Solarmarker Shifts Infrastructure in Recent Drive-By Attacks

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• Solarmarker malware delivered through a type of social engineering attack tactic known as drive-by download, in which users download a malicious file on their devices unknowingly.
• In recent attacks, operators created thousands of fake blogs on Blogger.com targeting common document templates such as sales agreements or legal notices.
• Each blog is padded with keywords used to boost search engine ranking (a technique known as SEO poisoning). When visiting the page, the victim was redirected to a download page for Solarmarker malware disguised as a PDF document.
  • Previously, Solarmarker operators used services such as Google Sites or Amazon Web Services to host content.

Figure 1 Search engine results for a purchase agreement. The Solarmarker landing page is the third result.

Figure 2 Clicking the blogspot.com link leads to a PDF document download panel. Clicking the Open PDF or Open DOC links leads to malware.

Figure 3 Blog padded with keywords to influence search engine results. This content is not shown to the user on the first visit.

How did we find it?

• Our Machine Learning PowerShell classifier detected malicious code execution resulting from the victim executing malware disguised as a PDF document template.
• Our 24/7 SOC was alerted and investigated.

What did we do?

• Investigated and confirmed the activity is malicious.
• Isolated the host to contain this incident in accordance with the business’ policies.
• Provided remediation recommendations and support.
• Filed abuse reports with Blogger.com.

What can you learn from this TRU positive?

• Throughout 2021, operators have continuously updated their attack tactics by pivoting to new services to host malicious content.
• Solarmarker is part of a growing class of threats utilizing drive-by social engineering attacks, which operate by exploiting human emotions such as fear or desire.
  • Solarmarker operators target users’ desire to access free online resources by seeding search engine results with fake document templates, resulting in the victim inadvertently executing malware.

Recommendations from our Threat Response Unit (TRU) Team:

While rapid identification and containment of successful exploits is necessary to limit impact, unsuccessful attempts still present an opportunity to shore up defenses. The best approach to preventing drive-by attacks is by using a layered defense, such as: 

• Increase awareness of social engineering threat tactics with your users through security awareness training.
• Audit your environment and endpoints regularly to ensure all endpoints are patched with the latest vendor security updates.
• Protect endpoints against malware using managed endpoint detection and response support.

Ask Yourself…

• Adversaries are continually improving on their social engineering techniques. How well-equipped are you in rapidly detecting and responding to threats initiated by unwitting users?

If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business.

Want to learn more? Connect with an eSentire Security Specialist.