Threat actors targeting Brazilian users have hijacked Facebook’s content delivery network (CDN) as a vehicle for cybercrime. The actors are using the Facebook CDN as a way to deliver files that hide banking Trojans, according to MalwareHunter.

Cybercriminals use this method because most antivirus solutions will almost always trust such a specialized IP address. The threat actors take advantage of this assumption to slip their malware files past detection.

Similar Security Breaches Reported

Similar attacks have also been described by Palo Alto Networks in its blog, but these attacks use Dropbox and Google’s cloud storage services to store the same infected files. Like the Facebook CDN, neither cloud storage service is usually blocked by standard antivirus products. Again, assumptions made by the product creators proved fallacious in actual practice.

The current campaign specifically targets Brazilian users and starts with a mass email with an embedded link. The letter appears official in nature, and the link points to a RAR or a ZIP file hosted on the CDN. This file is an encoded PowerShell script, which will invoke the local PowerShell application.

Using a local application in this way is a malware trick to bypass some unsophisticated security applications that may be in use.

Bleeping Computer noted that this first link leads to further downloads that are performed before that actual malware is executed. This multilayered approach gives the threat actors greater control over what is actually done on the victim machines based, for example, on the user’s location. In the Facebook-based campaign, a DLL file that is loaded at the last stage of infection will be empty if the user IP is not between a certain range. Only the desired IP addresses will receive the poisoned file that contains a Trojan.

Not Their First Rodeo

The group behind these security breaches seems to have had extensive experience targeting Brazilian users. According to Bleeping Computer, researchers believed that this is the same group that ran the Banload Trojan campaign in 2016 as well as the Escelar Trojan of 2015.

The group also uses sophisticated tracking techniques to gauge how the spammed mail performs. Tracking images are embedded within the email and served by goo.gl shortened links. This can allow them to track how many messages were opened. With this technique, it was found that users opened the mail 200,000 times on Sept. 2 alone.

Facebook has been informed of the situation.