Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Additional U.S. Utilities Targeted With LookBack Malware

Proofpoint security researchers have observed a new series of phishing attacks targeting entities in the United States utilities sector in an attempt to deliver the LookBack remote access Trojan (RAT).

Proofpoint security researchers have observed a new series of phishing attacks targeting entities in the United States utilities sector in an attempt to deliver the LookBack remote access Trojan (RAT).

In early August, the security firm detailed a series of similar attacks on the U.S. utilities sector, where phishing emails would carry Word documents containing malicious macros that were designed to download and execute the LookBack Trojan.

Now, Proofpoint says a new wave of attacks was observed between August 21 and August 29, and that additional organizations in the utilities sector were targeted. The emails impersonated a licensing body related to the utilities sector, masquerading as Global Energy Certification (GEC).

The tactics, techniques, and procedures (TTPs) are consistent with previously reported activity. Attached Word documents were once again leveraged for malware delivery.

So far, the security researchers have identified at least 17 entities in the US utilities sector that have been targeted by these threat actors from April 5 through August 29, 2019.

The researchers also discovered that the attackers conducted reconnaissance scanning against future targets utilizing a staging IP. The scanning targeted SMB over IP via port 445 for up to two weeks prior to the sending of the phishing emails.

Originating from an email address at the domain globalenergycertification[.]net, which spoofs the official GEC website, the message invited recipients to take the GEC exam administered by the Energy Research and Intelligence Institution.

In addition to the malicious Word document, the emails also had a legitimate and benign PDF file attached. Designed for exam preparation, the PDF was hosted on the legitimate GEC site.

The VBA macros in the Word document were similar to those observed in July. As soon as the user opens the attachment and enables it, the macro installs several privacy-enhanced mail (PEM) files on the host. These files are both malware modules and macro variables.

Additionally, the macro drops a version of certutil.exe on to the victim’s machine, and leverages it to decode the initial files. The PEM files are a GUP Proxy tool, a malicious loader, and a file containing command and control (C&C) configuration data.

The attackers modified the macros in the recent campaign, by adding some more variables that are referred to when the Word document is opened and macros are enabled. These variables, likely an attempt at obfuscation, are leveraged in the installation of the malicious loader. The C&C server used in this campaign was 103.253.41[.]45, the same as in the July attacks.

“The evolution of TTPs including updated macros demonstrates a further departure from tactics previously employed by known APT groups. However, at the current moment, the creators of LookBack malware are yet to depart from their persistent focus on critical infrastructure providers in the United States,” Proofpoint concludes.

Related: New “LookBack” Malware Used in Attacks Against U.S. Utilities Sector

Related: Hackers Behind ‘Triton’ Malware Target Electric Utilities in US, APAC

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Cybercrime

Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Malware & Threats

Cybercrime in 2017 was a tumultuous year "full of twists and turns", with new (but old) infection methods, a major return to social engineering,...

Malware & Threats

Norway‎-based DNV said a ransomware attack on its ship management software impacted 1,000 vessels.

Cybercrime

Security researchers with Juniper Networks’ Threat Labs warn of a new Python-based backdoor targeting VMware ESXi virtualization servers.