Return of the Worm: A Red Hat Analysis

A computer worm is a piece of malware that is designed to replicate itself in order to spread to other machines. While worms have existed since at least the 1980s, they’ve made a surprise comeback in 2017. Notable pieces of malware, including ransomware and banking trojans, have sought to incorporate “wormable” functionalities. Following the WCry attacks, Rick Holland wrote a blog titled “The Early 2000s Called, They Want Their Worms Back”. Could 2017 be seen as the return of the worm? By using the Red Hat structured analytic technique, it’s possible to take the perspective of an attacker and understand the potential evolution of this technique in the near future.

Worms in 2017

In early 2017, the SamSam ransomware added self-propagation techniques. The developers of SamSam likely determined that the added technique would increase potential profits for the operators of the ransomware. More recently, Emotet and TrickBot, two banking trojans added self-propagation to their functionality. Banking trojans target customers of online banking services in order to harvest their credentials and access accounts for subsequent fraudulent transfers. Both Emotet and TrickBot demonstrated a new capability that attempted to allow self-propagation through a network using two distinct techniques.

  1. Emotet relied on the brute-force cracking of credentials to spread internally among networked systems, using a list of passwords hard-coded into the malware. This was incorporated in the months after WCry and Petya, demonstrating how criminals track cyber trends and adjust their TTPs accordingly.
  2. The new TrickBot variant attempted to autonomously propagate among networked machines over the Server Message Block (SMB) service. There have been further indications that the exploit used in the TrickBot variant was ETERNALBLUE, an exploit for an SMB vulnerability (CVE-2017-0144). ETERNALBLUE was released by the Shadow Brokers in April 2017 and subsequently used in the WCry (WannaCry) attacks of May 2017.

Over the past six months, there have been multiple instances of malware using network self-propagation techniques. As seen in Figure 1 below, the Backdoor.Nitol and Gh0st RAT trojans, WCry, and now, possibly, TrickBot have used ETERNALBLUE.

Wormable Trojans Timeline September 2017 

Figure 1 – Timeline of malware adding self-propagation

Red Hat Analysis

The incorporation of a “worming” capability enables malware to propagate among machines within a local area network, and potentially between networks. This could enable a single successful delivery via a spam email, for example, to infect multiple machines.

A lack of technical knowledge is one reason why we have seen a lack of adoption in the past. TrickBot is a well-developed and successful banking trojan, indicating that its operators were likely relatively well resourced; however, the newly added self-propagation modules were reportedly relatively poorly written in comparison to its older modules, suggesting a realistic possibility that they may still be under development.

In order to assess the question of why banking trojan developers would adopt self-propagation techniques, we have conducted a Red Hat analysis exercise. Red Hat analysis is a structured analytic technique that prompts an analyst to change his or her point of reference from that of an analyst observing or predicting an adversary or competitor’s behavior, to someone who must make decisions within an existing operational culture. The technique works best when you are trying to predict the behavior of a specific person or adversary. The Red Hat analysis quadrant in Figure 2 shows the potential advantages, benefits, costs, and risks associated with future development of self-propagating techniques for banking trojans.

 Red Hat Analysis Self Propagation

Figure 2 – Red Hat analysis of developing self-propagation techniques for banking trojans

The self propagation outlook

Actors or groups that can implement these techniques without compromising operational security would likely gain more profit. Given this, it’s likely that the development of self-propagation capabilities will continue in the near future.

While there’s still limited information on how self-propagation techniques have increased the profitability of Emotet and TrickBot, the incorporation of these capabilities in multiple malware variants showed their developers and operators perceived the techniques as profitable. If development of self-propagation techniques continues, it will likely increase the extent to which a specific variant can impact an enterprise network. However, this would largely depend on how hardened a network is against such activity.

Shortly after the WCry ransomware worm, we wrote a blog on 5 lessons we can learn from security engineering. The advice in this blog extends beyond the WCry incident, and provides good advice for protecting against the rise of wormable malware, covering these five areas:

    1. Default deny
    2. Least privilege
    3. (Attack) surface reduction
    4. Need to know/compartmentalization
    5. Defense in depth

Previous Post
Equifax Breach: The Impact For Enterprises and Consumers
Equifax Breach: The Impact For Enterprises and Consumers

What we know about the Equifax breach On September 7th, credit reporting agency Equifax announced “a cybers...

Next Post
Content Delivery Networks (CDNs) Can Leave You Exposed – How You Might be Affected and What You Can Do About It
Content Delivery Networks (CDNs) Can Leave You Exposed – How You Might be Affected and What You Can Do About It

Whether it was the Mirai botnet and Dyn or the “Cloudbleed” revelations, content delivery networks (CDNs) h...


Join 150k subscribers and get the latest news & threat intel in your inbox.

First Name
Last Name
State- optional
Job Title
Thank you!
Error - something went wrong!