Menu
'ScanBox' keylogger targets Uyghurs, US think tank, hospitality industry

'ScanBox' keylogger targets Uyghurs, US think tank, hospitality industry

The JavaScript-based attack doesn't put malware on a computer's disk

A diversification of targets for a clever keylogging attack suggests that several hacking groups may be using the "ScanBox" framework, which spies on users without installing malicious software.

ScanBox was found in August by the security company Alien Vault on the website of a large industrial company that develops simulation and engineering software for aerospace and manufacturing companies.

PricewaterhouseCoopers wanted to see if ScanBox was more widespread and found it on a more diverse set of websites, including one for the Uyghur community in China, an industrial-related website in Japan, a U.S. think tank and a Korean hospitality site.

"This variation was our first clue that more than one actor may be using the framework, although on its own this would not be enough - some actors do target a wide range of organisations, some also focus on specific geographies or sectors," wrote Chris Doman and Tom Lancaster, who work in cyber threat detection and response for PwC.

It's a common technique for attackers to plant malware or other malicious code on legitimate websites, in what is referred to as a "watering hole" attack.

ScanBox is unique in that it doesn't install malware but instead uses JavaScript. If executed in the browser, the JavaScript logs keystrokes and collects system information that could be used later to exploit computers in other ways, Doman and Lancaster wrote.

The four infected websites had generally the same code base for ScanBox, although there were minor differences in implementation. Depending on which browser a person is using, ScanBox loads different plugins that check the versions of Microsoft's SharePoint application or Adobe Systems' Reader app, among others. If attackers detect outdated versions of those applications, they may try to exploit them in further attacks.

Though the four attacks all used SandBox, there was "little overlap both in terms of associated infrastructure and in terms of the malware families associated with that infrastructure," such as shared IP addresses or other domains, Doman and Lancaster wrote.

The four websites are so different that they would be of interest to separate groups of attackers. Sometimes, attackers do take exploit kits planted on other websites and appropriate them for their own use, they wrote. They also occasionally share attack kits even if they have different targets in mind.

"Sharing frameworks like ScanBox or other exploit kits allows less sophisticated actors who were themselves unable to develop a tool like ScanBox to conduct better attacks," they wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securityAlien VaultmalwarePricewaterhouseCoopers

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments