Menu
'ScanBox' keylogger targets Uyghurs, US think tank, hospitality industry

'ScanBox' keylogger targets Uyghurs, US think tank, hospitality industry

The JavaScript-based attack doesn't put malware on a computer's disk

A diversification of targets for a clever keylogging attack suggests that several hacking groups may be using the "ScanBox" framework, which spies on users without installing malicious software.

ScanBox was found in August by the security company Alien Vault on the website of a large industrial company that develops simulation and engineering software for aerospace and manufacturing companies.

PricewaterhouseCoopers wanted to see if ScanBox was more widespread and found it on a more diverse set of websites, including one for the Uyghur community in China, an industrial-related website in Japan, a U.S. think tank and a Korean hospitality site.

"This variation was our first clue that more than one actor may be using the framework, although on its own this would not be enough - some actors do target a wide range of organisations, some also focus on specific geographies or sectors," wrote Chris Doman and Tom Lancaster, who work in cyber threat detection and response for PwC.

It's a common technique for attackers to plant malware or other malicious code on legitimate websites, in what is referred to as a "watering hole" attack.

ScanBox is unique in that it doesn't install malware but instead uses JavaScript. If executed in the browser, the JavaScript logs keystrokes and collects system information that could be used later to exploit computers in other ways, Doman and Lancaster wrote.

The four infected websites had generally the same code base for ScanBox, although there were minor differences in implementation. Depending on which browser a person is using, ScanBox loads different plugins that check the versions of Microsoft's SharePoint application or Adobe Systems' Reader app, among others. If attackers detect outdated versions of those applications, they may try to exploit them in further attacks.

Though the four attacks all used SandBox, there was "little overlap both in terms of associated infrastructure and in terms of the malware families associated with that infrastructure," such as shared IP addresses or other domains, Doman and Lancaster wrote.

The four websites are so different that they would be of interest to separate groups of attackers. Sometimes, attackers do take exploit kits planted on other websites and appropriate them for their own use, they wrote. They also occasionally share attack kits even if they have different targets in mind.

"Sharing frameworks like ScanBox or other exploit kits allows less sophisticated actors who were themselves unable to develop a tool like ScanBox to conduct better attacks," they wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwarePricewaterhouseCoopersAlien Vault

Events

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments