Cybercrime
,
Fraud Management & Cybercrime
DanaBot Used to Steal and to Spy
A top figure in the Russian cybercrime gang behind DanaBot infected his own computer with the malware, allowing an FBI agent to search an image of his system, U.S. federal prosecutors disclosed Thursday in indictments and an announced disruption of the malware’s infrastructure.
See Also: Why Cyberattackers Love ‘Living Off the Land’
Federal prosecutors unsealed indictments and a criminal complaint against 16 defendants, including suspected DanaBot leader Aleksandr Stepanov, 39, a.k.a. “JimmBee,” and Artem Aleksandrovich Kalinkin, 34, a.k.a. “Onix,” both of Novosibirsk, Russia.
Justice said the Defense Criminal Investigative Service seized DanaBot command and control servers, including “dozens” of virtual servers hosted in the United States.
In the complaint against Kalinkin, the FBI says it obtained copies of DanaBot servers. A search showed a computer with an active user “onx” – which turned out to be a computer belonging to Onix, an identity responsible for DanaBot sales and support. DanaBot functioned as it was designed to do, siphoning data and login credentials from the system, allowing the FBI to connect Onix to Kalinkin through Gmail and iCloud email addresses.
“Pervasive malware like DanaBot harms hundreds of thousands of victims around the world, including sensitive military, diplomatic and government entities, and causes many millions of dollars in losses,” said U.S. Attorney Bill Essayli for the Central District of California. Prosecutors say DanaBot infected more than 300,000 computers across the globe and caused at least $50 million in damage. Analysis by Eset pinpoints Poland as one of the most targeted countries. The cybersecurity company said it knows of more than 1,000 unique DanaBot command and control servers.
Security researchers first spotted DanaBot in the wild in 2018, although according to prosecutors’ timeline, Stepanov began efforts to code the malware in September 2015. The gang behind the malware – tracked variously as TA547 and Scully Spider- offered access to DanaBot for between $3,000 to $4,000 a month. The FBI said it identified approximately 40 active customers between 2018 and 2021. Most affiliates were Russian.
Unusually, there are two DanaBot variants: One for cybercrime and one for espionage. The gang ultimately stored data stolen by the espionage variant on servers inside Russia. Infections with the espionage variant were less widespread than the criminal variant, hitting computers in the United States, Belarus, the United Kingdom, Germany and Russia. Prosecutors say they haven’t indicted users of the espionage variant, who deployed it to steal data such as “financial transactions by diplomatic staff, correspondence concerning day-to-day diplomatic activity, as well as summaries of a particular country’s interactions with the United States.”
A threat actor used DanaBot to launch a distributed denial of service attack against Ukrainian Ministry of Defense webmail server in March 2022. The indictment also attributes the Ukrainian DDoS attacks timed to Russia’s launch of a war of conquest against Ukraine to unindicted co-conspirators – but they occurred after Stepanov and other members of the gang developed a DDoS module for DanaBot.
Proofpoint, which first observed the malware, said it say DanaBot actors impersonating the Organization for Security and Co-operation in Europe and a Kazakhstan government agency to infrect computers in October 2019 and January 2020.
“DanaBot exemplifies the blurred lines between Russian eCrime and state-sponsored cyber operations,” wrote cybersecurity firm CrowdStrike. “We think this direct use of criminal infrastructure for intelligence gathering activities provides evidence that Scully Spider operators were acting on behalf of Russian government interests.”
Users of the criminal variant didn’t just use it to steal banking credentials. Online shopping platforms were also a prime target. In one case, an affiliate used the malware against an online storefront in order to buy items and use stolen credentials to grant refunds for bogus returns, with the refunds worth several times more than the original price. “Many victims were online retailers and saw extensive fraud conducted on their sales platforms,” the Kalinkin complaint states.
DanaBot made it onto the victim computers through a number of methods, including through spam campaigns, malvertising and as a download to a computer already infected with malware such as Smokeloader. Crowdstrike spotted a criminal affiliate in November 2021 hiding DanaBot in a compromised JavaScript runtime environment npm package that had 8.9 million weekly downloads.
Eset wrote that of all the distribution mechanisms, the misuse of Google Ads to display seemingly relevant, but actually malicious, websites among the sponsored links in Google search results “stands out as one of the most prominent methods.”
DanaBot affiliates have also taken to developing deceptive IT help websites that coax users into copying and pasting malicious commands onto their computer.