BatLoader Facilitates Fraud and Hands-On-Keyboard Attacks

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• BatLoader, a malware dropper, was found to be distributed in drive-by cyberattacks.
  • In recent incidents examined by TRU, victims were lured to websites masquerading as download pages for popular software such as AnyDesk, Zoom, LogMeIn, and TeamViewer (among others). These fake webpages were distributed through advertisements displayed in search engine results.
• In a recent case involving an eSentire insurance customer in late October 2022, the victim arrived on hxxps://logmein-cloud[.]com via a malicious advertisement and downloaded a Windows Installer (.msi) file (Figure 1).





• When executed, BatLoader profiles the system using living-off-the-land commands and uses this information to retrieve a second-stage payload best suited for monetizing the system or network where it has landed.
• On personal workstations, BatLoader drops the Ursnif banking malware and the Vidar information stealer. On domain-joined systems it drops Cobalt Strike and the Syncro Remote Monitoring and Management tool in additional to the above malware.
  • This automated approach provides a flexible means to monetize the compromised system through either fraud (Ursnif/Vidar) or hands-on-keyboard intrusion actions (Cobalt Strike, Syncro).
  • It also increases the attacker’s agility when weaponizing footholds since Cobalt Strike is deployed immediately to suitable targets, reducing false leads and limiting exposure of its command and control infrastructure.

How did we find it?

• MDR for Endpoint identified multiple infection behaviors associated with BatLoader.

What did we do?

• Our team of 24/7 SOC Cyber Analysts investigated the threat and alerted the customer.
• Since Cobalt Strike was initiated immediately following user-execution of the BatLoader MSI file, the case was escalated to Tier 3 SOC Analysts to continue the threat investigation and ensure that the threat was contained.

What can you learn from this TRU positive?

• Drive-by social engineering cyberattacks are on the rise.
  • According to the 2022 report Disrupting Initial Access, drive-by attacks accounted for 34% of malware infections disrupted by eSentire in 2021, up from 7% in 2020. This attack vector continues to be a popular choice in 2022, with 34% of disrupted attacks originating from web browsing sessions in the first half of the year.
• Manipulating search results is a common tactic employed by adversaries to introduce malicious code. Two common ways adversaries influence search engine results are through SEO poisoning or by purchasing ads that target specific keywords.
  • While popular search engines attempt to filter out malicious search results, users should remain vigilant when browsing the web and only download files from trusted sources.
• BatLoader’s objective is to deliver other cyber threats, ranging from fraud in the form of banking malware and information stealers to Cobalt Strike and remote monitoring tools.
  • This approach enables monetization through fraud as a baseline while leaving the door open for hands-on-keyboard attacks.
• Rapid threat identification and containment is critical to disrupting follow-on attacks such as ransomware.

Recommendations from our Threat Response Unit (TRU) Team:

• Raise awareness of malware masquerading as legitimate applications, and include in your Phishing and Security Awareness Training (PSAT) program. An effective PSAT program emphasizes building cyber resilience by increasing risk awareness, rather than trying to turn everyone into security experts.
• Protect endpoints against malware.
  • Ensure antivirus signatures are up-to-date.
  • Use a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) product to detect and contain threats.

Ask Yourself…

• What level of visibility do you have across your network, endpoint, and overall environment to detect malicious behavior at scale?
• Are you monitoring your endpoints 24/7 and what degree of control do you have to initiate a kill switch when required?

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.