Malware Using Memes Posted on Twitter as C&C Service

Researchers have observed a new threat using malicious memes posted on Twitter to receive command-and-control (C&C) instructions.

Trend Micro observed that the malicious activity begins after a threat detected as “TROJAN.MSIL.BERBOMTHUM.AA” executes on an infected machine. As of this writing, the Japanese multinational digital security firm had not identified the delivery mechanism for the malware. Though it had ruled out Twitter as a means of downloading the trojan.

Upon execution, the malware looks up two tweets posted on 25 October 2018 and 26 October 2018 and then downloads two memes contained therein. The memes themselves look benign. But they actually employ steganography, a practice which has featured prominently in previous data exfiltration campaigns, to conceal malicious commands for the trojan.

Aliakbar Zahravi, malware analyst at Trend Micro, discusses one such command contained in the malicious memes:

In the case of the “print” command hidden in the memes, the malware takes a screenshot of the infected machine. It then obtains the control server information from Pastebin. Afterwards, the malware sends out the collected information or the command output to the attacker by uploading it to a specific URL address.

At the time of their analysis, Zahravi and his fellow Trend Micro researchers observed the Pastebin URL pointing to an internal or private IP address, which the digital attackers could be using as a temporary placeholder.

The security firm found that the malicious memes contained five commands in total. Aside from “print,” the malware could extract the “/process” instruction to acquire a list of running processes on the infected machines. It could also use “/clip” to capture clipboard content, “/username” to obtain the username for the infected machine and “/docs” (Read more...)