Originally written by Daniel Fonseca Yarochewsky

Years-old domains, compromised JS libraries and worldwide-localized content among tactics of this sophisticated attacker.

In Internet parlance, “old” has a much younger meaning — domains, virtual servers, image assets — everything is now or never. So much so that many security vendors rely heavily on what is called “domain reputation”, or the history a particular domain name has acquired over time on the Internet; a domain that is days old for a supposedly established online shop for example can raise concerns, while a 5-year-old digital presence works like a kosher staple.

Despite having extensively talked about investment scams for quite some time (here and here), we’d like to bring attention to this actor we’ve been tracking for almost two years now whose tactics are particular in ways we’ve never seen before; CashRewindo, first seen in 2018, distributes attacks all around the globe, smuggling malicious code in common JavaScript libraries and aging domains like fine scotch.

The ads

We already know of the two main components of a successful malvertising campaign — an effective creative and a cloaked landing page.

CashRewindo employs a creative strategy that consists of flipping between scam ads and innocuous wording, i.e. usually at the beginning of the campaign we’d see placeholder ads that don’t trigger strong language detection and only later do we start to observe actual call-to-action ads.

Here’s a precise example of creative flipping: the domain webprolix[.]com was observed in the UK with the fake ad, and a few hours later switched to targeting Poland with the scam creative.

The Infrastructure

Apart from A/B-testing campaigns and in so doing abusing time-based creative verification systems, CashRewindo has yet another trick up its sleeves: domain aging.

Most of the IOCs we collected have domains that were registered two or three years ago, only to be activated, i.e. certificates updated and virtual server assigned, just in time for the campaigns. We speculate that either they buy these from reputation-building markets, or wait around for them to age, likely the former. Being outsourced or not, this technique is able to bypass security systems that classify registration timing as reputable.

The Specimen: thesellotto[.]com

Let’s now take a look at one sample from CashRewindo and dissect its operation.

Usually, when the creatives have malicious call-to-actions, clicking on the ads will land the victim at this type of template, where there’s a button that determines whether to redirect to the scam or a cloaked page.

Note the tiny red circle on top of the coin image. That’s also a technique used on some of their creatives to trip up computer vision detection modules:

The Uncloaking

For users and devices outside their target audience, clicking on “click here” will just redirect to white pages (in cloaking, means a decoy placeholder markup with no malicious intent).

(https://thesellotto[.]com/start-benefiting/)

On the other hand, the correct targeting reveals interesting code snippets. The following is what appears to be tracking code for affiliate schemes:

https://gist.githubusercontent.com/dyarochewsky/77408cd61ef3b984332f502f77b08d6e/raw/8588df2104a3063a72a9fa465fe36095c5f58349/cash-1.html

As you can see, this is done over WSS which loads an image with the tracking path /event/lead in order to escape traditional request inspection.

What’s even more interesting is what was hidden inside a javascript library:

https://thesellotto[.]com/wp-content/plugins/contact-form-7/js/respond.js?ver=5.2.2

This is what the link loads for a normal out-of-target user:

https://gist.githubusercontent.com/dyarochewsky/02cac7e3ab0f17d65ce280ef8f5d0e09/raw/af112806ef328652221cfd8475bd54355d90fc1a/cash2.js

Nothing to see, right? Well, look at what we got it to load instead for us:

https://gist.githubusercontent.com/dyarochewsky/1c0d440fd65cff70ed4df1e4f421a1a8/raw/2ebee2915f2e19e7992e083ec836a8f942561ea5/cash3.js

This was decided server-side, so they likely inspected our client’s TLS and HTTP layers to serve us the malicious code.

Here’s the array it built to fingerprint the browser:

https://gist.githubusercontent.com/dyarochewsky/4d15592d010e8d00a2a97aeada67e004/raw/49d91471622619e02c79116e91e24aa18aef517f/payload.json

Very simple payload which includes timezone offset, device platform and language inspection. There’s one additional interesting step though; for a moment we were confused while inspecting only the network logs as to where the POST with this payload happens. If you look closely though, you’ll notice that they smuggle it inside a GET request header:

https://gist.githubusercontent.com/dyarochewsky/3bdfd158cf852247f152edd64b9f0b50/raw/e23254f51dc8f999d26b6354b3ba9a0a3b02dc13/p1.js

So, in effect:

https://gist.githubusercontent.com/dyarochewsky/54b0585cb26046307743f66e84a3f242/raw/40f125ee1b81380c9bffc6f64c9c05df5439574a/p2.js

which becomes a header:

https://gist.githubusercontent.com/dyarochewsky/d1f173b41c3ae59fcac9ba6bcc6a6e6c/raw/5b7f233356ec2690bb42be3261288d2051d5ba4a/p3.js

Neat!

Aaaand the scam page is:

Which redirects to a crypto platform on-click, where victims are persuaded to put in a deposit towards a fake investment opportunity.

The Behavior

From tracking this actor’s behavior, we’ve also noticed that the majority of the IOCs come from a few IPs that are virtualized in slow and steady cycles. That is, we’ve seen relative low volume and less aggressive domain churn compared to other threats we track — we’ve recorded 1,569,083 impressions over a period of 12 months, and the majority of its recorded targeting is Windows devices:

In addition, one of the most striking quirks about this actor is the diversity of targeting. CashRewindo’s attacks are spread across Europe, Asia, Africa, and the Americas with oddly tailored campaigns — customized language, local currency and all.

Here’s another recent one targeting Brazil (a geo very rarely observed in investment scams). Notice the tailored language and attention to detail, the choice of the creative imagery that’s very specific to the location. CashRewindo is really a master in localization.

landing page

uncloaked page tynbox[.]com

“Geo-diversity” by the numbers:

https://gist.githubusercontent.com/dyarochewsky/4e5b7696492d9e62a5ab2af8b8678507/raw/34e3615238fdd2621c00e54d76058f70a60ff9cf/impressions2.csv

Appendix A: IOC Piñata (as of Nov 1st)

https://gist.githubusercontent.com/dyarochewsky/3917d1464901c9969f68df601182a7e7/raw/7adaa8dcb6e6de69b79179ec192e726913ba02c0/iocs.csv

Appendix B: Tracked IPs

https://gist.githubusercontent.com/dyarochewsky/1e09ceac5e50c3a2a1ec951b0b99419b/raw/f09afb28fb1457333d97890db3c84fc07f7f5fb5/isps.csv

CashRewindo: How to age domains for an…