Fake DMCA complaints, DDoS threats lead to BazaLoader malware

Cybercriminals behind the BazaLoader malware came up with a new lure to trick website owners into opening malicious files: fake notifications about the site being engaged in distributed denial-of-service (DDoS) attacks.

The messages contain a legal threat and a file stored in a Google Drive folder that allegedly provides evidence of the source of the attack.

Fake legal threats

The DDoS theme is a variation of another lure, a Digital Millennium Copyright Act (DMCA) infringement complaint linking to a file that supposedly contains evidence about stealing images.

In submissions seen by BleepingComputer, the threat actor used Firebase URLs to push BazaLoader. The goal is the same though: use contact forms to deliver BazaLoader malware that often drops Cobalt Strike, which can lead to data theft or a ransomware attack.

Microsoft has warned about this delivery method in April, when cybercriminals used it to deliver IcedID malware. The recent campaigns are similar, only the payload and the lure have changed.

Website developer and designer Brian Johnson posted last week about two of his clients getting legal notifications about their websites being hacked to run DDoS attacks against a major company (Intuit, Hubspot).

The sender threatened with legal action unless the recipients didn’t “immediately clean” their website of the malicious files that helped deploy the DDoS attack.

“I have shared the log file with the recorded evidence that the attack is coming from [example.com] and also detailed guidelines on how to safely deal with, find and clean up all malicious files manually in order to eradicate the threat to our network,” reads the fake notification.

The malicious sender also included a link to a file hosted in Google Drive claiming to provide evidence of the DDoS attack and its origin.

Proofpoint security researcher Matthew Mesa notes in a tweet that these messages are sent through the website’s contact form and deliver the BazaLoader malware hosted on a Google site.

The researcher also says that the lure is a variation of the copyright infringement theme, also submitted through the website’s contact form.

BleepingComputer has received several of these infringement notifications over the past few months with allegations of using protected images without the owner’s consent.

The message provides a link to a file that supposedly lists the images used without permission. The data is hosted in Google’s Firebase cloud storage.

To make the matter seem urgent, the sender also says that the website owner is “possibly be liable for statutory damage as high as $120,000.” It is all a ruse to deliver malware, though.

Malware analyst Brad Duncan examined the file and found it was a ZIP archive with JavaScript that fetches the BazaLoader DLL, a backdoor attributed to the TrickBot gang that typically leads to a ransomware infection.

The malware then reaches to its command and control (C2) server and gets Cobalt Strike, a penetration-testing tool widely abused by cybercriminals to maintain persistence and deliver other payloads.

As seen from the samples above, the notifications are quite convincing and take advantage of the legitimacy of the contact form emails, which increases the chances of receiving a “safe” mark from email security solutions.

Looking for signs of malicious intent (incomplete contact information, incorrect grammar, suspicious links) is a good way to avoid falling for this social engineering trap.