Pop Star Used to Spread Malware

A Russian hacking group is believed to have been at it again. This time, researchers at ESET said that the group used a popular celebrity singer’s Instagram site as a means to redirect unsuspecting users to a command and control center (C&C) server. Once there, the compromised machines could be used to perform other types of mischief, such as spreading more malware, using those machines as botnets, or perhaps to spy on others.

The hacking group, Turla is supposedly behind this trick and are strongly believed by many to be associated with the Russian government. In this case, they used pop star Britney Spears’ Instagram account to do their damage. The reason they chose her is unknown, but could be because she has nearly 17 million Instagram followers, making it easy to hide secret code. Perhaps they chose her, simply because they are big fans. Who knows?

Once the C&C is found by researchers or others, the hackers move it. With infected computers of Brittney’s fans, they just add another coded comment and it’s found again. By doing this, it’s easy to hide the new addresses as they change; which is often when dealing with this type of cybercrime.

It was quite clever how it was done. They had to convince people to download an extension to add on to the Firefox browser. In order to do that, they had to compromise another site. In this case, it was a Swiss security company. Once that site was compromised, the hackers modified the code. Then it offered an extension that users downloaded.

Normally, it’s not recommended to just willy-nilly download extensions to whatever browser you are using. In fact, the fewer you have, the better. If you don’t need it, don’t install it is the general rule. Turla was successful because it used the fact that users trust Firefox, so they are more likely to add an extension onto their browsers.

At the point the extension is installed, the machines are compromised and can be used by the group.

Brittney’s site was not breached in any way and the comment itself was not malicious. The users who downloaded that Firefox extension were then the vehicles for turning that comment into a URL.

This tactic has been seen in the past being used by Turla. It’s referred to as a watering hole attack and is often used to target embassies or government-related agencies or organizations. Some of the recently compromised sites, according to Forcepoint have been:

• Embassies of Iraq, Jordan, Russia, and Zambia located in Washington, DC.
• A socialist organization in Spain.
• A political party, a sports association, and a government-run sustainability site in Austria.
• An African Union site.
• An African plant society.
• A road safety site in Ukraine.

This type of attack has been used in pretty much same way and in the same form by Turla since 2014. It is useful, because it allows the attackers to hide the C&C locations better than just putting the locations directly into the malware code. When done that way, it’s much easier for researchers to discover it. They better find another way, because those researchers are now onto them.