Rewterz Threat Alert: The Cobalt gang exploiting Google App Engine to distribute malware through PDF decoy documents

SEVERITY: HIGH

CATEGORY: DATA BREACH

ANALYSIS SUMMARY

Known for targeting financial organizations, the Cobalt gang resurfaces with another campaign that drops malware. About 42 targets from the financial and banking sector around the World have been attacked by the Cobalt gang’s campaign, meant to drop malware via PDF decoys using App Engine Google Cloud computing platform (GCP).

The attackers are abusing the GCP URL redirection in PDF decoys and redirecting to the malicious URL hosting the malicious payload.

The URL hosting the malware points the host URL to Google App Engine, making it more trust-able for the targets. Most of the PDF’s involved were created using Adobe Acrobat 18.0. The PDF decoy downloads a word document containing obfuscated macro code. This document was downloaded from the URL https://transef[.]biz.

Once the download is complete, a message pops up on opening the document that requires enabling editing and content mode to view the document. On enabling the option, the macro is executed downloading another stage payload.

IMPACT

Code Execution

Malware Infection

INDICATORS OF COMPROMISE

URLs

• pace[.]edu
• ulaval[.]ca
• metacase[.]eu
• ivywise[.]com
• transef[.]biz
• ebf[.]eu[.]com
• hxxps://appengine.google[.]com/_ah/logout?continue=https%3A%2F%2Ftransef[.]biz%2FDoc102018[.]doc
• https://appengine.google[.]com/_ah/logout?continue=https%3A%2F%2Fswptransaction-scan2034[.]s3[.]ca-central-1[.]a mazonaws[.]com%2FDoc102018[.]doc

FILENAME

• fr[.]txt

EXTENSION

.eml

EMAIL ADDRESS

• jk01814n[@]pace[.]edu
• benoit[.]filion[.]2[@]ulaval[.]ca
• alexandre[.]custeau[.]1[@]ulaval[.]ca
• dominique[.]denis-berube[.]1[@]ulaval[.]ca
• helpdesk[@]metacase[.]eu
• adrienne[@]ivywise[.]com
• info[@]ebf[.]eu[.]com
• sec[@]ebf[.]eu[.]com
• r[.]evans[@]ebf[.]eu[.]com

REMEDIATION

• Block the threat indicators at their respective controls.
• Warn users against opening un-trusted attachments, regardless of their extensions or filenames.
• Warn users to avoid executing any file without confirming that they are not malicious.
• Un-check the option “Remember this action for this site for all PDF documents” in the PDF reader software. The Default Allow policy can help in downloading malware even from trusted sites like Google App Engine.