menu

Contact Us

1 (800) 723-1166 |

Security Labs

HomeSecurity Labs
HomeSecurity Labs

Forcepoint Security Labs™ brings together researchers, engineers and thought leaders from around the world to discover, investigate, report and – ultimately – protect our customers from sophisticated, evasive and evolving Web- and email-based threats.

Find out more about the work we do through our blogs, annual reports, conference presentations and podcasts.

The Horse Pill rootkit was presented at Black Hat 2016 by Michael Leibowitz, a security engineer and member of the Red Team at Intel. Horse Pill is a proof-of-concept Linux rootkit that demonstrates two interesting techniques: 1. infecting systems via the initial ramdisk, and 2. deceiving system owners using container primitives. In this article we explore those techniques and how our product, Forcepoint Threat Protection for Linux, fares against them.

Initrd Infection

The initial ramdisk, or initrd, is a compressed archive containing files needed by a Linux system early in the boot process. The initrd is loaded into memory,... Read more

Back in 2012, we saw the first malware abuse to cloud-storage services in the form of an information-stealing trojan. The trojan collected Microsoft Word and Excel files from affected PCs, archived them, and then uploaded the archive to the file hosting website, SendSpace, so that it can be later accessed by the cybercriminals behind it. Fast forward to today, and the same abuse has become a de facto standard for many cybercriminals, perhaps primarily for spreading malware. Free cloud-storage services are used to host malware where the generated download links are sent to prospective victims as part of social engineering lure.... Read more

Introduction

Forcepoint Security Labs™ recently encountered a strain of attacks that appear to target Pakistani nationals. We named the attack "BITTER" based on the network communication header used by the latest variant of remote access tool (RAT) used:

Our investigation indicates that the campaign has existed since at least November 2013 but has remained active until today. This post intends to share the results of our research.

Infection Vector

Spear-phishing emails are used to target prospective BITTER victims. The campaign predominantly used the older, relatively popular Microsoft Office exploit, CVE-... Read more

FREEMAN is a uniquely positioned security research project conducted by Forcepoint Security Labs™. It identifies unknown risks and threats that accompany a specific piece of abandonware commonly used by the security research community. We have released our research in the form of a whitepaper. A download link is provided below.

“What started out as a simple ‘what-if?’ activity, quite literally set-up from the back rows of a talk at Blackhat Europe in 2015, soon turned into a long-term data collection and analysis project. I cannot overstate the surprise felt when we first looked at the data collected. The sheer... Read more

On September 27, 2016 Forcepoint Security Labs noticed that the Russian boxing site allboxing[.]ru was compromised. The site is injected with code that attempts to silently redirect users to a third party website containing an exploit and a Russian banking trojan. The injected code employs several evasion tactics, and ensures that the redirect only occurs when there is significant user interaction on the website.

Hiding in Plain Sight

The site allboxing[.]ru is a very popular Russian boxing website receiving an estimated 3 million visitors per month.

One of the scripts being used by the website at hxxp://... Read more

Throughout September 2016 we have observed an actor sending malware to Canadian nationals by e-mail. Upon investigation we have determined the malware payload to be DELoader, which downloads a Zeus variant banking trojan upon execution.

E-mail Lures

The e-mails typically pretend to be from the Canada Revenue Agency (CRA) claiming that the individual has a tax payment outstanding.

The e-mails contain an MSG attachment with an embedded OLE object. This is not a technique we see very often and is challenging for security products to detect due to the complicated MSG format. When the user opens the MSG attachment... Read more

On September 1, 2016 a new trojan downloader became available to purchase on various Russian underground forums. Named "Quant Loader" by its creator, the downloader has already been used to distribute the Locky Zepto crypto-ransomware, and Pony (aka Fareit) malware families.

Locky Zepto & Pony E-mail Campaign

On September 12, 2016 Forcepoint Security Labs™ noticed an e-mail campaign which was typical of one we mainly see distributing the Locky or Dridex botnet 220 malware families. The e-mails themselves masqueraded as an invoice document like the one below.

 

The attached ZIP file contained a malicious... Read more

Dridex has drastically reduced in volume throughout 2016. Actors are now appearing to prefer crypto-ransomware such as Locky over the infamous banking trojan. However, Dridex is still being actively developed.  Here is Forcepoint Security Labs we have seen a number of changes and improvements over the last few months.

Command-and-Control (C&C) Blacklisting

The initial Dridex executable is known as the Dridex Loader.  It is responsible for checking in to its C&C servers, requesting the "bot" module and a "list" of peers to communicate with. The module contains all of the core Dridex functionality and is known as the "... Read more

MONSOON is the name given to the Forcepoint Security Labs™ investigation into an ongoing espionage campaign that the Special Investigations team have been tracking and analysing since May 2016. We have released our technical analysis in the form of a whitepaper. A download link is provided below.

Monsoon Targets Specific Victims

The overarching campaign appears to target both Chinese nationals within different industries and government agencies in Southern Asia. It appears to have started in December 2015 and is still ongoing as of July 2016. The malware components used in MONSOON are typically distributed through... Read more

An actor known for distributing the Kovter and Miuref (aka Boaxxe) malware families has been working on a Javascript-based Nemucod ransomware for several months. Recently the actor has begun dropping legitimate command line utilities like 7Zip and PHP onto infected systems to perform the encryption. The malicious use of these benign tools makes this an effective and tricky-to-detect threat. We have dubbed this ransomware "NELocker".

E-mail Lures

The actor distributes their malware by e-mail. A recent e-mail campaign posed as a confusing courier e-mail.

A ZIP file is attached here, which contains a malicious... Read more