Purple Fox Malware
Purple Fox is a combined backdoor and rootkit used in several campaigns to deliver a variety of cryptocurrency miners, ransomware, and spyware. It can also act as an exploit kit to deliver payloads, including itself, to other targets.
Summary
Purple Fox is a combined backdoor and rootkit used in several campaigns to deliver a variety of cryptocurrency miners, ransomware, and spyware. It can also act as an exploit kit to deliver payloads, including itself, to other targets.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
First observed in March 2018, Purple Fox is a combined fileless rootkit and backdoor trojan, that is also able to act as an exploit kit. Believed to be sold through several Russian-speaking hacking forums, Purple Fox has been used in a number of campaigns to deliver ransomware tools, spyware, and cryptocurrency mining malware.
Delivery
Older Purple Fox variants relied on the RIG exploit kit for delivery; with some variants also using trojanised versions of legitimate applications hosted on third-party sites for distribution.
However, in September 2019, new Purple Fox variants began to be observed that appeared to use built-in exploit kit (known as PFEK) functionality to replace RIG. At the time of publication, it thought that Purple Fox's authors included this functionality to avoid paying to use RIG.
PFEK uses the Popcash malvertising network to redirect users to attacker-controlled landing pages, where the exploit kit component attempt to fingerprint them. If any visitor matches the desired user profile, PFEK deploys an Internet Explorer scripting engine exploit alongside a local privilege escalation exploit to gain initial access.
Activities
Once present on the system, PFEK will perform several anti-analysis checks before dropping the primary Purple Fox Windows Installer (MSI) package. PFEK then register's the package as a boot-start driver before rebooting the system to ensure persistence.
When successfully executed, Purple Fox will inject a DLL containing it's rootkit into a new svchost process. It then connects to a command and control server and uploads user and system information.
Intended payloads are retrieved using either the NSIS tool in older Purple Fox versions, with newer versions using PowerShell.
Threat updates
| Date | Update |
|---|---|
| 24 Mar 2021 |
SMB worming capability
A new Purple Fox variant has been discovered that uses SMB brute-force attacks to propagate automatically. This version scans randomly generated IP blocks before attempting to authenticate to any responding SMB services. If successful, it will drop a copy of itself on the affected system. |
| 22 Oct 2020 |
New privilege escalation capability
Purple Fox has been updated with two new privilege escalation vulnerabilities and is being used in a new malvertising campaign targeting Internet Explorer users. |
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 24 March 2021 10:22 am