Shortened URLs are like an express train for cyber attackers to your sensitive data. We all know phishing tactics, and spear phishing ones in particular, have become more evasive over time, weakening a victim's ability to recognize if they are being targeted. With shortened URLs - the problem becomes even worse. WeLiveSecurity have recently uncovered a mobile malware and spam campaign using shortened URLs to infect victims.
Text messages are meant to be short and sweet, leaving no room for a lengthy URL. Heck, just taking a quick look at my recent SMS history shows that both my mobile network provider, parking payment service and neighborhood grocery store use bitly shortened URLs instead of linking their website directly. When a user clicks on a shortened URL, the traffic is then redirected to the original URL's location. In the mobile malware campaign mentioned above, malicious shortened links sent victims to unwanted internet addresses, then prompting them with a variety of scams.
Infection consequences on the different operating systems. Image: WeLiveSecurity
Each operating system has been targeted with different attack outcomes in this campaign, aside from malvertising which floods victims with any OS with unwanted ads. iOS targets that clicked on the shortened link had their calendars spammed with tons of fake events, leading the victim to think their phone has been infected with malware and they "must click on a link to remove it" (obviously leading to more malicious downloads). On the other side of the mobile OS kingdom, calendars may have been spared, but Android users had the most dangerous consequences of all if they accidentally fell for a malicious shortened link. The websites they were sent to prompted the victims to download a malicious application, which led to the download of various banking trojans such as Cerberus, Ginp, and Teabot.
Behavior-based security solutions are nice, but aside from being way too expensive, they often let malware enter right through your network gates. Utilizing DNS RPZ technology, you can block malicious referrals right at the gateway. Automatically updated blocklists on your organization's DNS with the latest threat intelligence will barre communication with evil domains, even if someone on the network innocently clicks on a shortened malicious URL. Another layer of defense is activated once the C2 servers are also included in your blocklists, ensuring that they cannot communicate with your network either [see C2 IOC list below].
ThreatSTOP's DNS Defense turns existing and future DNS systems into Protective DNS (PDNS). Using continuous updates from 900+ Threat Intelligence sources, DNS Defense stops dangerous and unwanted DNS traffic before damage is done.
Add in predictive feedback loops and customer-specific block and allow lists, and you have ThreatSTOP's highly adaptive DNS protection. There is no new equipment to buy, or threat intelligence sources to tap into - ThreatSTOP provides the data, the integrations, and the automation to keep your DNS systems tuned for the newest threats.
If you are a ThreatSTOP customer, you are protected from the IOCs of this campaign. If you are not (yet) our customer, we suggest you immediately implement blocking its control and command servers:
| mmunitedaw[.]info | rycovernmen[.]club | emanalyst[.]biz |
| honeiwillre[.]biz | ssedonthep[.]biz | schemics[.]club |
| omeoneha[.]online | fceptthis[.]biz | oftongueid[.]online |
| ommunite[.]top | eaconhop[.]online | offeranda[.]biz |
| sityinition[.]top | fjobiwouldli[.]biz | ransociatelyf[.]info |
Ready to try ThreatSTOP in your network? Want an expert-led demo to see how it works?