TA16-336A: Avalanche (crimeware-as-a-service infrastructure)

["US-CERT" <US-CERT () ncas us-cert gov>]

U.S. Department of Homeland Security US-CERT

National Cyber Awareness System:

 

TA16-336A: Avalanche (crimeware-as-a-service infrastructure) [ https://www.us-cert.gov/ncas/alerts/TA16-336A ] 
12/01/2016 12:00 AM EST 
Original release date: December 01, 2016

Systems Affected

Microsoft Windows

Overview

“Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing and 
malware distribution campaigns and money mule schemes. The United States Department of Homeland Security (DHS), in 
collaboration with the Federal Bureau of Investigation (FBI), is releasing this Technical Alert to provide further 
information about Avalanche.

Description

Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to 
victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal 
information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct 
other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other 
victims’ computers.

In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit 
fraud involving transporting and laundering stolen money or merchandise.

Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of 
compromised systems acting as proxies.

The following malware families were hosted on the infrastructure:


  * Windows-encryption Trojan horse (WVT) (aka Matsnu, Injector,Rannoh,Ransomlock.P) 
  * URLzone (aka Bebloh) 
  * Citadel 
  * VM-ZeuS (aka KINS) 
  * Bugat (aka Feodo, Geodo, Cridex, Dridex, Emotet) 
  * newGOZ (aka GameOverZeuS) 
  * Tinba (aka TinyBanker) 
  * Nymaim/GozNym 
  * Vawtrak (aka Neverquest) 
  * Marcher 
  * Pandabanker 
  * Ranbyus 
  * Smart App 
  * TeslaCrypt 
  * Trusteer App 
  * Xswkit 

Avalanche was also used as a fast flux botnet which provides communication infrastructure for other botnets, including 
the following:        


  * TeslaCrypt 
  * Nymaim 
  * Corebot 
  * GetTiny 
  * Matsnu 
  * Rovnix 
  * Urlzone 
  * QakBot (aka Qbot, PinkSlip Bot) 

Impact

A system infected with Avalanche-associated malware may be subject to malicious activity including the theft of user 
credentials and other sensitive data, such as banking and credit card information. Some of the malware had the 
capability to encrypt user files and demand a ransom be paid by the victim to regain access to those files. In 
addition, the malware may have allowed criminals unauthorized remote access to the infected computer. Infected systems 
could have been used to conduct distributed denial-of-service (DDoS) attacks.

Solution

Users are advised to take the following actions to remediate malware infections associated with Avalanche:


  * "Use and maintain anti-virus software" – Anti-virus software recognizes and protects your computer against most 
known viruses. Even though parts of Avalanche are designed to evade detection, security companies are continuously 
updating their software to counter these advanced threats. Therefore, it is important to keep your anti-virus software 
up-to-date. If you suspect you may be a victim of an Avalanche malware, update your anti-virus software definitions and 
run a full-system scan. (See Understanding Anti-Virus Software [ http://www.us-cert.gov/ncas/tips/ST04-005 ] for more 
information.) 
  * "Avoid clicking links in email" – Attackers have become very skilled at making phishing emails look legitimate. 
Users should ensure the link is legitimate by typing the link into a new browser (see Avoiding Social Engineering and 
Phishing Attacks [ https://www.us-cert.gov/ncas/tips/ST04-014 ] for more information). 
  * "Change your passwords –" Your original passwords may have been compromised during the infection, so you should 
change them. (See Choosing and Protecting Passwords [ http://www.us-cert.gov/ncas/tips/ST04-002 ] for more 
information.) 
  * "Keep your operating system and application software up-to-date –" Install software patches so that attackers 
cannot take advantage of known problems or vulnerabilities. You should enable automatic updates of the operating system 
if this option is available. (See Understanding Patches [ http://www.us-cert.gov/ncas/tips/ST04-006 ] for more 
information.) 
  * "Use anti-malware tools –" Using a legitimate program that identifies and removes malware can help eliminate an 
infection. Users can consider employing a remediation tool. A non-exhaustive list of examples is provided below. The 
U.S. Government does not endorse or support any particular product or vendor. 

          *ESET Online Scanner*

          https://www.eset.com/us/online-scanner/ [ https://www.eset.com/us/online-scanner/ ]  

          *F-Secure*

          https://www.f-secure.com/en/web/home_global/online-scanner [ 
https://www.f-secure.com/en/web/home_global/online-scanner ]

          *McAfee Stinger*

          http://www.mcafee.com/us/downloads/free-tools/index.aspx [ 
http://www.mcafee.com/us/downloads/free-tools/index.aspx ]

          *Microsoft Safety Scanner*

          https://www.microsoft.com/security/scanner/en-us/default.aspx [ 
https://www.microsoft.com/security/scanner/en-us/default.aspx ]

          *Norton Power Eraser*

          https://norton.com/npe [ https://norton.com/npe ]

References

  * https://www.us-cert.gov/sites/default/files/publications/money_mules.pdf 
  * http://www.bankinfosecurity.com/avalanche-group-linked-to-fraud-a-2573 

Revision History

  * December 1, 2016: Initial release 
________________________________________________________________________

This product is provided subject to this Notification [ http://www.us-cert.gov/privacy/notification ] and this Privacy 
& Use [ http://www.us-cert.gov/privacy/ ] policy.

________________________________________________________________________

A copy of this publication is available at www.us-cert.gov [ https://www.us-cert.gov ]. If you need help or have 
questions, please send an email to info () us-cert gov. Do not reply to this message since this email was sent from a 
notification-only address that is not monitored. To ensure you receive future US-CERT products, please add US-CERT () 
ncas us-cert gov to your address book. 

OTHER RESOURCES: Contact Us [ http://www.us-cert.gov/contact-us/ ] | Security Publications [ 
http://www.us-cert.gov/security-publications ] | Alerts and Tips [ http://www.us-cert.gov/ncas ] | Related Resources [ 
http://www.us-cert.gov/related-resources ]  

STAY CONNECTED: Sign up for email updates [ http://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/new ]