A new malware threat named Squirrelwaffle has emerged in the wild, supporting actors with an initial foothold and a way to drop malware onto compromised systems and networks.
The new malware tool spreads via spam campaigns dropping Qakbot and Cobalt Strike in the most recent campaigns.
Discovered by researchers at Cisco Talos, Squirrelwaffle is one of the tools that emerged as an Emotet replacement shortly after the law enforcement disruption on the widely used botnet.
This new threat first appeared in September 2021, with distribution volumes peaking at the end of that month. While the spam campaign primarily uses stolen reply-chain email campaigns in English, the threat actors also utilize French, German, Dutch, and Polish emails.
Source: Cisco Talos
These emails contain hyperlinks to malicious ZIP archives hosted on attacker-controlled web servers and typically include a malicious .doc or a .xls attachment that runs malware-retrieving code if opened.
On several documents sampled and analyzed by Talos researchers, the actors use the DocuSign signing platform as bait to trick the recipients into enabling macros on their MS Office suite.
Source: Cisco Talos
The contained code leverages string reversal for obfuscation, writes a VBS script to %PROGRAMDATA%, and executes it.
This action fetches Squirrelwaffle from one of the five hardcoded URLs, delivering it in the form of a DLL file onto the compromised system.
Source: Cisco Talos
The Squirrelwaffle loader then deploys malware like Qakbot or the widely abused penetration testing tool Cobalt Strike.
Cobalt Strike is a legitimate penetration testing tool designed as an attack framework to test an organization’s infrastructure to discover security gaps and vulnerabilities.
However, cracked versions of Cobalt Strike are also used by threat actors (commonly seen used during ransomware attacks) for post-exploitation tasks after deploying beacons, which provide them with persistent remote access to compromised devices.
Squirrelwaffle also features an IP blocklist that is populated with notable security research firms as a way to evade detection and analysis.
All communications between Squirrelwaffle and the C2 infrastructure are encrypted (XOR+Base64) and sent via HTTP POST requests.
Source: Cisco Talos
The threat actors leverage previously compromised web servers to support the file distribution aspect of their operations, with most of these sites running WordPress 5.8.1.
On these servers, the adversaries deploy “antibot” scripts that help prevent white-hat detection and analysis.
Other established actors have deployed several of the methods covered in the Cisco Talos report in the past.
As such, Squirrelwaffle may be a reboot of Emotet by members who dodged law enforcement or other threat actors attempting to fill the void left behind by the notorious malware.
Due to its increasing utilization, Cisco Talos advises all organizations and security professionals to become aware of the TTPs used in this malware’s campaigns.
To read the original article: