Tracking Malicious Glupteba Activity Through the Blockchain

Menace actors are more and more leveraging blockchain expertise to launch cyberattacks. By profiting from the distributed and decentralized nature of blockchain, malicious actors can exploit its anonymity for quite a lot of assaults, starting from malware propagation to ransomware distribution.

The Glupteba trojan is an instance of a risk actor leveraging blockchain-based applied sciences to hold out their malicious exercise. On this weblog, Nozomi Networks Lab presents our newest findings on Glupteba and the way safety groups can seek for malicious exercise within the blockchain.

What’s Glupteba?

Glupteba is a backdoor trojan that’s downloaded by way of Pay-Per-Set up networks – on-line advert campaigns that immediate software program or software downloads – in contaminated installers or software program cracks. As soon as Glupteba is energetic on a system, the botnet operators can deploy extra modules from the credential stealer to use kits compromising units on the goal community. There are a number of Glupteba modules aimed toward exploiting vulnerabilities in varied Web of Issues (IoT) home equipment from distributors, similar to MikroTik and Netgear.

Surprisingly, Glupteba leverages the Bitcoin blockchain to distribute its Command and Management (C2) domains to contaminated techniques. Other than the truth that that is an unusual approach, this mechanism can also be extraordinarily resilient to takedowns as there isn’t a technique to erase nor censor a validated Bitcoin transaction. Utilizing the identical strategy that Glupteba is utilizing to cover knowledge throughout the blockchain, researchers can hunt for malicious transactions and get better their payloads. If the stated domains will not be saved in plaintext, reversing the Glupteba samples permits safety researchers to decrypt the payload and entry the embedded domains.

Utilizing the Blockchain to Retailer Information

The Bitcoin blockchain can be utilized to retailer arbitrary knowledge. That is made doable by the OP_RETURN opcode that allows storage of as much as 80 bytes of arbitrary knowledge throughout the signature script. This storage mechanism has a number of benefits. First, it’s resilient to takedowns. As soon as a transaction has been validated, there isn’t a technique to erase it – that is the character of the blockchain. Utilizing this mechanism to distribute C2 area implies that regulation enforcement officers, community defenders, and incident responders haven’t any technique to take down the Bitcoin tackle and erase the transaction. The way in which the Bitcoin blockchain is constructed on high of contemporary cryptography additionally makes this mechanism safe; with out the Bitcoin tackle personal key, one can not ship a transaction with such a knowledge payload originating from the malicious tackle, therefore, taking up the botnet shouldn’t be doable. Moreover, risk actors can encrypt their payload from peering eyes, making the information storage scheme strong and price efficient.

This system has additionally been utilized by the Cerber ransomware prior to now. Bitcoin transactions originating from particular addresses have been monitored and the primary 6 characters of a vacation spot tackle have been used together with a .high TLD appended to> generate a website, which might be used to question the energetic C2 infrastructure.

Glupteba is thought to be utilizing the same mechanism counting on OP_RETURN as an alternative of vacation spot addresses to distribute its C2 domains. In case of a C2 area being taken down, the botnet operators solely have to ship a brand new transaction from the Bitcoin tackle distributing the domains and voila, the malware will regulate its configuration the subsequent time the C2 is refreshed. The latest identified Glupteba bitcoin transaction dates to the eighth of November 2022 with its embedded payload 000c0b0006171c11064d150a0b16.

The hexadecimal payload above doesn’t appear to signify something near a website identify and that’s as a result of Glupteba makes use of, in its newest variant, a XOR encryption scheme to guard the information. As soon as the bottom line is identified, sometimes by reverse engineering a pattern similar to c6d4ce67dd25764f571a84caa19fa6c2b067cae6, decrypting the information turns into easy; see a pattern of this decryption in Github.

The Evolution of Glupteba

Glupteba is thought to make use of the Bitcoin blockchain to distribute its C2 servers since at least 2019. To retrieve the Bitcoin transactions, a number of suppliers are used, normally blockchain.com and blockstream.data. The Glupteba perform accountable for querying blockchain.com to retrieve the transaction knowledge is proven in Determine 1.

The way in which the domains are protected throughout the transactions has barely advanced over time. In 2019, Glupteba used AES-GCM to guard and embed the information within the bitcoin transactions. Every pattern was shipped with a hardcoded key and initialization vector enabling the pattern to decrypt the payload from the Bitcoin transaction. Determine 2 exhibits the decryption routine within the oldest Glupteba variations..

In newer variations of the malware, this scheme was switched to a easy XOR cipher, which is at present getting used. All samples we discovered have been utilizing the identical key: “cheesesauce”. Determine 3 exhibits this key being moved round in reminiscence within the perform accountable to decrypt the ciphertext.

Timeline of Occasions  

Given all that info, we went on a blockchain harvesting tour, scanning your entire Bitcoin blockchain for hidden C2 domains. We tried to decrypt the information payload of the OP_RETURN script current in every transaction of each block utilizing all of the algorithms and keys we all know to be related to Glupteba. As well as, we downloaded over 1500 Glupteba samples from VirusTotal and seemed on the pockets addresses they used to ensure we didn’t miss something. However that’s not all: the most recent set of TLS certificates Glupteba makes use of additionally displays a precise pattern within the Topic Different Names and, due to certificates transparency, this may be hunted for. Lastly, we additionally took an in depth have a look at the passive DNS information at our disposal to search out potential related domains and hosts.
This analysis gave us a large sequence of occasions we determined to summarize with the timeline under, exhibiting when actions have been taken by Glupteba operators.

The 4 Glupteba Campaigns

We have now been in a position to determine 15 Glupteba bitcoin addresses spawning over 4 years and what we imagine to be 4 completely different campaigns.

Marketing campaign 1

The oldest wave appears to have began in June 2019. Again then, just one single Bitcoin tackle was used to distribute the malicious domains. This additionally corroborates what Google came upon of their lawsuit in opposition to two Glupteba operators.

Determine 4 exhibits a graph of the tackle transactions. We will see the OP_RETURN transactions like 3Jt2U the place the funds bounce again to the 15y7d tackle. Curiously all of the remaining $36.18 on the 15y7d tackle have been despatched to the tackle 3Jwj7 in February 2020. No exercise has been noticed at that tackle since then.

Marketing campaign 2

The second wave appears to have began in April 2020, this time two Bitcoin addresses have been used to distribute the malicious C2 domains. Curiously we didn’t discover any samples utilizing the second tackle; it may very well be a testing tackle to make sure the Glupteba variants have been behaving as anticipated. As well as, the area distributed by way of the supposedly testing tackle deepsound[.]stay has not been seen in every other transactions we have been capable of finding throughout each addresses. It is also that we merely are lacking some samples.

Right here the identical sample will be noticed on the principle tackle 1CgPC, after a interval of exercise, the remaining funds accounting for $28.45 have been transferred again to some vendor or service provider in November 2021. On the supposed check Bitcoin tackle, the funds weren’t transferred and stay to today on the account for a stability of $76.80. Determine 5 exhibits the transactions to and from each addresses.

Marketing campaign 3

The third marketing campaign begins in November 2021; the variety of bitcoin addresses used to ship malicious area doubled, from 2 in 2020 to 4 in 2021. This marketing campaign was the shortest of all, with a lifespan of solely about two months. We imagine that is seemingly resulting from Google efforts to take the botnet down, when about 1 12 months in the past Google filed a lawsuit against Glupteba two operators and several other actions have been taken to disrupt the botnet operations. That is additionally the primary time TOR hidden providers have been used as a command-and-control server by Glupteba.

Glupteba operators used 4 wallets, with essentially the most energetic one being 1CUha as proven in Determine 6. Once more, there have been no remaining funds left on the Bitcoin addresses. That is additionally the oldest tackle on this marketing campaign and the one with the very best variety of transactions. Curiously, we weren’t capable of finding a single pattern referring to the tackle 1GLjC which we imagine might have been used for testing the malware, just like 2020. The area used newcc[.]com was additionally not registered on the time and will point out it was utilized in a testing setting or we may very well be lacking some samples.

Marketing campaign 4

The newest and ongoing marketing campaign began in June 2022, 6 months after the Google lawsuit, and this time the variety of malicious bitcoin addresses significantlh elevated. We imagine this is because of a number of components. First, having extra Bitcoin addresses makes safety researcher job extra difficult. Second, to indicate that the Google lawsuit didn’t have a significant impact on their Glupteba operations. For this marketing campaign we weren’t capable of finding any samples for 3 of the addresses we gathered. We imagine these addresses will not be made for testing as they distribute some domains present in different Bitcoin addresses for which we discovered samples. As well as, there was a tenfold improve in TOR hidden service getting used as C2 servers because the 2021 marketing campaign.

The transactions graphs proven in Determine 7 involving the addresses used within the 2022 marketing campaign present the upscaling of the operations since 2019. Lastly, we traced again these transactions even additional, and we imagine that a minimum of 5 completely different retailers and exchanges have been used to fund the Glupteba addresses since 2019.

Conclusion

On this weblog, we’ve got proven how Glupteba will be hunted by following blockchain transaction, TLS certificates registrations, and by reverse engineering samples. We additionally had a have a look at how the blockchain can be utilized to retailer arbitrary knowledge and the way risk actors leverage this within the wild. As well as, we tried to shed some gentle on the Glupteba campaigns through the years. By way of resilience, we’ve got seen how the actions Google took to disrupt the Glupteba botnet had an affect on the 2021 marketing campaign, which we imagine ended abruptly. Even with Google winning a favorable ruling just lately, we hoped it will have inflicted a extreme blow to Glupteba operations, however virtually a 12 months later we are able to say it almost certainly didn’t. Certainly, it took Glupteba about six months to construct a brand new marketing campaign from scratch and distribute it within the wild, and this time on a a lot bigger scale.

For defenders and responders, we strongly counsel blocking blockchain-related domains like blockchain.data but in addition Glupteba identified C2 domains in your setting. We additionally advocate monitoring DNS logs and maintaining the antivirus software program updated to assist stop a possible Glupteba an infection.

Indicators of Compromise

The submit Tracking Malicious Glupteba Activity Through the Blockchain appeared first on Nozomi Networks.

*** It is a Safety Bloggers Community syndicated weblog from Nozomi Networks authored by Nozomi Networks Labs. Learn the unique submit at: https://www.nozominetworks.com/blog/tracking-malicious-glupteba-activity-through-the-blockchain/