Full Report
Spoof extensions help cybercriminals target users on trading forums as 130 devices still infected at time of writing
Analysis Summary
# Vulnerability: Spoof Extension Social Engineering via Double File Extensions
## CVE Details
- **CVE ID**: N/A (This is a TTP-based attack involving social engineering and file spoofing rather than a single software bug).
- **CVSS Score**: N/A
- **CWE**: CWE-451: User Interface (UI) Misrepresentation of Critical Information (Displaying misleading file extensions).
## Affected Systems
- **Products**: Windows OS, Web Browsers, Trading Forum Platforms.
- **Versions**: All versions of Windows that default to "Hide extensions for known file types."
- **Configurations**: Systems where users are active on P2P trading forums (e.g., crypto, gaming assets) and have the ability to download/execute files.
## Vulnerability Description
The attack leverages a "Double Extension" spoofing technique combined with custom icons. Attackers distribute malicious executables disguised as harmless media files (e.g., `.jpg`, `.pdf`, or `.txt`).
Because Windows, by default, hides the final extension of known file types, a file named `invoice.pdf.exe` appears to the user as `invoice.pdf`. The vulnerability relies on the psychological manipulation of users on trading forums who expect to receive screenshots or transaction logs, leading them to execute a malicious payload that installs information-stealing malware (Infostealers).
## Exploitation
- **Status**: **Exploited in the wild.** Approximately 130 devices were identified as actively infected at the time of the report.
- **Complexity**: Low (Relies on basic social engineering).
- **Attack Vector**: Network (Phishing/Social Engineering via forums).
## Impact
- **Confidentiality**: **High** (The primary goal is the theft of credentials, session cookies, and crypto wallets).
- **Integrity**: **High** (Malware can modify system files and registry keys for persistence).
- **Availability**: **Medium** (Can lead to system instability, though stealth is the attacker's priority).
## Remediation
### Patches
- There is no software patch for this technique as it exploits user behavior and default OS display settings.
### Workarounds
- **Enable File Extensions**: Configure Windows Explorer to "Show hidden files, folders, and drives" and uncheck "Hide extensions for known file types."
- **Restrict Executables**: Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of `.exe` or `.scr` files from `%APPDATA%` or `%TEMP%` directories.
- **User Education**: Train users to never open files from untrusted forum members, regardless of the perceived file type.
## Detection
### Indicators of Compromise (IoCs)
**File Names/Hashes (SHA256):**
- `images.com`: `b3d1f7b162f2efee3d94eabb6a4cd2d331f42ef964d999dd8080dbae94c8aa2a`
- `weakicons.com`: `414d2acaf75f70773cdd4c11684a50c123f4ba7643fd90732c181d9cceb4e53f`
- `VAAA.EXE`: `1a87678b77d45ad38968578e8edf6720bd9a0c6ebc771f1ad507e7878e326bbe`
**Network/C2 Domains:**
- `87iavv[.]com`
- `tganngs9[.]com`
- `trssp05923[.]com`
**Registry Persistence:**
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Logintech_000001`
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\anatomicobiological`
### Detection Methods
- Monitor for processes launching from `%APPDATA%` subfolders (e.g., `\WinSoft\`, `\NvidiaCore\`).
- Audit for unusual `.ocx` or `.dll` files being registered in the background.
## References
- Group-IB Blog: `https://www.group-ib[.]com/blog/cybercrime-fighters-club/`
- Incident Response Assistance: `https://www.group-ib[.]com/services/incident-response/`