Tracking Malicious Glupteba Activity Through the Blockchain

[ad_1] <br><div> <p>Risk actors are more and more leveraging blockchain know-how to launch cyberattacks. By benefiting from the distributed and decentralized nature of blockchain, malicious actors can exploit its anonymity for quite a lot of assaults, starting from malware propagation to ransomware distribution.</p> <p>The Glupteba trojan is an instance of a risk actor leveraging blockchain-based applied sciences to hold out their malicious exercise. On this weblog, Nozomi Networks Lab presents our newest findings on Glupteba and the way safety groups can seek for malicious exercise within the blockchain. </p> <div class="wp-block-image"> <figure class="aligncenter size-large is-resized"><img decoding="async" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/Tracking-Malicious-Glupteba-Activity-1024x536.jpg" alt="Organizations undergoing digital transformation need to focus on operational technology security." class="wp-image-117805" width="768" height="402" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/Tracking-Malicious-Glupteba-Activity-1024x536.jpg 1024w, https://www.nozominetworks.com/wp-content/uploads/2022/12/Tracking-Malicious-Glupteba-Activity-300x157.jpg 300w, https://www.nozominetworks.com/wp-content/uploads/2022/12/Tracking-Malicious-Glupteba-Activity-768x402.jpg 768w, https://www.nozominetworks.com/wp-content/uploads/2022/12/Tracking-Malicious-Glupteba-Activity-620x324.jpg 620w, https://www.nozominetworks.com/wp-content/uploads/2022/12/Tracking-Malicious-Glupteba-Activity.jpg 1200w, https://www.nozominetworks.com/wp-content/uploads/2022/12/Tracking-Malicious-Glupteba-Activity-400x209.jpg 400w" sizes="(max-width: 768px) 100vw, 768px"/><figcaption class="wp-element-caption"><em>Nozomi Networks Researchers have tracked Glupteba by means of the blockchain, figuring out 15 Glupteba bitcoin addresses</em> <em>spawning over 4 years, by means of 4 totally different campaigns.</em></figcaption></figure> </div> <h2>What's Glupteba?</h2> <p>Glupteba is a backdoor trojan that's downloaded through Pay-Per-Set up networks – on-line advert campaigns that immediate software program or utility downloads – in contaminated installers or software program cracks. As soon as Glupteba is energetic on a system, the botnet operators can deploy further modules from the credential stealer to take advantage of kits compromising gadgets on the goal community. There are a number of Glupteba modules aimed toward exploiting vulnerabilities in varied Web of Issues (IoT) home equipment from distributors, reminiscent of MikroTik and Netgear. </p> <p>Surprisingly, Glupteba leverages the Bitcoin blockchain to distribute its Command and Management (C2) domains to contaminated techniques. Aside from the truth that that is an unusual method, this mechanism can also be extraordinarily resilient to takedowns as there is no such thing as a solution to erase nor censor a validated Bitcoin transaction. Utilizing the identical strategy that Glupteba is utilizing to cover information inside the blockchain, researchers can hunt for malicious transactions and recuperate their payloads. If the stated domains aren't saved in plaintext, reversing the Glupteba samples allows safety researchers to decrypt the payload and entry the embedded domains. </p> <h2>Utilizing the Blockchain to Retailer Knowledge</h2> <p>The Bitcoin blockchain can be utilized to retailer arbitrary information. That is made potential by the <code><a target="_blank" href="https://en.bitcoin.it/wiki/OP_RETURN" rel="noreferrer noopener nofollow">OP_RETURN</a></code> opcode that allows storage of as much as 80 bytes of arbitrary information inside the signature script. This storage mechanism has a number of benefits. First, it's resilient to takedowns. As soon as a transaction has been validated, there is no such thing as a solution to erase it – that is the character of the blockchain. Utilizing this mechanism to distribute C2 area implies that legislation enforcement officers, community defenders, and incident responders haven't any solution to take down the Bitcoin deal with and erase the transaction. The way in which the Bitcoin blockchain is constructed on high of recent cryptography additionally makes this mechanism safe; with out the Bitcoin deal with non-public key, one can not ship a transaction with such a knowledge payload originating from the malicious deal with, therefore, taking on the botnet isn't potential. Moreover, risk actors can encrypt their payload from peering eyes, making the information storage scheme strong and value efficient.</p> <p>This method has additionally been utilized by the <a target="_blank" href="https://www.cyber-threat-intelligence.com/research/cerber-cnc/" rel="noreferrer noopener nofollow">Cerber ransomware</a> previously. Bitcoin transactions originating from particular addresses had been monitored and the primary 6 characters of a vacation spot deal with had been used together with a <code>.high</code> TLD appended to&gt; generate a site, which might be used to question the energetic C2 infrastructure.</p> <p>Glupteba is understood to be utilizing the same mechanism counting on <code>OP_RETURN</code> as an alternative of vacation spot addresses to distribute its C2 domains. In case of a C2 area being taken down, the botnet operators solely have to ship a brand new transaction from the Bitcoin deal with distributing the domains and voila, the malware will alter its configuration the following time the C2 is refreshed. The <a target="_blank" href="https://www.blockchain.com/btc/tx/77e7ba8fc55dcdbaca840d8a53801d3b3a8626745ab6ccdb53803a68e76b0034" rel="noreferrer noopener nofollow">latest identified Glupteba bitcoin transaction</a> dates to the eighth of November 2022 with its embedded payload <code>000c0b0006171c11064d150a0b16</code>.</p> <p>The hexadecimal payload above doesn't appear to signify something near a site identify and that's as a result of Glupteba makes use of, in its newest variant, a XOR encryption scheme to guard the information. As soon as the hot button is identified, usually by reverse engineering a pattern reminiscent of c6d4ce67dd25764f571a84caa19fa6c2b067cae6, decrypting the information turns into easy; see a pattern of this decryption in <a target="_blank" href="https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')XOR(%7B'option':'UTF8','string':'cheesesauce'%7D,'Standard',false)&amp;input=MDAwYzBiMDAwNjE3MWMxMTA2NGQxNTBhMGIxNg" rel="noopener">Github</a>.</p> <h2>The Evolution of Glupteba</h2> <p>Glupteba is understood to make use of the Bitcoin blockchain to distribute its C2 servers <a target="_blank" href="https://www.bleepingcomputer.com/news/security/glupteba-malware-uses-bitcoin-blockchain-to-update-c2-domains/" rel="noreferrer noopener nofollow">since at least 2019</a>. To retrieve the Bitcoin transactions, a number of suppliers are used, normally <em>blockchain.com</em> and <em>blockstream.information</em>. The Glupteba perform chargeable for querying <em>blockchain.com</em> to retrieve the transaction information is proven in Determine 1.</p> <div class="wp-block-image"> <figure class="aligncenter size-full is-resized"><img decoding="async" loading="lazy" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_1.png" alt="Figure 1. The Bitcoin address that contains the transactions with the command-and-control domains." class="wp-image-117640" width="601" height="319" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_1.png 1020w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_1-300x159.png 300w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_1-768x408.png 768w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_1-620x329.png 620w" sizes="(max-width: 601px) 100vw, 601px"/><figcaption class="wp-element-caption"><strong>Determine 1</strong>. The Bitcoin deal with that comprises the transactions with the command-and-control domains.</figcaption></figure> </div> <p>The way in which the domains are protected inside the transactions has barely developed over time. In 2019, Glupteba used AES-GCM to guard and embed the information within the bitcoin transactions. Every pattern was shipped with a hardcoded key and initialization vector enabling the pattern to decrypt the payload from the Bitcoin transaction. Determine 2 reveals the decryption routine within the oldest Glupteba variations.<code>.</code></p> <div class="wp-block-image"> <figure class="aligncenter size-large is-resized"><img decoding="async" loading="lazy" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_2-1024x470.png" alt="Figure 2. The Glupteba code calling the AES-GCM decryption routine." class="wp-image-117648" width="599" height="275" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_2-1024x470.png 1024w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_2-300x138.png 300w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_2-768x353.png 768w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_2-1536x706.png 1536w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_2-620x285.png 620w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_2.png 1600w" sizes="(max-width: 599px) 100vw, 599px"/><figcaption class="wp-element-caption"><strong>Determine 2</strong>. The Glupteba code calling the AES-GCM decryption routine.</figcaption></figure> </div> <p>In newer variations of the malware, this scheme was switched to a easy XOR cipher, which is at the moment getting used. All samples we discovered had been utilizing the identical key: “cheesesauce”. Determine 3 reveals this key being moved round in reminiscence within the perform accountable to decrypt the ciphertext.</p> <div class="wp-block-image"> <figure class="aligncenter size-large is-resized"><img decoding="async" loading="lazy" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_3-1024x580.png" alt="Figure 3. The XOR cipher key is being loaded in the Glupteba decryption routine." class="wp-image-117653" width="600" height="340" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_3-1024x580.png 1024w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_3-300x170.png 300w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_3-768x435.png 768w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_3-1536x871.png 1536w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_3-620x351.png 620w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_3.png 1600w" sizes="(max-width: 600px) 100vw, 600px"/><figcaption class="wp-element-caption"><strong>Determine 3</strong>. The XOR cipher secret's being loaded within the Glupteba decryption routine.</figcaption></figure> </div> <h2>Timeline of Occasions  </h2> <p>Given all that data, we went on a blockchain harvesting tour, scanning the whole Bitcoin blockchain for hidden C2 domains. We tried to decrypt the information payload of the <code>OP_RETURN</code> script current in every transaction of each block utilizing all of the algorithms and keys we all know to be related to Glupteba. As well as, we downloaded over 1500 Glupteba samples from VirusTotal and regarded on the pockets addresses they used to verify we didn't miss something. However that's not all: the newest set of TLS certificates Glupteba makes use of additionally reveals <a target="_blank" href="https://crt.sh/?q=4c2bac6c0493203dabaed2b14b99f2f8f17a9cab804a5ac6efd0e6415dbc568b" rel="noopener">a precise pattern</a> within the Topic Different Names and, because of certificates transparency, this may be hunted for. Lastly, we additionally took a detailed take a look at the passive DNS data at our disposal to search out potential related domains and hosts.<br/>This analysis gave us an enormous collection of occasions we determined to summarize with the timeline under, displaying when actions had been taken by Glupteba operators.</p> <figure class="wp-block-table is-style-stripes"> <table class="has-fixed-layout"> <thead> <tr> <th>Date</th> <th>Supply</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>2022-11-22</td> <td>Passive DNS</td> <td>Area registration limeprime[.]org</td> </tr> <tr> <td>2022-11-21</td> <td>Passive DNS</td> <td>Area registration greenphoenix[.]xyz</td> </tr> <tr> <td>2022-11-08</td> <td>Blockchain</td> <td>Pockets 1KfLXEveeDEi58wvuBBxuywUA1V66F5QXK replace cdneurops[.]pics</td> </tr> <tr> <td>2022-10-29</td> <td>Blockchain</td> <td> <li>Pockets 1NX7zTP6C4oGj2y3DaJTrg26AGFWExvYnr replace mastiakele[.]icu</li> <li>Pockets 1CzetoTU29WbhNy1UozrQpxuFuCVxffbTd replace mastiakele[.]xyz</li> <li> Pockets 1KfLXEveeDEi58wvuBBxuywUA1V66F5QXK replace cdneurops[.]buzz</li> <li>Pockets 1CfevVPC8cSpFf7QKQwShrFgQYfyQaoXhc replace cdneurops[.]store</li> <li>Pockets 14XZhcCJDguZuZF4p13tfLXJ6puudY7gqs replace zaoshanghaoz[.]web</li> <li>Pockets 1BrEshrz6gVbVuHGBgJ5GuHBvC2sdoeTAJ  replace cdneurop[.]cloud</li> <li>Pockets 1KfLXEveeDEi58wvuBBxuywUA1V66F5QXK replace cdneurop[.]cloud</li> <li>Pockets 1AuWUMtjPo7Cc1Ji2pz7DWVvVJ5EjiUaHh replace cdneurops[.]well being</li> <li>Pockets 1BqY56No1LR64AGcog4mF54UTPnjrPAPHz replace mastiakele[.]cyou</li> <li>Pockets 1CfevVPC8cSpFf7QKQwShrFgQYfyQaoXhc replace mastiakele[.]cyou</li> <li>Pockets 14XZhcCJDguZuZF4p13tfLXJ6puudY7gqs replace zaoshanghaoz[.]web</li> <li>Pockets 1NX7zTP6C4oGj2y3DaJTrg26AGFWExvYnr replace mastiakele[.]icu</li> <li>Pockets 1Mz2b2onxnAYhJTJQoGHdSBy6wu2HpufVR replace mastiakele[.]ae[.]org</li> <li>Pockets 1MuJwQKLQKt1VCBQ9u1RtepW7sDD3AwRE6 replace zaoshang[.]ooo</li> <li>Pockets 19RzEN3pqHvgRHGMjjtYCqjVTXt8bnHkK3 replace cdntokiog[.]studio</li> <li>Pockets 1CzetoTU29WbhNy1UozrQpxuFuCVxffbTd replace cdntokiog[.]studio</li> <li>Pockets 1HSC8Yt2yjuFUSGpUfJnwLMr4HzNxV3dvP` replace zaoshang[.]moscow</li> <li>Pockets 15nWGFaodg3efVKATgsaaSPU2TxSbiMHcP replace окрф[.]рф</li> <li>Pockets 1LQ2EPBwPqdbmXwN6RodPS4xqcm8EtPcaB replace zaoshang[.]ru</li> <li>Pockets 1HzJkTn6Z5nDrgbR6dHVBDVtsRYqwDmGzN replace zaoshanghao[.]su</li> </td> </tr> <tr> <td>2022-10-28</td> <td>Certificates Transparency</td> <td>Let’s encrypt certificates registration</td> </tr> <tr> <td>2022-10-28</td> <td>Blockchain</td> <td>Pockets 1BL6NZSoXtMSdquRmePDUCQxFaXtLLSVWG replace duniadekho[.]bar</td> </tr> <tr> <td>2022-10-27</td> <td>Passive DNS</td> <td>Area registration cdneurops[.]pics mastiakele[.]icu mastiakele[.]xyz cdneurops[.]buzz cdneurops[.]store zaoshanghaoz[.]web cdneurop[.]cloud cdneurops[.]well being mastiakele[.]cyou mastiakele[.]ae[.]org zaoshang[.]ooo cdntokiog[.]studio zaoshang[.]moscow окрф[.]рф zaoshang[.]ru zaoshanghao[.]su duniadekho[.]bar</td> </tr> <tr> <td>2022-10-26</td> <td>Blockchain</td> <td>Pockets 1KfLXEveeDEi58wvuBBxuywUA1V66F5QXK replace checkpos[.]web</td> </tr> <tr> <td>2022-10-25</td> <td>Passive DNS</td> <td>Area registration checkpos[.]web</td> </tr> <tr> <td>2022-10-01</td> <td>Passive DNS</td> <td>Area registration revouninstaller[.]houses</td> </tr> <tr> <td>2022-09-30</td> <td>Blockchain</td> <td>Pockets 1HzJkTn6Z5nDrgbR6dHVBDVtsRYqwDmGzN replace tmetres[.]com</td> </tr> <tr> <td>2022-09-28</td> <td>Passive DNS</td> <td>Area registration tmetres[.]com</td> </tr> <tr> <td>2022-08-12</td> <td>Blockchain</td> <td> <li>Pockets 1BL6NZSoXtMSdquRmePDUCQxFaXtLLSVWG replace 3ebu257qh2dlauxqj7cgv3i55e4orb55mwgqf4tq7eicsa3dfhr4aaid[.]onion</li> <li>Pockets 1HzJkTn6Z5nDrgbR6dHVBDVtsRYqwDmGzN replace yeug3c6mnwocixwlotka4nwo3fjtfic65o4psmpxvrdul5q7dgjmsvad[.]onion</li> </td> </tr> <tr> <td>2022-08-12</td> <td>Passive DNS</td> <td>Area registration getyourgift[.]life</td> </tr> <tr> <td>2022-07-04</td> <td>Blockchain</td> <td> <li>Pockets 1Cxy9e6KtHtBJrQwCwpKgcyp6dhncx6eNh replace x4l2doee6uhhf3lqjvjodgqtxsjvwbkdqyldhwyhwkhf4y23aqq7jayd[.]onion</li> <li>Pockets 1HSC8Yt2yjuFUSGpUfJnwLMr4HzNxV3dvP replace bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd[.]onion</li> </td> </tr> <tr> <td>2022-06-09</td> <td>Blockchain</td> <td>Pockets 1CzetoTU29WbhNy1UozrQpxuFuCVxffbTd replace x4l2doee6uhhf3lqjvjodgqtxsjvwbkdqyldhwyhwkhf4y23aqq7jayd.onion</td> </tr> <tr> <td>2022-06-07</td> <td>Blockchain</td> <td>Pockets 1CzetoTU29WbhNy1UozrQpxuFuCVxffbTd replace x4l2doee6uhhf3lqjvjodgqtxsjvwbkdqyldhwyhwkhf4y23aqq7jayd.onion</td> </tr> <tr> <td>2022-06-06</td> <td>Blockchain</td> <td> <li>Pockets 1AuWUMtjPo7Cc1Ji2pz7DWVvVJ5EjiUaHh replace c43tnmrkzfmkjyd3j4v6xbyrd67q6pskzy67dwkzj36uoqwpoju2loyd.onion</li> <li>Pockets 1CfevVPC8cSpFf7QKQwShrFgQYfyQaoXhc replace 2pkktxkf3gnpcjh2bhi62arz2ieyjgxocb3jne3kc2nu2yvyxqq23nad.onion</li> <li>Pockets 1BrEshrz6gVbVuHGBgJ5GuHBvC2sdoeTAJ replace yeug3c6mnwocixwlotka4nwo3fjtfic65o4psmpxvrdul5q7dgjmsvad.onion</li> <li>Pockets 19RzEN3pqHvgRHGMjjtYCqjVTXt8bnHkK3 replace dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion</li> <li>Pockets 1HSC8Yt2yjuFUSGpUfJnwLMr4HzNxV3dvP replace c43tnmrkzfmkjyd3j4v6xbyrd67q6pskzy67dwkzj36uoqwpoju2loyd.onion</li> <li>Pockets 1BqY56No1LR64AGcog4mF54UTPnjrPAPHz replace 2pkktxkf3gnpcjh2bhi62arz2ieyjgxocb3jne3kc2nu2yvyxqq23nad.onion</li> <li>Pockets 1LQ2EPBwPqdbmXwN6RodPS4xqcm8EtPcaB replace dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion</li> <li>Pockets 15nWGFaodg3efVKATgsaaSPU2TxSbiMHcP replace papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion</li> <li>Pockets 14XZhcCJDguZuZF4p13tfLXJ6puudY7gqs replace c43tnmrkzfmkjyd3j4v6xbyrd67q6pskzy67dwkzj36uoqwpoju2loyd.onion</li> </td> </tr> <tr> <td>2022-06-03</td> <td>Blockchain</td> <td> <li>Pockets 1Mz2b2onxnAYhJTJQoGHdSBy6wu2HpufVR replace 2pkktxkf3gnpcjh2bhi62arz2ieyjgxocb3jne3kc2nu2yvyxqq23nad.onion</li> <li>Pockets replace 1MuJwQKLQKt1VCBQ9u1RtepW7sDD3AwRE6 dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion</li> <li>Pockets replace 14XZhcCJDguZuZF4p13tfLXJ6puudY7gqs papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion</li> <li>Pockets replace 1HzJkTn6Z5nDrgbR6dHVBDVtsRYqwDmGzN yeug3c6mnwocixwlotka4nwo3fjtfic65o4psmpxvrdul5q7dgjmsvad.onio</li> <li>Pockets 1Cxy9e6KtHtBJrQwCwpKgcyp6dhncx6eNh replace yeug3c6mnwocixwlotka4nwo3fjtfic65o4psmpxvrdul5q7dgjmsvad.onio</li> </td> </tr> <tr> <td>2022-06-01</td> <td>Blockchain</td> <td> <li>Pockets 1KfLXEveeDEi58wvuBBxuywUA1V66F5QXK replace dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion</li> <li>Pockets 1CzetoTU29WbhNy1UozrQpxuFuCVxffbTd replace maesvpovrwqfaqjw44bbeb2w62h6n7eyosbeit7rfrrdbyjymqaxfryd.onion</li> </td> </tr> <tr> <td>2021-12-29</td> <td>Blockchain</td> <td>Pockets 1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97  replace dafflash[.]com</td> </tr> <tr> <td>2021-12-27</td> <td>Blockchain</td> <td>Area registration dafflash[.]com</td> </tr> <tr> <td>2021-12-25</td> <td>Blockchain</td> <td>Pockets 1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97 replace filimaik[.]com</td> </tr> <tr> <td>2021-12-13</td> <td>Blockchain</td> <td>Pockets 12EfzLra6LttQ8RWvBTDzJUjYE6eRxx4TY replace 7owe32rodnp3vnx2ekqncoegxolkmb3m2fex5zu6i2bg7ktivhwvczqd.onion</td> </tr> <tr> <td>2021-12-12</td> <td>Blockchain</td> <td>Pockets 12EfzLra6LttQ8RWvBTDzJUjYE6eRxx4TY replace r5vg4h5rlwmo6oa3p3vlckuvf5na2wb2tnqbsbkivhrhlyze6czlpjad.onion</td> </tr> <tr> <td>2021-12-10</td> <td>Passive DNS</td> <td>Area registration godespra[.]com filimaik[.]com</td> </tr> <tr> <td>2021-12-09</td> <td>Blockchain</td> <td>Pockets 1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97 replace mydomelem.com</td> </tr> <tr> <td>2021-12-08</td> <td>Blockchain</td> <td>Pockets 1HjoomvzjtvZdbznoEijTNAkMjmsFba9fY replace nameiusr.com</td> </tr> <tr> <td>2021-12-07</td> <td>Blockchain</td> <td>Pockets 1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97 replace younghil.com</td> </tr> <tr> <td>2021-12-06</td> <td>Passive DNS</td> <td>Area registration mydomelem.com nameiusr.com younghil.com</td> </tr> <tr> <td>2021-11-09 </td> <td>Blockchain</td> <td>Pockets 1GLjCyG3fDf7vT3SxwtEUx7Z2w2UQrR3FU replace newcc[.]com</td> </tr> <tr> <td>2021-10-19</td> <td>Blockchain</td> <td>Pockets 1CgPCp3E9399ZFodMnTSSvaf5TpGiym2N1 replace nisdably[.]com</td> </tr> <tr> <td>2021-10-13</td> <td>Blockchain</td> <td>Pockets 1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97 replace tyturu[.]com</td> </tr> <tr> <td>2021-10-11</td> <td>Passive DNS</td> <td>Area registration tyturu[.]com</td> </tr> <tr> <td>2021-03-28</td> <td>Passive DNS</td> <td>Area registration nisdably[.]com</td> </tr> <tr> <td>2020-05-13</td> <td>Blockchain</td> <td>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace maxbook[.]area</td> </tr> <tr> <td>2020-05-07</td> <td>Blockchain</td> <td>Pockets 1CgPCp3E9399ZFodMnTSSvaf5TpGiym2N1 replace easywbdesign[.]com</td> </tr> <tr> <td>2020-04-08</td> <td>Blockchain</td> <td>Pockets 1CgPCp3E9399ZFodMnTSSvaf5TpGiym2N1 replace sndvoices[.]com</td> </tr> <tr> <td>2020-04-02</td> <td>Passive DNS</td> <td>Area registration easywbdesign[.]com sndvoices[.]com</td> </tr> <tr> <td>2020-03-28</td> <td>Blockchain</td> <td> <li>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace myinfoart[.]xyz</li> <li>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace gfixprice[.]xyz</li> <li>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace getfixed[.]xyz</li> </td> </tr> <tr> <td>2020-03-15</td> <td>Passive DNS</td> <td>Area registration maxbook[.]area</td> </tr> <tr> <td>2020-02-17</td> <td>Blockchain</td> <td>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace anotheronedom[.]com</td> </tr> <tr> <td>2020-02-17</td> <td>Passive DNS</td> <td>Area Registration anotheronedom[.]com</td> </tr> <tr> <td>2020-02-14</td> <td>Blockchain</td> <td>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace sleepingcontrol[.]com</td> </tr> <tr> <td>2020-01-24</td> <td>Blockchain</td> <td>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace robotatten[.]com</td> </tr> <tr> <td>2020-01-23</td> <td>Blockchain</td> <td>Pockets 34RqywhujsHGVPNMedvGawFufFW9wWtbXC replace robotatten[.]com</td> </tr> <tr> <td>2020-01-23</td> <td>Passive DNS</td> <td>Area registration sleepingcontrol[.]com robotatten[.]com</td> </tr> <tr> <td>2019-06-19</td> <td>Blockchain</td> <td>Pockets 15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6 replace venoxcontrol[.]com</td> </tr> <tr> <td>2019-06-14</td> <td>Passive DNS</td> <td>Area registration venoxcontrol[.]com</td> </tr> </tbody> </table> </figure> <h2>The 4 Glupteba Campaigns</h2> <p>We now have been capable of establish 15 Glupteba bitcoin addresses spawning over 4 years and what we imagine to be 4 totally different campaigns.</p> <h3>Marketing campaign 1</h3> <p>The oldest wave appears to have began in June 2019. Again then, just one single Bitcoin deal with was used to distribute the malicious domains. This additionally corroborates what Google came upon of their lawsuit towards two Glupteba operators.</p> <figure class="wp-block-table is-style-stripes"> <table class="has-fixed-layout"> <thead> <tr> <th>Handle</th> <th>First seen</th> <th>Final seen</th> <th>Transactions</th> <th>Variety of samples</th> </tr> </thead> <tbody> <tr> <td>15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6</td> <td>2019-06-17 15:51</td> <td>2020-05-13 13:02</td> <td>16</td> <td>54</td> </tr> <tr/> </tbody> </table> </figure> <p>Determine 4 reveals a graph of the deal with transactions. We are able to see the <code>OP_RETURN </code>transactions like 3Jt2U the place the funds bounce again to the 15y7d deal with. Apparently all of the remaining $36.18 on the 15y7d deal with had been despatched to the deal with 3Jwj7 in February 2020. No exercise has been noticed at that deal with since then.</p> <div class="wp-block-image"> <figure class="aligncenter size-full is-resized"><img decoding="async" loading="lazy" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_4.png" alt="Figure 4. The graph shows the transaction to and from the address involved in the 2019 campaign." class="wp-image-117718" width="598" height="584" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_4.png 753w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_4-300x293.png 300w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_4-620x605.png 620w" sizes="(max-width: 598px) 100vw, 598px"/><figcaption class="wp-element-caption"><strong>Determine 4</strong>. The graph reveals the transaction to and from the deal with concerned within the 2019 marketing campaign.</figcaption></figure> </div> <h3>Marketing campaign 2</h3> <p>The second wave appears to have began in April 2020, this time two Bitcoin addresses had been used to distribute the malicious C2 domains. Apparently we didn't discover any samples utilizing the second deal with; <a>it</a> could possibly be a testing deal with to make sure the Glupteba variants had been behaving as anticipated. As well as, the area distributed through the supposedly testing deal with <em>deepsound[.]reside</em> has not been seen in every other transactions we had been capable of finding throughout each addresses. It is also that we merely are lacking some samples.</p> <figure class="wp-block-table is-style-stripes"> <table class="has-fixed-layout"> <thead> <tr> <th>Handle</th> <th>First Seen</th> <th>Final seen</th> <th>Transactions</th> <th>Variety of samples</th> </tr> </thead> <tbody> <tr> <td>1CgPCp3E9399ZFodMnTSSvaf5TpGiym2N1</td> <td>2020-04-08 18:28</td> <td>2021-10-19 17:28</td> <td>11</td> <td>87</td> </tr> <tr> <td>1bRfcRZVws98j3QQEZxrgRVd15vVF6zSU</td> <td>2020-04-08 14:21</td> <td>2020-04-08 15:49</td> <td>2</td> <td>0</td> </tr> <tr/> </tbody> </table> </figure> <p>Right here the identical sample will be noticed on the primary deal with 1CgPC, after a interval of exercise, the remaining funds accounting for $28.45 had been transferred again to some vendor or service provider in November 2021. On the supposed take a look at Bitcoin deal with, the funds weren't transferred and stay to this present day on the account for a steadiness of $76.80. Determine 5 reveals the transactions to and from each addresses.</p> <div class="wp-block-image"> <figure class="aligncenter size-full is-resized"><img decoding="async" loading="lazy" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_5.png" alt="Figure 5. The graph shows the transaction to and from the addresses involved in the 2020 Glupteba campaign." class="wp-image-117729" width="600" height="647" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_5.png 683w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_5-278x300.png 278w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_5-620x668.png 620w" sizes="(max-width: 600px) 100vw, 600px"/><figcaption class="wp-element-caption"><strong>Determine 5</strong>. The graph reveals the transaction to and from the addresses concerned within the 2020 Glupteba marketing campaign.</figcaption></figure> </div> <h3>Marketing campaign 3</h3> <p>The third marketing campaign begins in November 2021; the variety of bitcoin addresses used to ship malicious area doubled, from 2 in 2020 to 4 in 2021. This marketing campaign was the shortest of all, with a lifespan of solely about two months. We imagine that is seemingly on account of Google efforts to take the botnet down, when about <del>1</del> yr in the past <a target="_blank" href="https://blog.google/technology/safety-security/new-action-combat-cyber-crime/" rel="noreferrer noopener nofollow">Google filed a lawsuit against Glupteba two operators</a> and a number of other actions had been taken to <a target="_blank" href="https://blog.google/threat-analysis-group/disrupting-glupteba-operation/" rel="noreferrer noopener nofollow">disrupt the botnet operations</a>. That is additionally the primary time TOR hidden companies had been used as a command-and-control server by Glupteba.</p> <figure class="wp-block-table is-style-stripes"> <table class="has-fixed-layout"> <thead> <tr> <th>Handle</th> <th>First seen</th> <th>Final seen</th> <th>Transactions</th> <th>Variety of samples</th> </tr> </thead> <tbody> <tr> <td>1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97</td> <td>2021-10-13 15:20</td> <td>2021-12-29 10:15</td> <td>12</td> <td>77</td> </tr> <tr> <td>12EfzLra6LttQ8RWvBTDzJUjYE6eRxx4TY</td> <td>2021-12-12 21:38</td> <td>2021-12-13 21:14</td> <td>3</td> <td>3</td> </tr> <tr> <td>1HjoomvzjtvZdbznoEijTNAkMjmsFba9fY</td> <td>2021-12-08 15:57</td> <td>2021-12-08 17:12</td> <td>2</td> <td>17</td> </tr> <tr> <td>1GLjCyG3fDf7vT3SxwtEUx7Z2w2UQrR3FU</td> <td>2021-11-09 12:22</td> <td>2021-11-09 12:49</td> <td>2</td> <td>0</td> </tr> <tr/> </tbody> </table> </figure> <p>Glupteba operators used 4 wallets, with probably the most energetic one being 1CUha as proven in Determine 6. Once more, there have been no remaining funds left on the Bitcoin addresses. That is additionally the oldest deal with on this marketing campaign and the one with the best variety of transactions. Apparently, we weren't capable of finding a single pattern referring to the deal with 1GLjC which we imagine might have been used for testing the malware, just like 2020. The area used <em>newcc[.]</em>com was additionally not registered on the time and will point out it was utilized in a testing setting or we could possibly be lacking some samples.</p> <div class="wp-block-image"> <figure class="aligncenter size-full is-resized"><img decoding="async" loading="lazy" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_6.png" alt="Figure 6. The graph shows the transaction to and from the addresses involved in the 2021 Glupteba campaign." class="wp-image-117739" width="599" height="619" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_6.png 723w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_6-291x300.png 291w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_6-620x640.png 620w" sizes="(max-width: 599px) 100vw, 599px"/><figcaption class="wp-element-caption"><strong>Determine 6</strong>. The graph reveals the transaction to and from the addresses concerned within the 2021 Glupteba marketing campaign.</figcaption></figure> </div> <h3>Marketing campaign 4</h3> <p>The most recent and ongoing marketing campaign began in June 2022, 6 months after the Google lawsuit, and this time the variety of malicious bitcoin addresses significantlh elevated. We imagine this is because of a number of elements. First, having extra Bitcoin addresses makes safety researcher job extra sophisticated. Second, to indicate that the Google lawsuit didn't have a significant impact on their Glupteba operations. For this marketing campaign we weren't capable of finding any samples for 3 of the addresses we gathered. We imagine these addresses aren't made for testing as they distribute some domains present in different Bitcoin addresses for which we discovered samples. As well as, there was a tenfold enhance in TOR hidden service getting used as C2 servers because the 2021 marketing campaign.</p> <figure class="wp-block-table is-style-stripes"> <table class="has-fixed-layout"> <thead> <tr> <th>Handle</th> <th>First seen</th> <th>Final seen</th> <th>Transactions</th> <th>Variety of samples</th> </tr> </thead> <tbody> <tr> <td>1KfLXEveeDEi58wvuBBxuywUA1V66F5QXK</td> <td>2022-06-01 14:16</td> <td>2022-11-08 11:54</td> <td>11</td> <td>1197</td> </tr> <tr> <td>1LQ2EPBwPqdbmXwN6RodPS4xqcm8EtPcaB</td> <td> 2022-06-03 13:59</td> <td>2022-10-29 11:29</td> <td>4</td> <td>6</td> </tr> <tr> <td>1MuJwQKLQKt1VCBQ9u1RtepW7sDD3AwRE6</td> <td>2022-06-03 15:02</td> <td>2022-10-29 11:37</td> <td>4</td> <td>6</td> </tr> <tr> <td>1Mz2b2onxnAYhJTJQoGHdSBy6wu2HpufVR</td> <td>2022-06-03 14:33</td> <td>2022-10-29 11:40</td> <td>5</td> <td>3</td> </tr> <tr> <td>1NX7zTP6C4oGj2y3DaJTrg26AGFWExvYnr</td> <td>2022-06-06 14:10</td> <td>2022-10-29 12:07</td> <td>6</td> <td>6</td> </tr> <tr> <td>14XZhcCJDguZuZF4p13tfLXJ6puudY7gqs</td> <td>2022-06-03 14:56</td> <td>2022-10-29 12:03</td> <td>8</td> <td>12</td> </tr> <tr> <td>15nWGFaodg3efVKATgsaaSPU2TxSbiMHcP</td> <td>2022-06-03 14:34</td> <td>2022-10-29 11:30</td> <td>6</td> <td>48</td> </tr> <tr> <td>19RzEN3pqHvgRHGMjjtYCqjVTXt8bnHkK3</td> <td>2022-06-06 13:51</td> <td>2022-10-29 11:37</td> <td>4</td> <td>6</td> </tr> <tr> <td>1AuWUMtjPo7Cc1Ji2pz7DWVvVJ5EjiUaHh</td> <td>2022-06-06 14:04</td> <td>2022-10-29 11:43</td> <td>4</td> <td>3</td> </tr> <tr> <td>1BL6NZSoXtMSdquRmePDUCQxFaXtLLSVWG</td> <td>2022-06-07 08:51</td> <td>2022-10-28 10:51</td> <td>4</td> <td>3</td> </tr> <tr> <td>1BqY56No1LR64AGcog4mF54UTPnjrPAPHz</td> <td>2022-06-04 07:59</td> <td>2022-10-29 11:41</td> <td>4</td> <td>3</td> </tr> <tr> <td>1BrEshrz6gVbVuHGBgJ5GuHBvC2sdoeTAJ</td> <td>2022-06-04 02:35</td> <td>2022-10-29 11:42</td> <td>4</td> <td>3</td> </tr> <tr> <td>1CfevVPC8cSpFf7QKQwShrFgQYfyQaoXhc</td> <td>2022-06-06 14:05</td> <td>2022-10-29 12:10</td> <td>6</td> <td>3</td> </tr> <tr> <td>1HzJkTn6Z5nDrgbR6dHVBDVtsRYqwDmGzN</td> <td> 2022-06-03 13:55</td> <td>2022-10-29 11:28</td> <td>8</td> <td>3</td> </tr> <tr> <td>1HSC8Yt2yjuFUSGpUfJnwLMr4HzNxV3dvP</td> <td>2022-06-06 13:58</td> <td>2022-10-29 11:33</td> <td>6</td> <td>0</td> </tr> <tr> <td>1Cxy9e6KtHtBJrQwCwpKgcyp6dhncx6eNh</td> <td>2022-06-03 14:05</td> <td>2022-07-04 16:07</td> <td>4</td> <td>0</td> </tr> <tr> <td>1CzetoTU29WbhNy1UozrQpxuFuCVxffbTd</td> <td> 2022-05-31 15:19</td> <td>2022-10-29 12:04</td> <td>8</td> <td>0</td> </tr> <tr/> </tbody> </table> </figure> <p>The transactions graphs proven in Determine 7 involving the addresses used within the 2022 marketing campaign present the upscaling of the operations since 2019. Lastly, we traced again these transactions even additional, and we imagine that a minimum of 5 totally different retailers and exchanges had been used to fund the Glupteba addresses since 2019.</p> <div class="wp-block-image"> <figure class="aligncenter size-large is-resized"><img decoding="async" loading="lazy" src="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_7-1024x891.png" alt="Figure 7. The graph shows the transaction to and from the addresses involved in the 2022 campaign." class="wp-image-117777" width="599" height="522" srcset="https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_7-1024x891.png 1024w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_7-300x261.png 300w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_7-768x669.png 768w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_7-620x540.png 620w, https://www.nozominetworks.com/wp-content/uploads/2022/12/figure_7.png 1313w" sizes="(max-width: 599px) 100vw, 599px"/><figcaption class="wp-element-caption"><strong>Determine 7</strong>. The graph reveals the transaction to and from the addresses concerned within the 2022 marketing campaign.</figcaption></figure> </div> <h2>Conclusion</h2> <p>On this weblog, we now have proven how Glupteba will be hunted by following blockchain transaction, TLS certificates registrations, and by reverse engineering samples. We additionally had a take a look at how the blockchain can be utilized to retailer arbitrary information and the way risk actors leverage this within the wild. As well as, we tried to shed some gentle on the Glupteba campaigns over time. By way of resilience, we now have seen how the actions Google took to disrupt the Glupteba botnet had an influence on the 2021 marketing campaign, which we imagine ended abruptly. Even with <a target="_blank" href="https://blog.google/outreach-initiatives/public-policy/a-ruling-in-our-legal-case-against-the-glupteba-botnet/" rel="noreferrer noopener nofollow">Google winning a favorable ruling</a> just lately, we hoped it might have inflicted a extreme blow to Glupteba operations, however nearly a yr later we will say it most definitely didn't. Certainly, it took Glupteba about six months to construct a brand new marketing campaign from scratch and distribute it within the wild, and this time on a a lot bigger scale.</p> <p>For defenders and responders, we strongly recommend blocking blockchain-related domains like blockchain.information but in addition Glupteba identified C2 domains in your setting. We additionally suggest monitoring DNS logs and holding the antivirus software program updated to assist stop a possible Glupteba an infection.</p> <h2>Indicators of Compromise</h2> <figure class="wp-block-table is-style-stripes"> <table class="has-fixed-layout"> <thead> <tr> <th>IOC</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>cdneurops[.]pics</td> <td>C2 area 2022</td> </tr> <tr> <td>mastiakele[.]icu</td> <td>C2 area 2022</td> </tr> <tr> <td>mastiakele[.]xyz</td> <td>C2 area 2022</td> </tr> <tr> <td>cdneurops[.]buzz</td> <td>C2 area 2022</td> </tr> <tr> <td>cdneurops[.]store</td> <td>C2 area 2022</td> </tr> <tr> <td>zaoshanghaoz[.]web</td> <td>C2 area 2022</td> </tr> <tr> <td>cdneurop[.]cloud</td> <td>C2 area 2022</td> </tr> <tr> <td>cdneurops[.]well being</td> <td>C2 area 2022</td> </tr> <tr> <td>mastiakele[.]cyou</td> <td>C2 area 2022</td> </tr> <tr> <td>zaoshanghaoz[.]web</td> <td>C2 area 2022</td> </tr> <tr> <td>mastiakele[.]ae[.]org</td> <td>C2 area 2022</td> </tr> <tr> <td>zaoshang[.]ooo</td> <td>C2 area 2022</td> </tr> <tr> <td>cdntokiog[.]studio</td> <td>C2 area 2022</td> </tr> <tr> <td>zaoshang[.]moscow</td> <td>C2 area 2022</td> </tr> <tr> <td>zaoshang[.]ru</td> <td>C2 area 2022</td> </tr> <tr> <td>zaoshanghao[.]su</td> <td>C2 area 2022</td> </tr> <tr> <td>duniadekho[.]bar</td> <td>C2 area 2022</td> </tr> <tr> <td>checkpos[.]web</td> <td>C2 area 2022</td> </tr> <tr> <td>dafflash[.]com</td> <td>C2 area 2021</td> </tr> <tr> <td>godespra[.]com</td> <td>C2 area 2021</td> </tr> </tbody> </table> </figure>

<p> </p> <p>The submit <a target="_blank" rel="nofollow noopener" href="https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain/">Tracking Malicious Glupteba Activity Through the Blockchain</a> appeared first on <a target="_blank" rel="nofollow noopener" href="https://www.nozominetworks.com/">Nozomi Networks</a>.</p> <p class="syndicated-attribution">*** It is a Safety Bloggers Community syndicated weblog from <a target="_blank" href="https://www.nozominetworks.com/" rel="noopener">Nozomi Networks</a> authored by <a target="_blank" href="https://securityboulevard.com/author/0/" title="Read other posts by Nozomi Networks Labs" rel="noopener">Nozomi Networks Labs</a>. Learn the unique submit at: <a target="_blank" href="https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain/" rel="noopener">https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain/</a> </p> </div> <br>[ad_2] <br><a href="https://news.google.com/__i/rss/rd/articles/CBMiYmh0dHBzOi8vc2VjdXJpdHlib3VsZXZhcmQuY29tLzIwMjIvMTIvdHJhY2tpbmctbWFsaWNpb3VzLWdsdXB0ZWJhLWFjdGl2aXR5LXRocm91Z2gtdGhlLWJsb2NrY2hhaW4v0gFmaHR0cHM6Ly9zZWN1cml0eWJvdWxldmFyZC5jb20vMjAyMi8xMi90cmFja2luZy1tYWxpY2lvdXMtZ2x1cHRlYmEtYWN0aXZpdHktdGhyb3VnaC10aGUtYmxvY2tjaGFpbi9hbXAv?oc=5">Source link </a>