www.bleepingcomputer.com
Open in
urlscan Pro
104.20.59.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/fake-copyright-complaints-push-icedid-malware-using-yandex-forms/
Submission: On July 13 via api from US — Scanned from DE
Submission: On July 13 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/fake-copyright-complaints-push-icedid-malware-using-yandex-forms/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/fake-copyright-complaints-push-icedid-malware-using-yandex-forms/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/fake-copyright-complaints-push-icedid-malware-using-yandex-forms/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* Microsoft July 2022 Patch Tuesday fixes exploited zero-day, 84 flaws
* New ‘Luna Moth’ hackers breach orgs via fake subscription renewals
* Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs
* Windows 10 KB5015807 and KB5015811 updates released
* Windows 8.1 now shows full-screen 'End of Support' warnings
* Get remote work ready with this HP laptop and Microsoft Office bundle deal
* New UEFI firmware flaws impact over 70 Lenovo laptop models
* New Android malware on Google Play installed 3 million times
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to open a Windows 11 Command Prompt as Administrator
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Fake copyright complaints push IcedID malware using Yandex Forms
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
FAKE COPYRIGHT COMPLAINTS PUSH ICEDID MALWARE USING YANDEX FORMS
By
LAWRENCE ABRAMS
* July 7, 2022
* 05:04 PM
* 0
Website owners are being targeted with fake copyright infringement complaints
that utilize Yandex Forms to distribute the IcedID banking malware.
For over a year, threat actors tracked as TA578 have been conducting these
attacks where they use a website's contact page to send legal threats to
convince recipients to download a report of the offending material.
These reports allegedly contain proof of DDoS attacks or copyrighted material
used without permission but instead infect a target's device with various
malware, including BazarLoader, BumbleBee, and IcedID.
PLAY Top Articles Video Settings Full Screen About Connatix V169995 Read More
Read More Read More Read More Read More Read More New Android malware on Google
Play installed3 million times 1/1 Skip Ad Continue watching after the ad Visit
Advertiser websiteGO TO PAGE
SWITCHING TO YANDEX FORMS
This week, BleepingComputer received a new version of the "Copyright
infringement" threat pretending to be from Zoho, stating that we are utilizing
their copyrighted images.
"Hello,
Your website or a website that your organization hosts is infringing on a
copyrighted images owned by our company (zoho Inc.).
Check out this report with the links to our images you used at
www.bleepingcomputer.com and our previous publication to get the proof of our
copyrights.
Download it now and check this out for yourself:
https://forms.yandex.com/u/62c3f14d59f1f7ef4295d2c1/success/?0=742998805032103091
I do think you've willfully infringed our rights under 17 U.S.C. Section 101 et
seq. and could be liable for statutory damage as high as $130,000 as set forth
in Section 504 (c) (2) of the Digital
Millennium Copyright Act (”DMCA”) therein.
This message is official notification. I seek the removal of the infringing
materials mentioned above. Please take note as a company, the DMCA demands you
to remove or terminate access to the copyrighted materials upon receipt of this
particular letter. In case you don't stop the use of the above mentioned
copyrighted content a court action will likely be started against you.
I do have a strong faith belief that use of the copyrighted materials described
above as allegedly violating is not approved by the legal copyright owner, its
legal agent, or the law.
I declare, under consequence of perjury, that the information in this message is
correct and hereby affirm that I am authorized to act on behalf of the
proprietor of an exclusive and legal right that is allegedly infringed.
Best regards,
Christian Brdakic
Legal Officer
zoho, Inc.
zoho.com
07/06/2022"
However, what was different with this campaign is that instead of using Google
Drive or Google Sites to host their alleged "reports" like they did in the past,
the threat actors are now using Yandex Forms.
Yandex Forms is a free service that allows users to create customized online
forms but can also be used by threat actors to create phishing landing pages.
When a person clicks on the forms.yandex.com link in the copyright complaint,
they are brought to a webpage that states, "File 'Stolen Images Evidence' is
ready for download.'
Phishing landing page on Yandex Forms
Source: BleepingComputer
After a brief time, the Yandex Form will download an ISO file named
'Stolen_ImagesEvidence.iso' from an embedded firebasestorage.googleapis.com link
in the Yandex Form.
An ISO file is a disk image file format that will mount as a new drive letter
when opened in Windows 10 and Windows 11 so that you can access the enclosed
files.
ISO files have become a popular attachment in phishing attacks as it bypasses
the propagating of the Mark-of-the-Web to the contained files, causing Windows
not to warn that they are risky when you attempt to open them.
After double-clicking on the ISO file, a new drive letter will open containing
what appears to be a 'documents' folder and a randomly named DLL file, as shown
below.
Contents of the Stolen_ImagesEvidence.iso file
Source: BleepingComputer
However, this documents folder is actually a Windows shortcut that, when
double-clicked, will cause a malicious DLL file to be executed using the
rundll32.exe command, as shown in the shortcut's properties below.
Properties of the enclosed documents shortcut
Source: BleepingComputer
This DLL is a loader for the IcedID, a modular banking trojan that can steal
Windows credentials and deploy additional payloads to allow initial access to
networks, such as Cobalt Strike beacons. These secondary payloads often lead to
full-blown ransomware attacks on the now-breached network.
As seen from the contact form submission, these copyright complaints can be
pretty convincing and utilize threats of legal action to create urgency to the
message. Unfortunately, this urgency commonly leads to people throwing caution
to the wind and opening the malicious files.
Therefore, it is important to always stay calm when receiving emails like these
and to scan unknown or suspicious files using VirusTotal before opening them on
your computer.
RELATED ARTICLES:
New Android malware on Google Play installed 3 million times
Hackers impersonate cybersecurity firms in callback phishing attacks
New stealthy OrBit malware steals data from Linux devices
Microsoft finds Raspberry Robin worm in hundreds of Windows networks
Microsoft Exchange servers worldwide backdoored with new malware
* Copyright
* IcedID
* Malware
* Website
* Facebook
* Twitter
* LinkedIn
* Email
*
LAWRENCE ABRAMS
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com.
Lawrence's area of expertise includes Windows, malware removal, and computer
forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation,
Recovery, and Administration Field Guide and the technical editor for Rootkits
for Dummies.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Microsoft: Windows Autopatch is now generally available
* CISA orders agencies to patch new Windows zero-day used in attacks
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT