Thumbing through the DNS Traces of TamperedChef

TamperedChef, a massive malvertising campaign, leveraged apps users commonly installed on their computers. Potential victims were tricked into downloading malicious scripts via clever social engineering ruses. Infections could lead to establishing and selling remote access for profit, stealing and monetizing sensitive credentials and healthcare data, preparing compromised systems for future ransomware deployment, and engaging in opportunistic espionage by exploiting access to high-value targets.

The Acronis TRU identified 58 IoCs comprising URLs and subdomains.¹ We extracted 58 unique domains from them and weeded out those that were legitimate. We were left with 46 domains for further analysis. Our in-depth investigation led to these discoveries:

• 28 domains tagged as IoCs deemed likely to turn malicious 155–335 days before being dubbed as such
• 7,111 unique client IP addresses queried four domains identified as IoCs based on sample IASC network traffic data
• 97 email-connected domains
• 24 IP addresses, 10 were malicious
• 952 IP-connected domains
• Five string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.acronis.com/en/tru/posts/cooking-up-trouble-how-tamperedchef-uses-signed-apps-to-deliver-stealthy-payloads/