Glossary term
MITRE ATT&CK
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
Read more
Significant cyber incident
Bankshot implant attacks on the Turkish financial sector
In March 2018, McAfee Advanced Threat Research reported the Bankshot implant, linked to North Korean Hidden Cobra activity, at five Turkish financial and government-finance organizations.
In short
In March 2018, McAfee Advanced Threat Research reported the Bankshot implant, linked to North Korean Hidden Cobra activity, at five Turkish financial and government-finance organizations. A Word document carried a Flash exploit for CVE-2018-4878 that fetched the implant. MITRE ATT&CK records the use as Lazarus Group against the Turkish financial sector in 2018. McAfee reports no theft.
What happened
On 8 March 2018, McAfee Advanced Threat Research published its analysis of an attack on Turkish financial organizations. The team found the campaign on 28 February, and its telemetry showed infections on 2 and 3 March.
The first target was a major government-controlled financial organization. The implant then appeared at another Turkish government body involved in finance and trade, and at three large Turkish financial institutions. McAfee did not name them and saw the implant in no other sector or country.
Targets received spear-phishing emails with a Word document. The main sample, Agreement.docx, looked like a Bitcoin distribution agreement template between an individual in Paris and a cryptocurrency exchange to be named. It contained a Flash exploit for CVE-2018-4878 that downloaded the Bankshot DLL from falcancoin.io, a domain that imitated a cryptocurrency lending platform.
McAfee found two more documents, written in Korean, that used the same exploit and domain and had cryptocurrency security themes. It judged that the attack resembled earlier Hidden Cobra operations against the SWIFT network. MITRE ATT&CK links the same tool to the Lazarus Group profile and dates the use against the Turkish financial sector to 2018.
The tool itself was already public. DHS and the FBI described seven related files in malware analysis report MAR-10135536-B on 13 December 2017. A US-CERT alert on 21 December 2017 pointed to the report.
Timeline
- 13 December 2017
DHS and FBI analysis report. DHS and the FBI date malware analysis report MAR-10135536-B on the BANKSHOT variants.
- 21 December 2017
US-CERT alert. An alert on North Korean malicious cyber activity points to the report.
- 27 December 2017
Lure domain created. McAfee says falcancoin.io was created on this date, and updated on 19 February 2018.
- 25 to 26 February 2018
Exploit documents prepared. McAfee dates the Flash files to 25 February and Agreement.docx to 26 February.
- 28 February 2018
McAfee finds the campaign. Its Advanced Threat Research team sees the Bankshot implant return.
- 2 to 3 March 2018
Infections. McAfee telemetry shows the implant hitting five Turkish organizations.
- 8 March 2018
McAfee publishes. The analysis names CVE-2018-4878, the implant's abilities and the indicators.
How the attack worked
Delivery chain seen by McAfee
- A spear-phishing email carries a Word document with a financial or cryptocurrency theme.
- The document embeds a Flash object that exploits CVE-2018-4878, a flaw recently announced by the Korean Internet Security agency. McAfee says this gave a high chance of success against unpatched Flash.
- The exploit downloads a DLL from falcancoin.io. The DLL is disguised as a ZIP file and can run as a normal library inside a legitimate process.
- The implant contacts one of three hardcoded command servers, two of them Chinese-language gambling sites, and waits for commands.
What the implant does
A new thread starts from DllMain. It loads the Windows functions it needs at run time, decrypts its strings, contacts the server and handles commands. The first request is an HTTP POST with form fields named board_id, which McAfee thinks is a campaign ID, and user_id, a value hardcoded by the attacker. A file name of king.jpg acts as a beacon that says the implant is ready.
Commands arrive as encoded numbers in the range 0x123459 to 0x123490. McAfee lists abilities that include:
- List files in a directory, read a file and send it to the server.
- Run commands with cmd.exe /c and start processes, also as the logged-on user.
- Collect process times, account names, network addresses, drive details and the system version.
- Write data to disk, change file times and load more libraries.
- Delete files, or overwrite them with zeros and delete them at reboot, which destroys evidence.
The 2017 DHS and FBI report
The DHS and FBI report analyses seven malicious executable files. Five are proxy applications that use a similar cipher to hide traffic between the malware and the remote operator. Two of those five can create fake TLS handshake sessions using valid public SSL certificates. The other two files are remote access tools that let a remote user run commands on an infected system.
One remote access tool adds a cipher and the OpenSSL library to protect traffic with its command server, and may have been used to install the proxies. One analyzed proxy binds to the victim system and listens on port 110, so the operator can reach the internet through it. Data is encoded to stop firewalls and network analysis tools from spotting the sessions.
ATT&CK techniques
McAfee listed techniques with their 2018 names. The IDs below come from the current MITRE ATT&CK entry for Bankshot (S0239), matched to what McAfee and the DHS report describe.
- T1203, Exploitation for Client Execution: the Flash exploit for CVE-2018-4878.
- T1059.003, Windows Command Shell: commands run through cmd.exe /c. See Command and Scripting Interpreter (T1059).
- T1119 Automated Collection and T1005, Data from Local System: file listings and file reads. See Data from Local System (T1005).
- T1057, T1082, T1083, T1087.001 and T1087.002: process, system, file and account discovery. See Process Discovery (T1057) and System Information Discovery (T1082).
- T1134.002, Create Process with Token: the implant starts a process as the logged-on user.
- T1070.004 and T1070.006, File Deletion and Timestomp: wiping files and changing file times. See Indicator Removal (T1070).
- T1071.001 and T1041: HTTP command traffic and exfiltration over the command channel. See Exfiltration Over C2 Channel (T1041).
- T1001.003, Protocol or Service Impersonation: fake TLS handshakes, as described in the DHS and FBI report.
Delivery by spear-phishing email is also in McAfee's account. MITRE's page for Bankshot does not list it, so the Phishing mapping (T1566.001, see Phishing (T1566)) is ours.
ATT&CK techniques
- Technique Account Discovery Account Discovery is when an attacker builds a list of valid accounts, usernames or email addresses on a system or inside a compromised environment. T1087 · Discovery
- Technique Application Layer Protocol Application Layer Protocol is a technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS. T1071 · Command and Control
- Technique Command and Scripting Interpreter Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs. T1059 · Execution
- Technique Data from Local System Data from local system is when an attacker searches a computer they already control to find files and other data worth taking. T1005 · Collection
- Technique Exfiltration Over C2 Channel Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system. T1041 · Exfiltration
- Technique File and Directory Discovery File and Directory Discovery is a technique where an attacker lists files and folders on a system or a network share to learn what is there. T1083 · Discovery
- Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Process Discovery Process Discovery is a technique where attackers list the programs running on a system. T1057 · Discovery
- Technique System Information Discovery System Information Discovery is when an attacker collects details about a device, such as its operating system version, patch level and hardware. T1082 · Discovery
Who says who was behind it
Who attributed it, and how firm it is
McAfee calls its findings a strong indication of a Hidden Cobra attack. They are near-identical code (99% similar to documented 2017 samples), the financial victims, and command server strings seen in an earlier bank attack. Hidden Cobra is the US name for North Korean government activity, and MITRE lists Bankshot as Lazarus Group (G0032) software.
Impact
McAfee describes five victim organizations: one government-controlled financial organization, one Turkish government body in finance and trade, and three large financial institutions. It reports no stolen funds and no losses. It says the implant does not make financial transactions, but opens a channel for later stages.
McAfee read the campaign as an early data-gathering step before a possible heist. That is an assessment, not an observed theft. McAfee and the DHS report quote no Turkish authority or bank on this incident.
Government and regulator response
McAfee published file hashes, the falcancoin.io domain and three command server URLs, and named its detections for the documents and the implant. It noted that the Flash documents evaded static defenses and stayed undetected as exploits on VirusTotal when it checked.
DHS and the FBI had shared the 2017 report to support network defense. They asked users and administrators to flag activity linked to the malware and to report it to the DHS National Cybersecurity and Communications Integration Center or the FBI Cyber Watch. The report includes a detection rule and a list of best practices.
Lessons
-
A public report is an early warning
DHS and the FBI documented Bankshot in December 2017, before the March 2018 attack. McAfee found the new sample 99% similar to documented 2017 variants, so the 2017 report already described near-identical code.
-
A new exploit can carry an old implant
The attackers paired a fresh Flash flaw with a near-unchanged implant. Detect the implant's behavior and traffic, not only the delivery document.
-
The traffic was built to blend in
Proxies encode their data and can fake TLS with valid public certificates. A check that asks only whether a connection looks like normal encrypted traffic would miss it.
-
Targets were chosen with care
McAfee saw the implant only in Turkish government-linked finance and banking, and in no other sector or country. Banks in the region should treat it as a targeted warning.
What to check in your own organization
-
Hunt for the known domains and servers
Search proxy and DNS logs for falcancoin[.]io. Also search for the three command servers in the McAfee report: 530hr[.]com, 028xmz[.]com and 168wangpi[.]com.
-
Look for the implant on disk and in memory
Check for a DLL that is disguised as a ZIP file and loaded into a normal process, and for temporary files matching %temp%DWS00*. McAfee also lists four hashes, including sample a2e966edee45b30bb6bb5c978e55833eec169098.
-
Watch outbound HTTP for the beacon
Look for HTTP POST requests with multipart fields board_id and user_id and a file name such as king.jpg. McAfee took these strings from earlier captures, so check older logs too.
-
Do not rely on static document scanning
McAfee says the Flash documents evaded static defenses. Use behavior detection and a sandbox for attachments, and patch browsers, Office and plug-ins.
-
Check for fake TLS and odd proxies
The DHS and FBI report describes proxies that fake TLS handshakes with valid public certificates. Use the report's detection rule and report findings to DHS or the FBI.
-
Follow the report's basic list
The report advises keeping antivirus current, limiting who can install software, scanning attachments to confirm the file type, patching the operating system and disabling unneeded services.
Where it happened
Questions
What is the Bankshot implant?
Bankshot is a Windows remote access tool. DHS and the FBI described its variants in December 2017 as used by the North Korean government. It can list and read files, run commands, collect system data and wipe files.
What did McAfee find in March 2018?
McAfee found Bankshot at five Turkish organizations: a government-controlled financial organization, a government body in finance and trade, and three large financial institutions. A Word document with a Flash exploit for CVE-2018-4878 downloaded the implant. McAfee reports no theft.
Who used Bankshot against the Turkish financial sector?
McAfee said its evidence strongly indicated a Hidden Cobra attack, and MITRE ATT&CK says Lazarus Group used Bankshot against the Turkish financial sector in 2018. Hidden Cobra is the US Government's name for North Korean government activity.
How does Bankshot hide its traffic?
The DHS and FBI report describes proxies that use a cipher to hide traffic, and two that fake TLS handshakes with valid public certificates. McAfee describes HTTP POST beacons with a campaign ID and a fixed user ID.
How can banks look for it?
Search logs for falcancoin[.]io and the three server addresses, the board_id and user_id POST fields, and DLLs disguised as ZIP files. Use the DHS and FBI detection rule, and patch Flash, Office and browsers.
Sources
- Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant (8 March 2018) McAfee Advanced Threat Research
- North Korean Malicious Cyber Activity (alert of 21 December 2017, links Malware Analysis Report MAR-10135536-B) CISA (US-CERT)
- Bankshot, Software S0239 | MITRE ATT&CK MITRE ATT&CK
- Lazarus Group, Group G0032 | MITRE ATT&CK MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.