The threat actors behind the CopperStealer malware resurfaced in March and April 2023 with two new campaigns designed to deliver two new payloads named CopperStealth and CopperPhish.
See also: Lancefly hacking group uses MerDoor malware
Trend Micro is tracking the financially motivated group called “Water Orthrus.” The adversary is also believed to be behind another campaign, known as “Scranos,” which was detailed by Bitdefender in 2019.
Active since at least 2021, Water Orthrus has a history of leveraging pay-per-install (PPI) networks to redirect victims who land on cracked software download sites in order to drop an information stealer codenamed CopperStealer.
In August 2022, another campaign was detected that involved the use of CopperStealer to distribute Chromium-based web browser extensions capable of performing unauthorized transactions and transferring cryptocurrencies from victims' wallets to wallets under the control of the attackers.
See also: RA Group ransomware: Targets companies in the US and South Korea
The latest attack sequences recorded by Trend Micro do not show much deviation, spreading CopperStealth by packaging it as installers for free tools on Chinese software exchange websites.
The driver denylist contains byte sequences associated with Chinese security software companies such as Huorong, Kingsoft, and Qihoo 360.
CopperStealth also incorporates a task module that allows it to call a remote server and retrieve the command to be executed on the infected machine, equipping the malware to drop more payloads.
File-sharing sites act as conduits for CopperPhish Phishing Kit
The CopperPhish campaign, detected globally in April 2023, exploits a similar process to deploy malware via P2P networks behind free and anonymous file-sharing websites.
The download service, which is also offered on a pay-per-use basis, is used to retrieve and launch CopperPhish, a phishing kit responsible for collecting credit card information.
It achieves this by “starting a rundll32 process and injecting a simple program with a browser window (written in Visual Basic)”, which loads a phishing page that prompts victims to scan a QR code to verify their identity and enter a confirmation code to “reset their device’s network ”
Once the sensitive information is entered on the page, the CopperPhish malware displays the message “the identity verification has passed,” along with a confirmation code that the victim can enter on the aforementioned screen.
See also: Ransomware group stole data of 5.8 million PharMerica patients
Providing the correct confirmation code also forces the malware to uninstall and delete all phishing files from the machine.
Water Orthrus' performance is based on the fact that both CopperStealth and CopperPhish share similar source code to those of CopperStealer, raising the possibility that all three strains may have been developed by the same author.
The different campaign objectives represent the evolution of the threat actor's tactics, suggesting an effort to add new capabilities to its arsenal and expand its economic horizons.
The findings come as malicious Google ads are being used to trick users into downloading fake installers for AI tools, such as Midjourney and ChatGPT , which ultimately lead to drop stealers, such as Vidar and RedLine.
They also followed up with the discovery of a new traffic monopolization service called TrafficStealer that leverages misconfigured containers to redirect traffic to websites and generate fake ad clicks as part of an illegal profiteering scheme.
Information source: thehackernews.com
