Darkleech Says Hello
There's never a dull day at href="/content/fireeye-www/en_US/index.html">FireEye -- even on
the weekends. At approximately 7:29 AM PDT today, we were notified by
several security researchers that a fireeye[.]com/careers HR link was
inadvertently serving up a drive-by download exploit. Our internal
security, IT operations team, and third-party partners quickly
researched and discovered that the malicious code was not hosted
directly on any FireEye web infrastructure, but rather, it was
hosted on a third-party advertiser (aka "malvertisement")
that was linked via one of our third-party web services. The
team then responded and immediately removed links to the malicious
code in conjunction with our partners in order to protect our website
users. More information on this third-party compromise (of video.js)
can be found here.
Technical Details
The full redirect looked like this:
hxxp://www[.]fireeye[.]com/careers/
(redirect to) -> hxxp://xxx[.]xxxxxxxx[.]com/career/
CareerHome.action?clientId=8aa00506326e915601326f65b82e1fcb
(calls) -> hxxp://vjs[.]zencdn[.]net/c/video.js (VULNERABLE JAVASCRIPT)
(calls) -> hxxp://cdn[.]adsbarscipt[.]com/links/jump/ (MALVERTISEMENT)
(calls) -> hxxp://209[.]239[.]127[.]185/591918d6c2e8ce3f53ed8b93fb0735cd
/face-book.php (EXPLOIT URL)
(drops) -> MD5: href="https://www.virustotal.com/en/file/ea3be0fb4367e038c602a3de5811821d2367f3326ab2a12f469db4cda06fafa7/analysis/" target="_blank">01771c3500a5b1543f4fb43945337c7d
(Update_flash_player.exe)
So what was this, anyway?
It turns out, this attack was not targeted and it was not
a watering hole attack. Instead, this campaign appears to be a
recent wave of the href="http://www.gironsec.com/blog/2013/09/reversing-the-darkleech-exploit-kit/"
target="_blank">Darkleech malware campaign, where third-party href="http://kb.parallels.com/en/113374" target="_blank">Horde/IMP
Plesk Webmail servers were vulnerable to attack and used to
serve up Java exploits that ultimately drop yet another ransomware
named href="http://www.f-secure.com/v-descs/trojan_w32_reveton.shtml"
target="_blank">Reveton (similar to href="http://malware.dontneedcoffee.com/2013/07/urausy-ransomware-july-2013-design.html?q=reveton"
target="_blank">Urausy) -- yet other AV engines report it as a target="_blank">Zeus Bot (Zbot) variant.
Do FireEye products detect this attack?
Yes, the initial infection vector, payload, and corresponding
Reveton callbacks were fully detected across all FireEye products
prior to this incident being reported to us. In fact, this particular
Reveton sample has been reported by approximately 49 of our worldwide
customers, so far. Further intelligence about this threat is listed below:
- DTI Statistics for MD5: 01771c3500a5b1543f4fb43945337c7d
- MD5 first seen by our customers: 2013-09-14 07:12:40
UTC - Number of unique worldwide FireEye Web MPS detections:
188+ - Number of unique FireEye Web MPS customers
reported/alerted on this sample: 49+ - Number of
industries affected: 12+
class="aligncenter landscape-med"
alt="Industries affected by Reveton"
src="https://www.fireeye.com/content/dam/legacy/blog/2013/09/urausy.png"
width="592" height="381" />
Lastly, FireEye acknowledges and thanks security researchers Inaki
Rodriguez and Stephanus J Alex Taidri for bringing this issue to our attention.
Source: Darkleech Says Hello (http://)
