TA16-336A: Avalanche (crimeware-as-a-service infrastructure)

U.S. Department of Homeland Security US-CERT

National Cyber Awareness System:


TA16-336A: Avalanche (crimeware-as-a-service infrastructure)
12/01/2016 12:00 AM EST

Original release date: December 01, 2016
Systems Affected

Microsoft Windows
Overview

“Avalanche” refers to a large global network hosting infrastructure used by 
cyber criminals to conduct phishing and malware distribution campaigns and 
money mule schemes. The United States Department of Homeland Security (DHS),
in 
collaboration with the Federal Bureau of Investigation (FBI), is releasing
this 
Technical Alert to provide further information about Avalanche.
Description

Cyber criminals utilized Avalanche botnet infrastructure to host and
distribute 
a variety of malware variants to victims, including the targeting of over 40 
major financial institutions. Victims may have had their sensitive personal 
information stolen (e.g., user account credentials). Victims’ compromised 
systems may also have been used to conduct other malicious activity, such as 
launching denial-of-service (DoS) attacks or distributing malware variants to 
other victims’ computers.

In addition, Avalanche infrastructure was used to run money mule schemes where 
criminals recruited people to commit fraud involving transporting and 
laundering stolen money or merchandise.

Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind 
a constantly changing network of compromised systems acting as proxies.

The following malware families were hosted on the infrastructure:

    Windows-encryption Trojan horse (WVT) (aka Matsnu, 
Injector,Rannoh,Ransomlock.P)
    URLzone (aka Bebloh)
    Citadel
    VM-ZeuS (aka KINS)
    Bugat (aka Feodo, Geodo, Cridex, Dridex, Emotet)
    newGOZ (aka GameOverZeuS)
    Tinba (aka TinyBanker)
    Nymaim/GozNym
    Vawtrak (aka Neverquest)
    Marcher
    Pandabanker
    Ranbyus
    Smart App
    TeslaCrypt
    Trusteer App
    Xswkit

Avalanche was also used as a fast flux botnet which provides communication 
infrastructure for other botnets, including the following:

    TeslaCrypt
    Nymaim
    Corebot
    GetTiny
    Matsnu
    Rovnix
    Urlzone
    QakBot (aka Qbot, PinkSlip Bot)

Impact

A system infected with Avalanche-associated malware may be subject to
malicious 
activity including the theft of user credentials and other sensitive data,
such 
as banking and credit card information. Some of the malware had the capability 
to encrypt user files and demand a ransom be paid by the victim to regain 
access to those files. In addition, the malware may have allowed criminals 
unauthorized remote access to the infected computer. Infected systems could 
have been used to conduct distributed denial-of-service (DDoS) attacks.
Solution

Users are advised to take the following actions to remediate malware
infections 
associated with Avalanche:

    Use and maintain anti-virus software – Anti-virus software recognizes and 
protects your computer against most known viruses. Even though parts of 
Avalanche are designed to evade detection, security companies are continuously 
updating their software to counter these advanced threats. Therefore, it is 
important to keep your anti-virus software up-to-date. If you suspect you may 
be a victim of an Avalanche malware, update your anti-virus software 
definitions and run a full-system scan. (See Understanding Anti-Virus Software 
for more information.)
    Avoid clicking links in email – Attackers have become very skilled at 
making phishing emails look legitimate. Users should ensure the link is 
legitimate by typing the link into a new browser (see Avoiding Social 
Engineering and Phishing Attacks for more information).
    Change your passwords – Your original passwords may have been compromised 
during the infection, so you should change them. (See Choosing and Protecting 
Passwords for more information.)
    Keep your operating system and application software up-to-date – Install 
software patches so that attackers cannot take advantage of known problems or 
vulnerabilities. You should enable automatic updates of the operating system
if 
this option is available. (See Understanding Patches for more information.)
    Use anti-malware tools – Using a legitimate program that identifies and 
removes malware can help eliminate an infection. Users can consider employing
a 
remediation tool. A non-exhaustive list of examples is provided below. The
U.S. 
Government does not endorse or support any particular product or vendor.

          ESET Online Scanner

          https://www.eset.com/us/online-scanner/

          F-Secure

          https://www.f-secure.com/en/web/home_global/online-scanner

          McAfee Stinger

          http://www.mcafee.com/us/downloads/free-tools/index.aspx

          Microsoft Safety Scanner

          https://www.microsoft.com/security/scanner/en-us/default.aspx

          Norton Power Eraser

          https://norton.com/npe
References

    https://www.us-cert.gov/sites/default/files/publications/money_mules.pdf
    http://www.bankinfosecurity.com/avalanche-group-linked-to-fraud-a-2573

Revision History

    December 1, 2016: Initial release

This product is provided subject to this Notification and this Privacy & Use 
policy.
A copy of this publication is available at www.us-cert.gov. If you need help
or 
have questions, please send an email to info@us-cert.gov. Do not reply to this 
message since this email was sent from a notification-only address that is not 
monitored. To ensure you receive future US-CERT products, please add 
US-CERT@ncas.us-cert.gov to your address book.
OTHER RESOURCES:
Contact Us | Security Publications | Alerts and Tips | Related Resources
STAY CONNECTED:
Sign up for email updates

SUBSCRIBER SERVICES:
Manage Preferences  |  Unsubscribe  |  Help
This email was sent to Fido4cmech@lusfiber.net using GovDelivery, on behalf
of: 
United States Computer Emergency Readiness Team (US-CERT) · 245 Murray Lane SW 
Bldg 410 · Washington, DC 20598 · (888) 282-0870         Powered by GovDelivery
=== Cut ===


ÖÄ Keep the faith, ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ·
³                                                                    ³
³    Ben  aka cMech  Web: http|ftp|binkp|telnet://cmech.dynip.com    ³
³                  Email: fido4cmech(at)lusfiber.net                 ³
³              Home page: http://cmech.dynip.com/homepage/           ³
ÓÄÄÄÄÄÄÄÄÄÄÄ WildCat! Board 24/7  +1-337-984-4794  any BAUD 8,N,1 ÄÄĽ

... Calvin: I've changed my mind, Hobbes.  People are scum.
--- GoldED+/W32-MSVC v1.1.5 via Mystic BBS
 * Origin: FIDONet - The Positronium Repository (1:393/68)