Cutwail Spam Swapping Blackhole for Magnitude Exploit Kit

Shortly after reports that the developer of the Blackhole exploit kit was arrested, one of the groups leveraging the Cutwail spam botnet changed tactics, switching which exploit kit they use to distribute malware.

Cutwail has historically distributed the Gameover Zeus trojan through various themed spam campaigns (see Figure 1) in combination with malicious embedded links that led to the Blackhole exploit kit. Dell SecureWorks Counter Threat Unit™ (CTU™) security intelligence researchers have observed a shift by one of the groups using the Cutwail botnet from Blackhole to another exploit kit known in the security community as Magnitude (formerly known as Popads).

Figure 1. Example of spam lure distributed by the Cutwail botnet. (Source: Dell SecureWorks)

The spam email contains an embedded malicious link that opens a website and displays the message “We detected your browser is NOT up-to-date” (see Figure 2).

Figure 2. Example of fake "update your browser" website. (Source: Dell SecureWorks)

This message is part of a social engineering ploy to convince users to download and run an executable. Instead of a browser update, the user unknowingly installs Gameover Zeus. At the same time, a malicious iFrame redirects the browser to the Magnitude exploit kit. CTU researchers observed Magnitude installing the ZeroAccess trojan if the victim’s system was vulnerable to any of the attempted vulnerabilities:

• CVE-2011-3402
• CVE-2012-0507
• CVE-2013-2463
• CVE-2013-2551

Figure 3 shows the network activity for the Magnitude exploit kit from the landing page, and the ZeroAccess geographic lookup using the Maxmind JavaScript API.

Figure 3. Request chain associated with Magnitude exploit kit. (Source: Dell SecureWorks)

Cybercriminals quickly adjusted their operation to maintain continuity. Combining social engineering with ex ploit kits sets the stage for a successful campaign and maximizes the potential for infecting as many victims as possible.

CTU researchers recommend that customers use available controls to restrict access using the indicators in Table 1. The domains listed in the indicators table may contain malicious content, so consider the risks before opening them in a browser.

Table 1. Indicators associated with these threats.