'ScanBox' keylogger targets Uyghurs, US think tank, hospitality industry

The JavaScript-based attack doesn't put malware on a computer's disk

A diversification of targets for a clever keylogging attack suggests that several hacking groups may be using the "ScanBox" framework, which spies on users without installing malicious software.

ScanBox was found in August by the security company Alien Vault on the website of a large industrial company that develops simulation and engineering software for aerospace and manufacturing companies.

PricewaterhouseCoopers wanted to see if ScanBox was more widespread and found it on a more diverse set of websites, including one for the Uyghur community in China, an industrial-related website in Japan, a U.S. think tank and a Korean hospitality site.

"This variation was our first clue that more than one actor may be using the framework, although on its own this would not be enough - some actors do target a wide range of organisations, some also focus on specific geographies or sectors," wrote Chris Doman and Tom Lancaster, who work in cyber threat detection and response for PwC.

It's a common technique for attackers to plant malware or other malicious code on legitimate websites, in what is referred to as a "watering hole" attack.

ScanBox is unique in that it doesn't install malware but instead uses JavaScript. If executed in the browser, the JavaScript logs keystrokes and collects system information that could be used later to exploit computers in other ways, Doman and Lancaster wrote.

The four infected websites had generally the same code base for ScanBox, although there were minor differences in implementation. Depending on which browser a person is using, ScanBox loads different plugins that check the versions of Microsoft's SharePoint application or Adobe Systems' Reader app, among others. If attackers detect outdated versions of those applications, they may try to exploit them in further attacks.

Though the four attacks all used SandBox, there was "little overlap both in terms of associated infrastructure and in terms of the malware families associated with that infrastructure," such as shared IP addresses or other domains, Doman and Lancaster wrote.

The four websites are so different that they would be of interest to separate groups of attackers. Sometimes, attackers do take exploit kits planted on other websites and appropriate them for their own use, they wrote. They also occasionally share attack kits even if they have different targets in mind.

"Sharing frameworks like ScanBox or other exploit kits allows less sophisticated actors who were themselves unable to develop a tool like ScanBox to conduct better attacks," they wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags securityAlien VaultmalwarePricewaterhouseCoopers

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?