Proofpoint security researchers have observed a new series of phishing attacks targeting entities in the United States utilities sector in an attempt to deliver the LookBack remote access Trojan (RAT).
In early August, the security firm detailed a series of similar attacks on the U.S. utilities sector, where phishing emails would carry Word documents containing malicious macros that were designed to download and execute the LookBack Trojan.
Now, Proofpoint says a new wave of attacks was observed between August 21 and August 29, and that additional organizations in the utilities sector were targeted. The emails impersonated a licensing body related to the utilities sector, masquerading as Global Energy Certification (GEC).
The tactics, techniques, and procedures (TTPs) are consistent with previously reported activity. Attached Word documents were once again leveraged for malware delivery.
So far, the security researchers have identified at least 17 entities in the US utilities sector that have been targeted by these threat actors from April 5 through August 29, 2019.
The researchers also discovered that the attackers conducted reconnaissance scanning against future targets utilizing a staging IP. The scanning targeted SMB over IP via port 445 for up to two weeks prior to the sending of the phishing emails.
Originating from an email address at the domain globalenergycertification[.]net, which spoofs the official GEC website, the message invited recipients to take the GEC exam administered by the Energy Research and Intelligence Institution.
In addition to the malicious Word document, the emails also had a legitimate and benign PDF file attached. Designed for exam preparation, the PDF was hosted on the legitimate GEC site.
The VBA macros in the Word document were similar to those observed in July. As soon as the user opens the attachment and enables it, the macro installs several privacy-enhanced mail (PEM) files on the host. These files are both malware modules and macro variables.
Additionally, the macro drops a version of certutil.exe on to the victim’s machine, and leverages it to decode the initial files. The PEM files are a GUP Proxy tool, a malicious loader, and a file containing command and control (C&C) configuration data.
The attackers modified the macros in the recent campaign, by adding some more variables that are referred to when the Word document is opened and macros are enabled. These variables, likely an attempt at obfuscation, are leveraged in the installation of the malicious loader. The C&C server used in this campaign was 103.253.41[.]45, the same as in the July attacks.
“The evolution of TTPs including updated macros demonstrates a further departure from tactics previously employed by known APT groups. However, at the current moment, the creators of LookBack malware are yet to depart from their persistent focus on critical infrastructure providers in the United States,” Proofpoint concludes.
Related: New “LookBack” Malware Used in Attacks Against U.S. Utilities Sector
Related: Hackers Behind ‘Triton’ Malware Target Electric Utilities in US, APAC
