Polazert Trojan using poisoned Google Search results to spread

Trojan.Polazert aka SolarMarker has gone back and fine-tuned an old tactic known as SEO-poisoning to plant their Remote Access Trojan (RAT) on as many systems as possible. This RAT runs in memory and is used by attackers to install additional malware on affected systems.

Trojan.Polazert

Trojan.Polazert is specifically designed to steal credentials from browsers and provide an attacker with a backdoor that allows them to further compromise infected systems. To achieve this, collected data is sent to a C&C server. To gain persistence on an infected system it adds shortcuts to the Startup folder and changes existing shortcuts.

Distribution

According to Microsoft Security Intelligence, attackers have started using PDF files full of keywords that have a high SEO ranking, so that their links show up prominently in search results. Once victims have downloaded the PDF file they thought they were looking for, they are prompted to download another document that supposedly contains the information they set out to find. Instead of getting the coveted document they are redirected to through multiple sites to end up at a page where they download the Polazert Trojan.

In the past this threat actor used to flood search results with more than 100,000 websites claiming to offer free office forms and document templates. All with the same end-result, a download of the RAT. The malicious website serves up an executable disguised as a pdf document or a word document.

As you might expect, the attackers used cheap, scalable Cloud hosting like Amazon Web Services (AWS) and Google Sites to host their malicious PDFs.

SEO poisoning

SEO is short for Search Engine Optimization and it is a marketing strategy that is designed to make sure that your web pages are found if people search for certain keywords that are relevant to your business. The ranking of a page in Google’s search results is based on a huge array of factors, but two of the core principles are what the page is about, and the page’s reputation.

A PDF will be stuffed with keywords designed to convince Google its about something very specific that people will be searching for. To target lots of different searches, they’ll need lots of different, narrowly-focussed PDFs.

The reputation of a page is calculated in part by using the number of inbound links pointing to it. Links from pages about the same subject, that themselves have strong reputations, have a greater effect. Typically, threat actors can leverage a large amount of pages to create inbound links.

Lazy crooks that don’t want to put in the work link building, or those that can’t afford to hire someone, or those put off by heavy competition for keywords, may consider buying incoming links from an underground market vendor. These threat actors control a multitude of compromised sites that they can use to post links on. Another method that SEO poisoners may use is to build links is spam forums, with the help of spambots.

What they don’t use, is social media. Contrary to popular belief, posting links on social media like Facebook and Twitter does not help to improve a page’s SEO. The links on social media are “nofollow” links, and Google’s bots will not follow them or add them to the tally of incoming links.

Recognizing this threat

While it is not uncommon to be shown pdf files when you are using search engines, but it is advisable to scrutinize their content. Apart from the first page the stuffed PDF files look empty, but a closer look reveals their content.

It is also worth bearing in mind that aside from being used in SEO poisoning campaigns like this, malicious PDFs can also be used to trigger bugs in reader software, and there are no shortage of bugs.

The first page of the PDF file showcased by Microsoft Security Intelligence offers users a choice of a PDF download or a Word document download, under the heading “Select Download Format”. Or, in other words, would you like your RAT as a PDF or a DOC?

It is certainly feasible that this threat actor will change tactics again, but being aware of their current tactics may help you thwart their next attempt.

Stay safe, everyone!

The post Polazert Trojan using poisoned Google Search results to spread appeared first on Malwarebytes Labs.