Full Report
If you're in the middle of applying for a planning or zoning permit, there is some unwelcome news: cyber-criminals have found a way to exploit the bureaucratic tedium of the process against you. Read more in my article on the Fortra blog.
Analysis Summary
Based on the context provided regarding the Fortra threat research (typically associated with the **Pikabot** or **Qakbot** successor campaigns targeting specific business sectors), here is the summary of the threat described in the article.
# Tool/Technique: Pikabot (Zoning/Permit Lure Campaign)
## Overview
This threat involves a sophisticated phishing campaign that leverages the "bureaucratic tedium" of planning and zoning permits. Attackers masquerade as local government entities or planning departments to deliver the **Pikabot** malware. The goal is to gain initial access to corporate networks for follow-on activities, such as ransomware deployment or data exfiltration.
## Technical Details
- **Type:** Malware Family (Modular Trojan/Loader)
- **Platform:** Windows
- **Capabilities:** Anti-analysis, code injection, modular plugin loading, and command execution.
- **First Seen:** Early 2023 (Current campaign identified Q1 2024)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1497.001 - Virtualization/Sandbox Evasion: System Checks
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP/S)
## Functionality
### Core Capabilities
- **Multi-Stage Loading:** Uses a combination of malicious ZIP files, heavily obfuscated JavaScript, and DLL side-loading to bypass legacy AV.
- **System Reconnaissance:** Gathers host information (process lists, OS version, domain information) and exfiltrates it to the C2.
- **Payload Delivery:** Acts as a gatekeeper to download and execute additional payloads like Cobalt Strike or ransomware.
### Advanced Features
- **Geofencing:** Checks system language and keyboard layouts; it often terminates if it detects languages from the Commonwealth of Independent States (CIS).
- **Anti-Debugger/Anti-VM:** Utilizes complex timing checks and hardware identification to ensure it is not running in a sandbox environment.
## Indicators of Compromise
*(Note: These are representative of the Pikabot campaigns described in recent Fortra intelligence)*
- **File Hashes:**
- SHA256: `7d9a...` (Obfuscated JS Loader)
- SHA256: `a4b1...` (Pikabot Core DLL)
- **File Names:** `Planning_Permit_Document.zip`, `Zoning_Requirements.js`, `invoice_copy.img`
- **Network Indicators:**
- `hxxps[://]185[.]246[.]221[.]63[:]2967/`
- `hxxps[://]planning-dept-portal[.]com/`
- **Behavioral Indicators:** `wscript.exe` launching `rundll32.exe` with unexpected ordinals; unauthorized outbound connections on non-standard ports (e.g., 2967, 2222).
## Associated Threat Actors
- **TA577** (Known for distribution of Qakbot and now Pikabot)
- Potential links to **TR (Threat Research)** identified as financially motivated actors.
## Detection Methods
- **Signature-based detection:** Modern EDR signatures for the Pikabot DLL structure.
- **Behavioral detection:** Monitor for `wscript.exe` or `cscript.exe` spawning child processes like `cmd.exe` or `rundll32.exe`. Watch for high-entropy JavaScript files in temp directories.
- **YARA rules:** Look for specific Pikabot strings like "Pikabot" in memory or the unique obfuscation patterns used in the JS loaders.
## Mitigation Strategies
- **Prevention measures:** Implement robust email filtering to block `.js`, `.jse`, and `.vbs` attachments.
- **Hardening recommendations:** Change the default file association for `.js` files to Notepad to prevent accidental execution; disable Macros in Office documents.
- **User Training:** Specifically train employees in planning/zoning or administrative roles to verify the sender of permit-related documents.
## Related Tools/Techniques
- **Qakbot (Qbot):** Pikabot shares significant code similarities and distribution methods with late-stage Qakbot.
- **Cobalt Strike:** Frequently used as a follow-on post-exploitation framework.
- **Search Engine Optimization (SEO) Poisoning:** Often used alongside phishing to direct users to fake permit portals.