{"id":85095,"date":"2018-03-08T06:00:32","date_gmt":"2018-03-08T14:00:32","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=85095"},"modified":"2025-06-02T00:54:30","modified_gmt":"2025-06-02T07:54:30","slug":"hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant\/","title":{"rendered":"Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant"},"content":{"rendered":"

This post was prepared with contributions from Asheer Malhotra, Charles Crawford, and Jessica Saavedra-Morales.<\/em>\u00a0<\/strong><\/p>\n

On February 28, the McAfee Advanced Threat Research team discovered that the cybercrime group Hidden Cobra continues to target cryptocurrency and financial organizations. In this analysis, we observed the return of Hidden Cobra\u2019s Bankshot malware implant surfacing in the Turkish financial system. Based on the code similarity, the victim\u2019s business sector, and the presence of control server strings, this attack resembles previous attacks<\/a> by Hidden Cobra conducted against the global financial network SWIFT.<\/a><\/p>\n

In this new, aggressive campaign we see a return of the Bankshot implant, which last appeared in 2017. Bankshot is designed to persist on a victim\u2019s network for further exploitation; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations.<\/p>\n

Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document. The document contains an embedded Adobe Flash exploit, which was recently announced by the Korean Internet Security agency. The exploit, which takes advantage of CVE-2018-4878,<\/a> allows an attacker to execute arbitrary code such as an implant.<\/p>\n

the Further investigation into this campaign and analysis of McAfee product telemetry shows that the infection occurred on March 2 and 3. The implant\u2019s first target was a major government-controlled financial organization. It next appeared in another Turkish government organization involved in finance and trade. A further three large financial institutions in Turkey were victims of this attack. The implant has so far not surfaced in any other sector or country. This campaign suggests the attackers may plan a future heist against these targets by using Bankshot to gather information.<\/p>\n

Bankshot implants are distributed from a domain with a name similar to that of the cryptocurrency-lending platform Falcon Coin, but the similarly named domain is not associated with the legitimate entity. The malicious domain falcancoin.io was created December 27, 2017, and was updated on February 19, only a few days before the implants began to appear. These implants are variations of earlier forms of Bankshot, a remote access tool that gives an attacker full capability on a victim\u2019s system. This implant also contains functionality to wipe files and content from the targeted system to erase evidence or perform other destructive actions. Bankshot was first reported by the Department of Homeland Security<\/a> on December 13, 2017, and has only recently resurfaced in newly compiled variants. The sample we analyzed is 99% similar to the documented Bankshot variants from 2017.<\/p>\n

\"\"<\/a>
Bankshot implants hosted on falcancoin.io.<\/em><\/figcaption><\/figure>\n

The Bankshot implant is attached to a malicious Word document with the filename Agreement.docx. The document appears to be an agreement template for Bitcoin distribution between an unknown individual in Paris and a to-be-determined cryptocurrency exchange. The author of this document is test-pc. It was created February 26 and was submitted from the Netherlands. The document contains an embedded Flash script that exploits CVE-2018-4878 and downloads and executes the DLL implant from falcancoin.io.<\/p>\n

We discovered two more documents, written in Korean, that exploit the same vulnerability as Agreement.docx. These documents appear to be part of the same campaign and may have been used on different targets. These documents also communicated with falcancoin.io to install Bankshot and also contain themes around cryptocurrency security.<\/p>\n

Two Flash files exploit CVE-2018-4878.<\/h2>\n