In a recent surge of cyber threats, compromised websites are being exploited to deliver a Windows backdoor known as BadSpace. This malware sneaks into systems under the guise of fake browser updates, posing significant risks to unsuspecting users.
The Multi-Stage Attack Chain
German cybersecurity firm G DATA recently reported that threat actors employ a sophisticated multi-stage attack chain to deliver BadSpace. This process involves several key steps:
- Compromised Website: The attack begins with a legitimate website, often built on platforms like WordPress, which has been compromised to inject malicious code.
- Command-and-Control (C2) Server: The infected website connects to a C2 server.
- Fake Browser Update: In some cases, the malware disguises itself as a fake browser update.
- JScript Downloader: Finally, a JScript downloader is used to deploy the backdoor into the victim’s system.
How It Works
The attack initiates with a compromised website injecting code that determines if a visitor is new. For first-time visitors, the code gathers detailed information about the device, IP address, user-agent, and location, and sends it to a hard-coded domain via an HTTP GET request. The server’s response then overlays the web page with a fake Google Chrome update pop-up.
This deceptive pop-up either directly drops the malware or uses a JavaScript downloader to fetch and execute BadSpace. This method ensures that the malware seamlessly integrates into the victim’s system without raising immediate suspicion.
Connections to Known Malware
An in-depth analysis of the C2 servers used in this campaign revealed links to SocGholish (also known as FakeUpdates), a notorious JavaScript-based downloader. SocGholish has been spreading through similar mechanisms, highlighting a trend in leveraging fake browser updates to distribute malware.
BadSpace Capabilities
Once deployed, BadSpace demonstrates a range of malicious capabilities:
- Anti-Sandbox Checks: It can evade sandbox environments used for malware analysis.
- Persistence: It establishes persistence using scheduled tasks, ensuring it remains active even after system reboots.
- Data Harvesting: The malware can collect system information, execute commands, take screenshots, read and write files, and delete scheduled tasks.
Broader Implications
This disclosure follows warnings from eSentire and Sucuri about different campaigns using bogus browser updates to distribute information stealers and remote access trojans. These threats emphasize the importance of being vigilant when prompted to update your browser, especially on unfamiliar or suspicious websites.
Stay Informed and Protected
At CybrogenIT, we prioritize your cybersecurity. By staying informed about the latest threats and implementing robust security measures, you can protect your systems from malicious attacks like BadSpace.
Found this article interesting? Follow us on Facebook and LinkedIn for more exclusive content and cybersecurity updates.