Menu
Financial cybercrime group abuses Windows app compatibility feature

Financial cybercrime group abuses Windows app compatibility feature

The FIN7/Carbanak gang deploys fake application compatibility patches to inject malicious code into other processes

When Microsoft made it possible for enterprises to quickly resolve incompatibilities between their applications and new Windows versions, it didn't intend to help malware authors as well. Yet, this feature is now abused by cybercriminals for stealthy and persistent malware infections.

The Windows Application Compatibility Infrastructure allows companies and application developers to create patches, known as shims. These consist of libraries that sit between applications and the OS and rewrite API calls and other attributes so that those programs can run well on newer versions of Windows.

Shims are temporary fixes that can make older programs work even if Microsoft changes how Windows does certain things under the hood. They can be deployed to computers through Group Policy and are loaded when the target applications start.

Shims are described in special database files called SDBs that get registered on the OS and tell Windows when they should be executed. Security researchers have warned at security conferences in the past that this functionality can be abused to inject malicious code into other processes and achieve persistence, and it seems the attackers were listening.

Security researchers from FireEye have recently seen the shim technique used by a group of financially motivated cybercriminals known in the security industry as FIN7 or Carbanak. Since 2015, this group has stolen between US$500 million and $1 billion from hundreds of financial organizations worldwide.

FIN7 has recently diversified its targets and in March launched a spear-phishing campaign that targeted personnel involved with U.S. Securities and Exchange Commission (SEC) filings at organizations from multiple sectors, including financial services, transportation, retail, education, IT services, and electronics.

In an even more recent FIN7 attack detected by FireEye, the group used a PowerShell script to register a rogue shim database for services.exe, a legitimate Windows process. This ensured that its malicious shim code started on every system reboot and injected the Carbanak backdoor into the Windows Service Host (svchost.exe) process.

The group used the same technique to install a tool for harvesting payment card details from compromised systems, the FireEye researchers said in a blog post. "This was a departure from FIN7’s previous approach of installing a malicious Windows service for process injection and persistent access."

In the attack seen by FireEye, the rogue shim database masqueraded as a Windows update using the description: Microsoft KB2832077. This Microsoft Knowledge Base (KB) identifier does not correspond to any legitimate patch, so finding a reference to it in the system registry or in the list of installed programs can be a sign that the computer was compromised by FIN7.

To detect shim attacks, the FireEye researchers recommend monitoring for new files in the default shim database directories, monitoring for changes in registry keys related to shim database registrations and monitoring for processes that call the "sdbinst.exe” utility.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Leading female front runners of the Kiwi ICT industry honoured at 2019 WIICTA

Leading female front runners of the Kiwi ICT industry honoured at 2019 WIICTA

Reseller News has honoured the leading female front runners of the New Zealand ICT industry at the 2019 Women in ICT Awards (WIICTA) in Auckland. The awards recognised standout individuals across six categories, spanning Entrepreneur, Rising Star, Shining Star, Community, Technical and Achievement. Photos by Gino Demeer.

Leading female front runners of the Kiwi ICT industry honoured at 2019 WIICTA
Reseller News kicks off awards season in 2019 with Judges' Lunch

Reseller News kicks off awards season in 2019 with Judges' Lunch

The 2019 Reseller News Innovation Awards has kicked off with the Judges Lunch in Auckland with 70 judges in the voting panel. The awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors. Photos by Christine Wong.

Reseller News kicks off awards season in 2019 with Judges' Lunch
Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomed 2018 inductees - Chris Simpson, Kendra Ross and Phill Patton - to the third running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing landscape of the technology industry in New Zealand, while outlining ways to attract a new breed of players to the ecosystem. Photos by Gino Demeer.

Reseller News welcomes industry figures for 2019 Hall of Fame lunch
Show Comments