compromised even after a factory reset [4].

Triada attack overview

Across multiple customer deployments, devices were observed making a large number of connections to a range of hostnames, primarily over encrypted SSL and HTTPS protocols. These hostnames had never previously been observed on the customers’ networks and appear to be algorithmically generated. Examples include “68u91.66foh90o[.]com”, “92n7au[.]uhabq9[.]com”, “9yrh7.mea5ms[.]com”, and “is5jg.3zweuj[.]com”.

External Sites Summary Graph showing the rarity of the hostname “92n7au[.]uhabq9[.]com” on a customer network.
Figure 1: External Sites Summary Graph showing the rarity of the hostname “92n7au[.]uhabq9[.]com” on a customer network.

Most of the IP addresses associated with these hostnames belong to an ASN associated with the cloud provider Alibaba (i.e., AS45102 Alibaba US Technology Co., Ltd). These connections were made over a range of high number ports over 1000, most commonly over 30000 such as 32091, which Darktrace recognized as extremely unusual for the SSL and HTTPS protocols.

Screenshot of a Model Alert Event log showing a device connecting to the endpoint “is5jg[.]3zweuj[.]com” over port 32091.
Figure 2: Screenshot of a Model Alert Event log showing a device connecting to the endpoint “is5jg[.]3zweuj[.]com” over port 32091.

On several customer deployments, devices were seen exfiltrating data to hostnames which also appeared to be algorithmically generated. This occurred via HTTP POST requests containing unusual URI strings that were made without a prior GET request, indicating that the infected device was using a hardcoded list of C2 servers.

Screenshot of a Model Alert Event Log showing the device posting the string “i8xps1” to the hostname “72zf6.rxqfd[.]com.
Figure 3: Screenshot of a Model Alert Event Log showing the device posting the string “i8xps1” to the hostname “72zf6.rxqfd[.]com.
 Screenshot of a Model Alert Event Log showing the device posting the string “sqyjyadwwq” to the hostname “9yrh7.mea5ms[.]com”.
Figure 4: Screenshot of a Model Alert Event Log showing the device posting the string “sqyjyadwwq” to the hostname “9yrh7.mea5ms[.]com”.

These connections correspond with reports that devices affected by Triada communicate with the C2 server to transmit their information and receive instructions for installing the payload.

A number of these endpoints have communicating files associated with the unofficial WhatsApp versions YoWhatsApp and FM WhatsApp [11] [12] [13] . This could indicate that the devices connecting to these endpoints were infected via malicious modules in the unofficial versions of WhatsApp, as reported by open-source intelligence (OSINT) [10] [12]. It could also mean that the infected devices are using these connections to download additional files from the C2 server, which could infect systems with additional malicious modules related to Triada.

Moreover, on certain customer deployments, shortly before or after connecting to algorithmically generated hostnames with communicating files linked to YoWhatsApp and FM WhatsApp, devices were also seen connecting to multiple endpoints associated with WhatsApp and Facebook.

Figure 5: Screenshot from a device’s event log showing connections to endpoints associated with WhatsApp shortly after it connected to “9yrh7.mea5ms[.]com”.

These surrounding connections indicate that Triada is attempting to sign in to the users’ WhatsApp accounts on their mobile devices to request permissions such as access to text messages. Additionally, Triada sends information about users’ devices and mobile operators to the C2 server.

The connections made to the algorithmically generated hostnames over SSL and HTTPS protocols, along with the HTTP POST requests, triggered multiple Darktrace models to alert. These models include those that detect connections to potentially algorithmically generated hostnames, connections over ports that are highly unusual for the protocol used, unusual connectivity over the SSL protocol, and HTTP POSTs to endpoints that Darktrace has determined to be rare for the network.

Conclusion

Recently, the use of Android-based malware families, aimed at stealing banking and login credentials, has become a popular trend among threat actors. They use this information to perform identity theft and steal funds from victims worldwide.

Across affected customers, multiple devices were observed connecting to a range of likely algorithmically generated hostnames over SSL and HTTPS protocols. These devices were also seen sending data out of the network to various hostnames via HTTP POST requests without first making a GET request. The URIs in these requests appeared to be algorithmically generated, suggesting the exfiltration of sensitive network data to multiple Triada C2 servers.

This activity highlights the sophisticated methods used by malware like Triada to evade detection and exfiltrate data. It underscores the importance of advanced security measures and anomaly-based detection systems to identify and mitigate such mobile threats, protecting sensitive information and maintaining network integrity.

Credit to: Justin Torres (Senior Cyber Security Analyst) and Charlotte Thompson (Cyber Security Analyst).

Appendices

Darktrace Model Detections

Model Alert Coverage

Anomalous Connection / Application Protocol on Uncommon Port

Anomalous Connection / Multiple Connections to New External TCP Port

Anomalous Connection / Multiple HTTP POSTS to Rare Hostname

Anomalous Connections / Multiple Failed Connections to Rare Endpoint

Anomalous Connection / Suspicious Expired SSL

Compromise / DGA Beacon

Compromise / Domain Fluxing

Compromise / Fast Beaconing to DGA

Compromise / Sustained SSL or HTTP Increase

Compromise / Unusual Connections to Rare Lets Encrypt

Unusual Activity / Unusual External Activity

AI Analyst Incident Coverage

Unusual Repeated Connections to Multiple Endpoints

Possible SSL Command and Control

Unusual Repeated Connections

List of Indicators of Compromise (IoCs)

Ioc – Type - Description

  • is5jg[.]3zweuj[.]com - Hostname - Triada C2 Endpoint
  • 68u91[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
  • 9yrh7[.]mea5ms[.]com - Hostname - Triada C2 Endpoint
  • 92n7au[.]uhabq9[.]com - Hostname - Triada C2 Endpoint
  • 4a5x2[.]fs4ah[.]com - Hostname - Triada C2 Endpoint
  • jmll4[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
  • mrswd[.]wo87sf[.]com - Hostname - Triada C2 Endpoint
  • lptkw[.]s4xx6[.]com - Hostname - Triada C2 Endpoint
  • ya27fw[.]k6zix6[.]com - Hostname - Triada C2 Endpoint
  • w0g25[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
  • kivr8[.]wd6vy[.]com - Hostname - Triada C2 Endpoint
  • iuwe64[.]ct8pc6[.]com - Hostname - Triada C2 Endpoint
  • qefgn[.]8z0le[.]com - Hostname - Triada C2 Endpoint
  • a6y0x[.]xu0h7[.]com - Hostname - Triada C2 Endpoint
  • wewjyw[.]qb6ges[.]com - Hostname - Triada C2 Endpoint
  • vx9dle[.]n0qq3z[.]com - Hostname - Triada C2 Endpoint
  • 72zf6[.]rxqfd[.]com - Hostname - Triada C2 Endpoint
  • dwq[.]fsdw4f[.]com - Hostname - Triada C2 Endpoint
  • tqq6g[.]66foh90o[.]com - Hostname - Triada C2 Endpoint
  • 1rma1[.]4f8uq[.]com - Hostname - Triada C2 Endpoint
  • 0fdwa[.]7j3gj[.]com - Hostname - Triada C2 Endpoint
  • 5a7en[.]1e42t[.]com - Hostname - Triada C2 Endpoint
  • gmcp4[.]1e42t[.]com - Hostname - Triada C2 Endpoint
  • g7190[.]rt14v[.]com - Hostname - Triada C2 Endpoint
  • goyvi[.]2l2wa[.]com - Hostname - Triada C2 Endpoint
  • zq6kk[.]ca0qf[.]com - Hostname - Triada C2 Endpoint
  • sv83k[.]bn3avv[.]com - Hostname - Triada C2 Endpoint
  • 9sae7h[.]ct8pc6[.]com - Hostname - Triada C2 Endpoint
  • jpygmk[.]qt7tqr[.]com - Hostname - Triada C2 Endpoint
  • av2wg[.]rt14v[.]com - Hostname - Triada C2 Endpoint
  • ugbrg[.]osz1p[.]com - Hostname - Triada C2 Endpoint
  • hw2dm[.]wtws9k[.]com - Hostname - Triada C2 Endpoint
  • kj9atb[.]hai8j1[.]com - Hostname - Triada C2 Endpoint
  • pls9b[.]b0vb3[.]com - Hostname - Triada C2 Endpoint
  • 8rweau[.]j7e7r[.]com - Hostname - Triada C2 Endpoint
  • wkc5kn[.]j7e7r[.]com - Hostname - Triada C2 Endpoint
  • v58pq[.]mpvflv[.]com - Hostname - Triada C2 Endpoint
  • zmai4k[.]huqp3e[.]com - Hostname - Triada C2 Endpoint
  • eajgum[.]huqp3e[.]com - Hostname - Triada C2 Endpoint
  • mxl9zg[.]kv0pzv[.]com - Hostname - Triada C2 Endpoint
  • ad1x7[.]mea5ms[.]com - Hostname - Triada C2 Endpoint
  • ixhtb[.]s9gxw8[.]com - Hostname - Triada C2 Endpoint
  • vg1ne[.]uhabq9[.]com - Hostname - Triada C2 Endpoint
  • q5gd0[.]birxpk[.]com - Hostname - Triada C2 Endpoint
  • dycsw[.]h99n6[.]com - Hostname - Triada C2 Endpoint
  • a3miu[.]h99n6[.]com - Hostname - Triada C2 Endpoint
  • qru62[.]5qwu8b5[.]com - Hostname - Triada C2 Endpoint
  • 3eox8[.]abxkoop[.]com - Hostname - Triada C2 Endpoint
  • 0kttj[.]bddld[.]com - Hostname - Triada C2 Endpoint
  • gjhdr[.]xikuj[.]com - Hostname - Triada C2 Endpoint
  • zq6kk[.]wm0hd[.]com - Hostname - Triada C2 Endpoint
  • 8.222.219[.]234 - IP Address - Triada C2 Endpoint
  • 8.222.244[.]205 - IP Address - Triada C2 Endpoint
  • 8.222.243[.]182 - IP Address - Triada C2 Endpoint
  • 8.222.240[.]127 - IP Address - Triada C2 Endpoint
  • 8.219.123[.]139 - IP Address - Triada C2 Endpoint
  • 8.219.196[.]124 - IP Address - Triada C2 Endpoint
  • 8.222.217[.]73 - IP Address - Triada C2 Endpoint
  • 8.222.251[.]253 - IP Address - Triada C2 Endpoint
  • 8.222.194[.]254 - IP Address - Triada C2 Endpoint
  • 8.222.251[.]34 - IP Address - Triada C2 Endpoint
  • 8.222.216[.]105 - IP Address - Triada C2 Endpoint
  • 47.245.83[.]167 - IP Address - Triada C2 Endpoint
  • 198.200.54[.]56 - IP Address - Triada C2 Endpoint
  • 47.236.113[.]126 - IP Address - Triada C2 Endpoint
  • 47.241.47[.]128 - IP Address - Triada C2 Endpoint
  • /iyuljwdhxk - URI - Triada C2 URI
  • /gvuhlbzknh - URI - Triada C2 URI
  • /sqyjyadwwq - URI - Triada C2 URI
  • /cncyz3 - URI - Triada C2 URI
  • /42k0zk - URI - Triada C2 URI
  • /75kdl5 - URI - Triada C2 URI
  • /i8xps1 - URI - Triada C2 URI
  • /84gcjmo - URI - Triada C2 URI
  • /fkhiwf - URI - Triada C2 URI

MITRE ATT&CK Mapping

Technique Name - Tactic - ID - Sub-Technique of

Data Obfuscation - COMMAND AND CONTROL - T1001

Non-Standard Port - COMMAND AND CONTROL - T1571

Standard Application Layer Protocol - COMMAND AND CONTROL ICS - T0869

Non-Application Layer Protocol - COMMAND AND CONTROL - T1095

Masquerading - EVASION ICS - T0849

Man in the Browser - COLLECTION - T1185

Web Protocols - COMMAND AND CONTROL - T1071.001 -T1071

External Proxy - COMMAND AND CONTROL - T1090.002 - T1090

Domain Generation Algorithms - COMMAND AND CONTROL - T1568.002 - T1568

Web Services - RESOURCE DEVELOPMENT - T1583.006 - T1583

DNS - COMMAND AND CONTROL - T1071.004 - T1071

Fast Flux DNS - COMMAND AND CONTROL - T1568.001 - T1568

One-Way Communication - COMMAND AND CONTROL - T1102.003 - T1102

Digital Certificates - RESOURCE DEVELOPMENT - T1587.003 - T1587

References

[1] https://www.checkpoint.com/cyber-hub/cyber-security/what-is-trojan/what-is-a-banking-trojan/

[2] https://cyberfraudcentre.com/the-rise-of-the-antidot-android-banking-trojan-a-comprehensive-guide

[3] https://www.zimperium.com/glossary/banking-trojans/

[4] https://www.geeksforgeeks.org/what-is-triada-malware/

[5] https://www.infosecurity-magazine.com/news/malware-infected-devices-retailers/

[6] https://www.pcrisk.com/removal-guides/24926-triada-trojan-android

[7] https://securelist.com/malicious-whatsapp-mod-distributed-through-legitimate-apps/107690/

[8] https://securityboulevard.com/2024/02/impact-of-badbox-and-peachpit-malware-on-android-devices/

[9] https://threatpost.com/custom-whatsapp-build-malware/168892/

[10] https://securelist.com/triada-trojan-in-whatsapp-mod/103679/

[11] https://www.virustotal.com/gui/domain/is5jg.3zweuj.com/relations

[12] https://www.virustotal.com/gui/domain/92n7au.uhabq9.com/relations

[13] https://www.virustotal.com/gui/domain/68u91.66foh90o.com/relations

Continue reading
About the author
Justin Torres
Cyber Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI