Researchers discovered a new downloader, dubbed AdvisorsBot, as part of an attack campaign that uses malicious emails to target companies in the telecommunications and hospitality industries.

First observed by Proofpoint in May 2018, AdvisorsBot is a previously undocumented downloader that’s now appearing as part of a phishing campaign crafted specifically to compromise telecommunications companies, restaurants and hotels. According to Proofpoint, the campaign is likely the work of a threat actor known as TA555, who uses this malware as a first-stage payload.

While AdvisorsBot is modular and contains command-and-control (C&C) capabilities, Proofpoint has only observed the malware actively sending fingerprint module data — which it uses to identify potential targets — back to the C&C. Over the past four months, three separate AdvisorsBot variations have been used in attack campaigns; the latest iteration included an entirely PowerShell version of the malware.

Malicious Emails Highly Targeted to Specific Industries

Key to the success of this malware campaign is the use of malicious emails designed to elicit a response from targets. Restaurants receive messages about food poisoning with attached doctors’ reports, for example, while hotels are targeted with emails about double service charges with attached credit statements. Telecommunications companies, meanwhile, receive job application emails with resumes or CV attachments.

If users open these malicious attachments and enable Microsoft Word macros, AdvisorsBot downloads, fingerprints the system for potential interest to attackers and then sends this data to the C&C server. The result is an increased risk of phishing success with emails that go the extra mile to appear legitimate.

Another concern around AdvisorsBot is ongoing development. As noted by Proofpoint, the malware is “under active development and we have also further observed another version of the malware completely rewritten in PowerShell and .NET.” In May and June, for example, the malicious documents contained PowerShell scripts to download AdvisorsBot. On Aug. 8, the macro was modified to include a PowerShell command that downloaded another PowerShell script before downloading the malware.

In addition, AdvisorsBot uses junk code and Windows application programming interface (API) function hashing to evade security analysis. This continual evolution means that successfully countering one version of AdvisorsBot may not ensure defense against the next.

How to Avoid AdvisorsBot

According to the IBM X-Force Exchange advisory for this threat, security teams should block specific IPs (162.244.32.148 and 185.180.198.56) associated with AdvisorsBot, along with URLs such as investments-advisors.bid, interactive-investments.bid and real-estate-advisors.win.

IBM experts also recommend adopting a layered approach to email security that includes spam control and monitoring, external mail scanning, perimeter protection, and training for end users to avoid common phishing attack techniques — such as the highly targeted malicious emails that precede AdvisorsBot infections.

Source: Proofpoint