Researchers at email and web security company AppRiver spotted a campaign in which malicious actors attempted to distribute a piece of ransomware with the aid of SVG files.
The attack starts with an email that appears to have a resume attached to it. The file is a ZIP archive containing an SVG file.
SVG (Scalable Vector Graphics) is an XML-based vector image format for two-dimensional graphics with support for animation and interactivity. Images and their behavior are defined in XML files.
SVG files contain a small JavaScript entry, which attackers exploited in the campaign observed by AppRiver to redirect victims to a webpage set up to push a piece of malware.
The JavaScript code in the SVG file analyzed by researchers contains an IP address that forwards users to another domain serving the notorious CryptoWall ransomware. If users execute the malicious file, their computer becomes infected and their important files are encrypted and held for ransom.
“Crypto ransomware has proven many times it is effective for attackers in getting users to actually pay the ransom. The tactic is still alive and likely to continue evolving. With the attacks still being prevalent, it’s a good idea to make sure you are covered with data backups that cannot be potentially accessed by the malware (it’s been known to encrypt network shares and NAS units),” AppRiver researchers said in a blog post.
An interesting aspect noted by experts is that the malicious executable served in this attack contains hardcoded SQL commands that appear to target a school’s database. AppRiver said some of the organizations they protected against this attack were schools, so it’s possible that someone with knowledge of SQL naming conventions used for school databases might have been trying to cause some damage with INSERT and DELETE commands.
However, researchers also pointed out that the SQL commands might have been included simply to make the analysis of the malware more complex and time consuming.
“While these appeared to be part of valid functions, it looks like they were not used during testing. Though it’s possible there were very specific parameters that needed to be met for this to go active and attempt sql changes,” researchers explained.