Venom Spider Spins Web of New Malware for MaaS Platform

Source: Photo Spirit via Shutterstock

A known threat actor in the malware-as-a-service (MaaS) business known as “Venom Spider” continues to expand capabilities for cybercriminals who use its platform, with a novel backdoor and loader detected in two separate attacks in a recent two-month period.

Researchers at Zscaler ThreatLabz uncovered campaigns between August and October of this year that leveraged a backdoor called called RevC2, as well as a loader called Venom Loader, in attacks that use known MaaS tools from Venom Spider (aka Golden Chickens), according to a blog post published Dec. 2.

RevC2 uses WebSockets to communicate with its command-and-control (C2) server and can steal cookies and passwords, proxy network traffic, and enable remote code execution (RCE). Venom Loader meanwhile uses the victim’s computer name to encode payloads, thus customizing them for each victim as an extra personalization tactic.

Venom Spider is a threat actor known for offering various MaaS tools such as VenomLNK, TerraLoader, TerraStealer, and TerraCryptor that are widely used by groups such as FIN6 and Cobalt for cyberattacks. In fact, FIN6 was seen leveraging Venom Spider’s MaaS platform in October, in a spear-phishing campaign spreading a novel backdoor dubbed “more_eggs” capable of executing secondary malware payloads.

Related:Ransomware’s Grip on Healthcare

Even “More_Eggs”

That platform apparently has been enhanced yet again, this time with two new malware families observed in recent phishing campaigns. RevC2, observed by researchers in a campaign that occurred from August to September, used an API documentation lure to deliver the novel payload.

The attack began with with a VenomLNK file that contains an obfuscated batch (BAT) script that when executed downloads a PNG image from the website hxxp://gdrive[.]rest:8080/api/API.png. The PNG image aims to lure the victim with a document that is titled “APFX Media API Documentation.”

Upon execution, RevC2 used two checks for specific system criteria and then executed only if they both pass, to ensure it’s launched as part of an attack chain, and not in analysis environments such as sandboxes.

Once launched, the backdoor’s capabilities include the ability to: communicate with the C2 using a C++ library called "websocketpp"; steal passwords and cookies from Chromium browsers; take screenshots of the victim’s system; proxy network data using the SOCK5 protocol; and execute commands as a different user using the stolen credentials.

A second campaign occurring between September and October used a cryptocurrency lure to deliver Venom Loader, which in turn spread a JavaScript backdoor providing RCE capabilities that the researchers dubbed “More_eggs lite.” The malware is so-named because it has fewer capabilities than the previously discovered “more_eggs,” ThreatLabz security researcher Muhammed Irfan V A noted in the post.

Related:2 UK Hospitals Targeted in Separate Cyberattacks

“Although it is a JS backdoor delivered via VenomLNK, the variant only includes the capability to perform RCE,” he wrote.

One notable feature of Venom Loader is that the DLL file it used in the observed campaign is custom built for each victim and is used to load the next stage, according to ThreatLabz.

The loader is downloaded from :hxxp://170.75.168[.]151/%computername%/aaa, “where the %computername% value is an environment variable which contains the computer name of the system,” Irfan V A wrote.

Venom Loader then uses %computername% as the hardcoded XOR key to encode its stages of attack, which in this case executes the More_eggs lite backdoor for attackers to carry out RCE.

MaaS Capabilities Expected to Expand

ThreatLabz believes that the new malware included in Venom Spider’s MaaS platform “are early versions, and expect more features and anti-analysis techniques to be added in the future,” Irfan V A wrote.

Zscaler detected the malware using both a sandbox and its cloud security platform, which detected the following threat-name indictors related to the campaign: LNK.Downloader.VenomLNK; Win32.Backdoor.RevC2; and Win32.Downloader.VenomLoader.

Related:Incident Response Playbooks: Are You Prepared?

Zscaler also is providing a Python script that emulates RevC2’s WebSocket server on its GitHub repository as well as included a long list of indicators of compromise (IoCs) in the blog post so defenders can check their respective organization’s systems for evidence of the malware.

About the Author

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.