Necurs Botnet Goes Phishing for Banks

A new Necurs botnet campaign targets thousands of banks with a malicious file dropping the FlawedAmmyy remote-access Trojan.

The Necurs botnet has resurfaced in a new phishing campaign targeting banks with malicious Microsoft Publisher and PDF files packed with the FlawedAmmyy remote-access Trojan.
Cofense researchers first detected the campaign early on August 15 and have confirmed 3,071 banking domains have been hit so far. Recipients range from small regional banks to some of the worlds largest financial institutions.
Necurs, a rootkit first discovered in 2012, became famous in 2016 when it was
spotted
delivering large volumes of Dridex and Locky ransomware. Now its resurfacing with new tactics as threat actors experiment with different strategies to see which are most effective.
As far as this particular campaign, it is a change from what Necurs has been doing, says Jason Meurer, senior research engineer at Cofense. He compared the attack with a marketing campaign, noting that it felt like there was a little bit of A/B testing going on here.
This campaign differed from Necurs usual strategy in several ways. For starters, it wasnt your traditional spam — this was a phishing campaign specifically geared toward the banking industry, using malicious attachments to deliver a payload designed to enable remote access. It also leveraged Microsoft Publisher files, a shift from typical Word and Excel documents. A small subset of this campaign used PDF files, which shows the attackers are trying different tactics.
Its extremely rare to see Publisher files in phishing attacks, says Cofense co-founder and CTO Aaron Higbee. While this type of file has been used in the past — after all, most employees are required to install Publisher as part of Office 365 — its not commonly seen in cybercrime.
Digging into the Details
Emails in this campaign are fairly basic, researchers report, with subject lines including Request BOI and Payment Advice with a random alphanumeric code tacked on the end. Higbee points out the phishing email was forged to appear as though it came from an employee at an Indian bank. A different Indian bank, Cosmos,
recently
lost $13.5 million in a cyberattack when hackers broke into its ATM server and stole customer information.
This campaign could potentially indicate a future ATM attack, says Higbee, and network access may be part of the actors motivation. The malicious .pub documents attached to phishing emails have embedded macros that, when executed, prompt a download from a remote host, explain Cofenses Jason Meurer and Darrel Rendell in a
blog post
on the campaign.
The final payload is FlawedAmmyy, which is malware based on leaked source code for Ammyy Admin. It gives an attacker with full remote control of a compromised host, which can lead to file and credential theft and enable lateral movement within target organizations.
FlawedAmmyy had gone undocumented until early 2018, when Proofpoint
research
indicated the Trojan had been used in attacks as far back as January 2016 and as recently as March 2018. At that time, attackers began to use a new distribution method of combining ZIP files with the Server Message Block protocol to deliver FlawedAmmyy onto target systems.
The March campaign dropping FlawedAmmyy appeared to be the work of TA505, the same threat group associated with the Dridex, Locky, and GlobeImposter campaigns. While Cofense has not yet determined the motivation behind the latest Necurs campaign, Higbee says people who have been studying Necurs have linked the botnet to organized crime.
Whats Next for Necurs
Now that the campaign has come to a halt, Meurer anticipates the attackers are probably taking a look at their command-and-control infrastructure to gauge the effectiveness of their strategy. Did .pub files work, for example, or were PDF files more effective?
If there was little to no engagement, theyll go back to the drawing board and look for another file format they can use to deliver the next wave, he says. If we see Necurs do another phishing campaign using .pub files, its an indication people behind it were satisfied with the results.
Its a call for banking institutions to stay on their toes. Banks should make sure their perimeter security is in good shape and their email gateways are updated. The second thing is to make sure banking employees are aware theyre targets of cybercriminals, just by the nature of the fact they work at a bank, Meurer adds. Any employee is a rich target for a cybercriminal.
Related Content
6 Eye-Raising Third-Party Breaches
Active Third-Party Content the Bane of Web Security
Miller & Valasek: Security Stakes Higher for Autonomous Vehicles
2018 Pwnie Awards: Who Pwned, Who Got Pwned
Learn from the industrys most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for
more info
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Necurs Botnet Goes Phishing for Banks