Google’s reCAPTCHA bot protection has been weaponised
The Ukrainian Computer Emergency Response Team has issued a new security warning after discovering a cyber attack campaign carried out by the APT28 threat group, also known as Fancy Bear. This group is thought, with a high degree of confidence, to be affiliated with Russian military intelligence operations. Here’s what we know so far and what you need to watch out for if you think you might be at risk of being targeted.
The APT28 Fancy Bear Cyber Attack Campaign Warning From CERT-UA
The Ukrainian CERT warning, number CERT-UA#11689, was published Oct. 25 and, courtesy of Google’s on-page language translation tools, detailed an ongoing investigation into a phishing campaign using emails that contain a database table, and a link that delivers what appears to be a Google reCAPTCHA bot-detection dialog.
The frequency of these anti-bot CAPTCHA tools has reduced considerably for most users, in no small part by the sheer number of browser extensions that help to defeat them and the likes of iOS using Apple’s server-based automatic verification system to bypass the need to complete them yourself. However, it’s still not an altogether unexpected event when one does appear and, something that the Fancy Bear threat group is relying upon, certainly not something that would arouse suspicion in the user. If anything, it’s the opposite: the use of such an anti-bot defense tends to suggest a trustworthy outcome rather than a dangerous one.
In the case of this cyber attack campaign, CERT-UA said that ticking the checkbox asking for confirmation in response to the “I am not a robot” question will initiate a malicious PowerShell command instruction to the user’s clipboard.
Mitigating The Risk Of Falling Victim To The CAPTCHA Cyber Attack
OK, so the most important point to be made here is that the cyber attack campaign in question appears to be highly targeted at local government workers in Ukraine. That immediately filters out a lot of the concern that everyone else might have. However, importantly, that doesn’t mean that the same techniques will not be used by other threat actors now that the methodology is out there and apparently fooling some victims. Therefore, you still need to be aware of the threat and how to mitigate it.
Which brings me to the second important point here: the cyber attack is initiated by clicking a link (don’t do that) which causes the I am not a robot dialog to appear in the first place. If you get to this stage of such an attack then more interaction is required to execute the payload of the campaign: the PowerShell command sets off a script instructing the user to take a number of further steps.
These include: pressing a Win+R combo to open the command prompt, pressing a Win+V combo to paste the malware payload execution instruction, and finally the need to press enter to actually execute it and install the malware itself. That’s a lot of steps, requiring a lot of trust, from the user. Don’t be that trustworthy. Period. Ask yourself, when have I ever been asked to do something like this before? I’d bet my house that the answer to that, for 99.9% of people is, erm, never. So, why start now? With cyber attack campaigns, especially those involving AI-boosted phishing techniques, it’s easy to forget that most still rely upon good old-fashioned trickery. Stay alert, don’t let work pressures or knee-jerk reactions make you take unnecessary risks, and you can keep even state-sponsored hackers at bay.