‘ScanBox’ keylogger targets Uyghurs, US think tank, hospitality industry

A diversification of targets for a clever keylogging attack suggests that several hacking groups may be using the “ScanBox” framework, which spies on users without installing malicious software.

ScanBox was found in August by the security company Alien Vault on the website of a large industrial company that develops simulation and engineering software for aerospace and manufacturing companies.

PricewaterhouseCoopers wanted to see if ScanBox was more widespread and found it on a more diverse set of websites, including one for the Uyghur community in China, an industrial-related website in Japan, a U.S. think tank and a Korean hospitality site.

“This variation was our first clue that more than one actor may be using the framework, although on its own this would not be enough – some actors do target a wide range of organizations, some also focus on specific geographies or sectors,” wrote Chris Doman and Tom Lancaster, who work in cyber threat detection and response for PwC.

It’s a common technique for attackers to plant malware or other malicious code on legitimate websites, in what is referred to as a “watering hole” attack.

ScanBox is unique in that it doesn’t install malware but instead uses JavaScript. If executed in the browser, the JavaScript logs keystrokes and collects system information that could be used later to exploit computers in other ways, Doman and Lancaster wrote.

The four infected websites had generally the same code base for ScanBox, although there were minor differences in implementation. Depending on which browser a person is using, ScanBox loads different plugins that check the versions of Microsoft’s SharePoint application or Adobe Systems’ Reader app, among others. If attackers detect outdated versions of those applications, they may try to exploit them in further attacks.

Though the four attacks all used SandBox, there was “little overlap both in terms of associated infrastructure and in terms of the malware families associated with that infrastructure,” such as shared IP addresses or other domains, Doman and Lancaster wrote.

The four websites are so different that they would be of interest to separate groups of attackers. Sometimes, attackers do take exploit kits planted on other websites and appropriate them for their own use, they wrote. They also occasionally share attack kits even if they have different targets in mind.

“Sharing frameworks like ScanBox or other exploit kits allows less sophisticated actors who were themselves unable to develop a tool like ScanBox to conduct better attacks,” they wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk