cerrar
cerrar
Su red del mañana
Su red del mañana
Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.
          Descubra Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            Líder en SSE. Ahora es líder en SASE de un solo proveedor.
            Líder en SSE. Ahora es líder en SASE de un solo proveedor.
            Netskope debuta como Líder en el Cuadrante Mágico™ de Gartner® para Single-Vendor SASE
              Protección de la IA generativa para principiantes
              Protección de la IA generativa para principiantes
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Prevención moderna de pérdida de datos (DLP) para Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Libro SD-WAN moderno para principiantes de SASE
                  Modern SD-WAN for SASE Dummies
                  Deje de ponerse al día con su arquitectura de red
                    Entendiendo dónde está el riesgo
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        Los 6 casos de uso más convincentes para el reemplazo completo de VPN heredada
                        Los 6 casos de uso más convincentes para el reemplazo completo de VPN heredada
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive Salvaguarda su "Propiedad Intelectual" con Protección de Datos Inteligente y Adaptable
                          Colgate-Palmolive Salvaguarda su "Propiedad Intelectual" con Protección de Datos Inteligente y Adaptable
                            Netskope GovCloud
                            Netskope logra la alta autorización FedRAMP
                            Elija Netskope GovCloud para acelerar la transformación de su agencia.
                              Let's Do Great Things Together
                              La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.
                                Soluciones Netskope
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Soporte técnico Netskope
                                  Soporte técnico Netskope
                                  Nuestros ingenieros de soporte cualificados ubicados en todo el mundo y con distintos ámbitos de conocimiento sobre seguridad en la nube, redes, virtualización, entrega de contenidos y desarrollo de software, garantizan una asistencia técnica de calidad en todo momento
                                    Vídeo de Netskope
                                    Netskope Training
                                    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube. Estamos aquí para ayudarle a proteger su proceso de transformación digital y aprovechar al máximo sus aplicaciones cloud, web y privadas.

                                      Black Friday is Coming and LNKR Malware Might Be Watching You

                                      Nov 24 2021

                                      Summary

                                      Black Friday is a long-awaited day for many people, as it generates a lot of sales in both physical stores and online marketplaces. With the ongoing COVID pandemic, online sales are expected to be even more intense this year, and along with that, we will likely see an increase in cyber scams.

                                      Attackers will try to steal your money in many ways: through phishing sites, banking malware, remote access trojans, and more. However, there is one type of malware that people often underestimate: adware.

                                      In 2019, Netskope Threat Labs identified a campaign linked to the malware LNKR, which is an Ad Injection Framework commonly delivered through malicious Google Chrome extensions, where the attacker can inject rogue advertisements on any page the victim is accessing for monetization. Later in 2020, we identified another campaign from LNKR, after blocking this variant from many different pages.

                                      The year 2021 is no different either. LNKR is still active and Netskope continues to block requests from this threat. With the upcoming Black Friday holiday, the demand for products increases, as well as the chances of someone landing on a fraudulent page through a malicious advertisement. In this blog post, we will analyze LNKR and show how this type of threat can be dangerous.

                                      LNKR Malware

                                      Although this threat is adware, it’s not as harmless as one may think. LNKR contains many capabilities, including:

                                      • Exfiltrate data from search engines;
                                      • Redirect the user to any page the attacker wants;
                                      • Display its own monetized advertisements;
                                      • Inject any JavaScript from external websites.

                                      LNKR is commonly distributed via infected Google Chrome extensions. However, the code is also capable of self-replication, injecting itself into web pages where the user has write permissions (i.e. capable of infecting websites).

                                      Screenshot of main LNKR script.
                                      Main LNKR script.

                                      As soon as the script is loaded, it sends several requests to its C2 server, which is hosted on the same website as the main script. In these requests, we can see the following pattern:

                                      • /metric/
                                        This endpoint is used as feedback for LNKR actions, whether they were successful or not.
                                      • /optout/<operation>
                                        This endpoint is used to interact with the malware’ configuration, where <operation> can be “set” or “get”. The list of actions LNKR performs through this endpoint was mapped by TrendMicro early in 2021.
                                      Screenshot of LNKR initial requests
                                      LNKR initial requests.

                                      The metrics requests are sent through an invisible image element that is added to the HTML page.

                                      Screenshot of LNKR function for sending metrics to the C2 server.
                                      LNKR function for sending metrics to the C2 server.

                                      Analyzing its capabilities, the malware starts by injecting many scripts into the page that are loaded through a hardcoded configuration.

                                      Screenshot of LNKR external scripts to load.
                                      LNKR external scripts to load.

                                      This configuration is stored in JSON, where it has the URLs for the external scripts and other settings such as allowed/denied countries and browsers.

                                      Screenshot of LNKR external scripts to be injected into the page.
                                      LNKR external scripts to be injected into the page.

                                      In this case, one of the external scripts loaded by LNKR contains a function named “insertScript”, which can be used to inject JavaScript code into any page the victim is accessing. 

                                      This is extremely dangerous as the attacker can inject anything into the page, like a script to steal credit card data for example.

                                      Screenshot of Function to inject JavaScript code into the page.
                                      Function to inject JavaScript code into the page.

                                      This malware also contains hardcoded targeted websites, like the Russian social network named OK, where the rogue advertisement is loaded through iframes.

                                      Screenshot of function to inject JavaScript code into the page.
                                      Function to inject JavaScript code into the page.

                                      Another targeted website is Amazon. The malware checks the website the user is browsing through a regex pattern.

                                      Screenshot of LNKR checking if the website is Amazon.
                                      LNKR checking if the website is Amazon.

                                      If the victim is shopping at Amazon, the malware collects information about the products, such as the name, price, and items in the cart, which are later used for advertisement/monetization.

                                      Screenshot of LNKR exfiltrating information from Amazon.
                                      LNKR exfiltrating information from Amazon.

                                      Booking is also on the target list. If the victim accesses the original website or its corresponding typos, the request is stopped and the user is redirected to another page.

                                      Screenshot of LNKR redirects the user if the page is Booking.
                                      LNKR redirects the user if the page is Booking.

                                      Furthermore, there are also functions to exfiltrate data from search engines, like Google, Yahoo, and go.mail.ru. If that’s the case, anything the victim is searching is redirected to another page.

                                      Screemshot of LNKR redirects the victim’s search.
                                      LNKR redirects the victim’s search.

                                      Conclusion

                                      We demonstrated how LNKR is able to inject JavaScript into any page, redirect and exfiltrate the victim’s search results, and display rogue advertisements for its own benefit. Adware is not as harmless as one might think, as it can cause many serious problems such as theft of personal information, and delivery of other types of malware. We need to be on the lookout for these types of attacks, especially during Black Friday, where the chance of accessing a fraudulent ad is increased.

                                      Protection

                                      Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

                                      • Netskope Threat Protection
                                        • Script-JS.Adware.Lnkr
                                      • Netskope Advanced Threat Protection provides proactive coverage against this threat.
                                        • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
                                        • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox

                                      IOCs

                                      Hashes (SHA256)

                                      a2fe96b7fe6cb873f771c4753fd75bc8476bb3ff7c48e5d362d2ba62d4a83854

                                      305272b83c898b6b8a83f398ca3421d538a46ba9ec9893b454cb3eb11319499b

                                      URLs

                                      hxxps://rayanplug[.]xyz/1d933b8fbaeff2de0c.js

                                      hxxps://rayanplug[.]xyz/metric/

                                      hxxps://rayanplug[.]xyz/optout/

                                      hxxps://hublosk[.]com/js/int.js

                                      hxxps://hublosk[.]com/newapi/api

                                      hxxps://hublosk[.]com/redir/

                                      hxxps://jullyambery[.]net/api

                                      hxxp://adrs[.]me/get

                                      hxxp://www.youradexchange[.]com/a/display.php

                                      Other IOCs for LNKR can be found here and here.

                                      author image
                                      Gustavo Palazolo
                                      Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection.
                                      Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection.

                                      ¡Mantente informado!

                                      Suscríbase para recibir lo último del blog de Netskope