Dangerous new phishing campaign infects Windows devices with malicious Linux VM

A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.

(Image credit: Getty Images)

A phishing attack leads to the download of a large file
The Linux VM comes preloaded with malware, granting crooks all kinds of advantages
Securonix advises caution when handing inbound emails

A creative new phishing technique has been spotted that looks to trick victims into downloading and installing a virtual Linux machine on their Windows endpoints. The virtual machine comes preloaded with a backdoor, granting the crooks unabated access to the compromised devices.

A report from cybersecurity researchers Securonix dubbed the campaign ‘CRON#TRAP’. It starts with a fake “OneAmerica” survey which distributes the VM installation file (285 MB), and a fake error popup image.

If the victims fall for the trick and trigger the installer, it will run in the background, while showing the fake error message in the front. That way, the victims will think that the survey was unavailable at the time. In the background, though, a fully legit version of a Linux VM, called TinyCore, will be installed via QEMU, a legitimate, open-source virtualization tool that allows for emulating various hardware and processor architectures.

Tricking the AV

Since QEMU is legitimate, no antivirus programs flag it as malicious. Furthermore, they will not flag anything that happens in the virtual machine, since it is walled in and operates as a sandbox. “This emulated Linux environment enables the attacker to operate outside the visibility of traditional antivirus solutions,” the researchers explained.

However, since the VM comes with a backdoor, crooks can use it for a number of things, including network testing and initial reconnaissance, tool installation and preparation, payload manipulation and execution, configuration persistence and privilege escalation, SSH key manipulation for remote access, file and environment management, system and user enumeration, and potential exfiltration or command control channels.

The backdoor was said to contain a tool called Chisel, which is a network tunneling program, pre-configured to set up a secure communications channel with the C2 server.

Since the campaign starts with a simple phishing email, Securonix advises care when handling inbound emails.

Via BleepingComputer

Cactus ransomware hackers say they stole terabytes of Schneider Electric data
Here's a list of the best firewalls today
These are the best endpoint protection tools right now

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.