Fake copyright complaints push IcedID malware using Yandex Forms

Website owners are being targeted with fake copyright infringement complaints that utilize Yandex Forms to distribute the IcedID banking malware.

For over a year, threat actors tracked as TA578 have been conducting these attacks where they use a website's contact page to send legal threats to convince recipients to download a report of the offending material.

These reports allegedly contain proof of DDoS attacks or copyrighted material used without permission but instead infect a target's device with various malware, including BazarLoader, BumbleBee, and IcedID.

Switching to Yandex forms

This week, BleepingComputer received a new version of the "Copyright infringement" threat pretending to be from Zoho, stating that we are utilizing their copyrighted images.

However, what was different with this campaign is that instead of using Google Drive or Google Sites to host their alleged "reports" like they did in the past, the threat actors are now using Yandex Forms.

Yandex Forms is a free service that allows users to create customized online forms but can also be used by threat actors to create phishing landing pages.

When a person clicks on the forms.yandex.com link in the copyright complaint, they are brought to a webpage that states, "File 'Stolen Images Evidence' is ready for download.'

After a brief time, the Yandex Form will download an ISO file named 'Stolen_ImagesEvidence.iso' from an embedded firebasestorage.googleapis.com link in the Yandex Form.

An ISO file is a disk image file format that will mount as a new drive letter when opened in Windows 10 and Windows 11 so that you can access the enclosed files.

ISO files have become a popular attachment in phishing attacks as it bypasses the propagating of the Mark-of-the-Web to the contained files, causing Windows not to warn that they are risky when you attempt to open them.

After double-clicking on the ISO file, a new drive letter will open containing what appears to be a 'documents' folder and a randomly named DLL file, as shown below.

However, this documents folder is actually a Windows shortcut that, when double-clicked, will cause a malicious DLL file to be executed using the rundll32.exe command, as shown in the shortcut's properties below.

This DLL is a loader for the IcedID, a modular banking trojan that can steal Windows credentials and deploy additional payloads to allow initial access to networks, such as Cobalt Strike beacons. These secondary payloads often lead to full-blown ransomware attacks on the now-breached network.

As seen from the contact form submission, these copyright complaints can be pretty convincing and utilize threats of legal action to create urgency to the message. Unfortunately, this urgency commonly leads to people throwing caution to the wind and opening the malicious files.

Therefore, it is important to always stay calm when receiving emails like these and to scan unknown or suspicious files using VirusTotal before opening them on your computer.