The world of cybersecurity is constantly evolving, and attackers are always looking for new ways to deceive users into clicking on malicious links or downloading infected files. One of the most common vectors for cyber attacks is the PDF file. These files, used to share documents and articles, have become a favorite tool for cyber attackers. In fact, Microsoft recently warned Windows users about the growing threat of PDF attachments in attacks.
Obfuscation Techniques Used by Attackers
The techniques used by attackers to disguise malicious PDFs are becoming increasingly sophisticated. Microsoft warned users of a tax-day related attack that involved embedding a DoubleClick URL within a PDF attachment. This URL redirected users to a Rebrandly URL shortening link, which in turn led to a fake DocuSign page hosted on a domain that masqueraded as DocuSign. While the target user was redirected to a landing site that displayed a fake DocuSign page, the outcome depended on the filtering rules set up by the threat actor. This made it difficult for security researchers to replicate the attack and craft a fix.
RemcosRAT Campaign Using PDFs
TrustWave SpiderLabs has spotted a campaign delivering RemcosRAT, a type of malware known for its ability to remotely control infected systems. The attackers used a fake payment SWIFT copy to lure victims, attaching a PDF link to an obfuscated JavaScript file. The script then invoked PowerShell to download and decode an image hosted on archive.org, which appeared harmless but concealed the Remcos payload using steganography. The use of steganography is a key feature of the attack. Steganography is the practice of concealing information within another message or physical object to avoid detection. In this case, the attackers hid the link to the image within a seemingly innocent PDF file. Key highlights of the attack include:
- Use of obfuscated JavaScript to hide the link
- Use of PowerShell to download and decode the image
- Use of steganography to conceal the link
The attackers have also been using QR codes to hide links within PDFs, making it even more difficult for security scans to detect the malicious content.
Why PDFs are Vulnerable to Attackers
The reason behind the attack lies in the way PDFs are used by users. People are becoming increasingly wary of Office documents, which have been used in various cyber attacks in the past. However, this wariness is misplaced, as PDFs are vulnerable to attack due to their open nature. According to Cybersecurity News, the attack “begins with a phishing email that attaches a PDF file containing a malicious link, specifically pointing to a malicious webpage. This lures victims into a multi-stage infection process designed to deliver RemcosRAT, a malware known for its ability to remotely control infected systems.”
Protecting Yourself
So, what can you do to protect yourself from these types of attacks? * Be wary of unexpected emails, especially those with attachments or links. * Avoid clicking on links in suspicious emails. * Ensure that you have up-to-date antivirus software installed. * Keep your operating system and software up to date. * Use strong passwords and enable two-factor authentication.
Steganography: The Art of Concealing Information
Steganography is a technique used by attackers to hide information within another message or physical object. This technique is used to avoid detection and can be used to hide virtually any type of digital content. According to Kaspersky, “steganography can be used to hide virtually any type of digital content, including text, image, video, or audio content. Content concealed through steganography is sometimes encrypted before being hidden within another file format. If it isn’t encrypted, then it may be processed in some way to make it harder to detect.”
The Importance of Alerting Users
It is essential to alert users about the growing threat of malicious PDFs. These attachments are being used in various attacks, including phishing campaigns and data breaches. The attackers are using PDFs to spread malware, including RemcosRAT, which is a type of malware known for its ability to remotely control infected systems. To protect yourself from these types of attacks, be wary of unexpected emails, avoid clicking on links in suspicious emails, ensure you have up-to-date antivirus software installed, and keep your operating system and software up to date. Finally, do not delete PDFs without checking them first. While it may seem safe, PDFs can be a haven for malware and other malicious content.
“PDFs are more vulnerable to attack than you may think. Don’t let your guard down just because they appear to be benign.”
This is the final chapter in the story of malicious PDFs. While the threat is real, there is hope.