View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

DanaBot Malware Spear Phishes Enterprise Players Through FTP Links

The phishing emails masquerade as invoices in order to appear legitimate.

By CBR Staff Writer

Researchers have warned enterprise players of a new digital threat: Danabot, malware at the heart of a new phishing campaign specifically targeting SMBs.

Enterprise players, from the largest and most well-known companies to SMBs, are under constant threat of cyberattack. The valuable corporate and customer data they act as wardens for, intellectual property and more can all be attractive lures to cybercriminals.

According to security researchers from TrustWave, DanaBot is a new phishing threat on the scene which appears to be specifically targeting small to medium enterprise players.

The majority of scammers and phishing campaigns follow a predictable pattern. Fraudulent emails are sent out, either en masse in the hopes of catching company employees unaware, or tailored emails are specifically sent to target particular members of a team, such as in HR, sales, or accounting.

The latter will often contain details, secured through social engineering, to appear legitimate and trustworthy.

In either form of campaign, these emails will often contain malicious executables, embedded malicious macros in Microsoft Word documents, or links which connect to fraudulent websites.

However, the new phishing threat is trying out something different.

Content from our partners
How businesses can safeguard themselves on the cyber frontline
How hackers’ tactics are evolving in an increasingly complex landscape
Green for go: Transforming trade in the UK

Controlled by the Threat Actors

According to security researchers from Trustwave, spear phishing emails are being sent to Australian businesses which masquerade as fake invoices sent from MYOB, a mobile cash flow application.

The emails are filled with links that led to File Transfer Protocol (FTP) servers legitimately used to download and transfer files between systems. but in this case it was compromised and controlled by the threat actors.

The majority of the domains involved were Australian, but not all.

If an email recipient fell for the fraudulent message and visited the FTP server the links would point to a downloadable zipped archive.

The archive file contained JavaScript which, once executed, would launch a Powershell command and download the DanaBot malware payload.

Written in Delphi, DanaBot is modular malware which contains a dropper, downloader, and master .DLL. The dropper utilizes the downloader and drops a .DLL file — the master .DLL — before deleting itself.

The master .DLL downloads an encrypted file which splits into two upon execution and contains a set of configurations as well as a selection of malware modules.

The modules include a VNC remote controller, an information stealer designed to target private and sensitive information, a network sniffer and a Tor module. The latter is  used to communicate covertly with the malware’s command-and-control (C&C) server.

In addition, DanaBot is able to launch web injections and monitor cryptocurrency-related activities.

Trustwave researchers say that once a machine is infected, screenshots may be taken and credentials stolen, both of which can give the malware’s operators the information they need to compromise online bank accounts.

Trustwave researchers commented that: “The infrastructure supporting the malware is designed to be flexible while the malware is designed to be modular with functionality spread across multiple components that are heavily encrypted.”

The use of FTP is an interesting twist in phishing campaigns and may have been chosen in response to many of us becoming savvier when it comes to common phishing methods.

It is not known how many businesses may have fallen prey to such tactics, but with 14.5 billion spam emails being sent on a daily basis, phishing campaigns are a problem which is unlikely to vanish any time soon.

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how New Statesman Media Group may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.
THANK YOU