The world of cybercrime has witnessed an intriguing evolution with the emergence of Ousaban, a banking trojan with a unique twist. This malware, which has traditionally targeted victims in Brazil, has now set its sights on Spain and Portugal, employing a sophisticated blend of evasion techniques to stay under the radar.
What makes Ousaban particularly fascinating is its ability to adapt and evolve. While it may not be a groundbreaking new attack, it represents a highly refined version of traditional Latin American banking trojan strategies. Written in Delphi and utilizing an encryption scheme from the late 2000s, Ousaban showcases how cybercriminals can repurpose old tools with a fresh approach.
The attack begins with a clever phishing tactic. Victims receive a seemingly broken PDF file, prompting them to click an "Update" button that leads to a malicious webpage. Disguised as a government tax portal, this page employs server-side checks to profile visitors, ensuring the attack is tailored to users in Spain or Portugal. By examining language, time zone, and IP data, the malware screens out VPN connections and sandboxes, effectively hiding its criteria from analysts.
For those who pass this initial screening, the malware delivers a script that downloads an image resembling a PDF icon. However, this icon is a clever disguise, as it uses steganography to conceal an archive containing the Ousaban payload. This layer of obfuscation adds an extra challenge for security researchers, making it harder to detect and analyze.
Once installed, Ousaban keeps a close eye on its victims, monitoring their interactions with dozens of targeted banking services. These include well-known institutions like Santander, BBVA, and CaixaBank. When a victim accesses one of these services, Ousaban springs into action, employing a range of tools such as screenshots, keylogging, clipboard injection, and remote control. It even displays fake bank screens to deceive users into revealing their sensitive information.
One of the most intriguing aspects of Ousaban is its command server setup. Instead of relying on a fixed address, the malware employs daily changing domains, derived from a hash of the current date pulled from a Google error page. This dynamic approach, combined with a decoy Pastebin link leading to a dead-end private IP, further enhances its evasion capabilities.
As Jason Soroko from certificate-management firm Sectigo points out, "Geofenced malware can look absent from outside the target region." This highlights the importance of correlating various logs, such as endpoint, mail, DNS, and proxy data, to gain a comprehensive understanding of such attacks.
Fortinet's telemetry confirms that this campaign is ongoing, with the primary goal of credential theft for bank fraud. This raises a deeper question about the evolving nature of cyber threats and the need for constant vigilance and adaptation in the cybersecurity landscape.
In my opinion, the Ousaban case study serves as a stark reminder that cybercriminals are constantly innovating and refining their tactics. It's a cat-and-mouse game where security researchers and defenders must stay one step ahead. The ability to repurpose old tools and adapt them to new targets is a worrying trend, and it underscores the need for a proactive and holistic approach to cybersecurity.
From my perspective, the Ousaban story is a fascinating glimpse into the minds of cybercriminals and the evolving nature of digital threats. It's a constant battle, and staying ahead requires a combination of technical expertise, innovative thinking, and a deep understanding of human behavior.
