GMERA Trojan
GMERA is an information stealing trojan used in attacks against cryptotrading platforms and their users.
Summary
GMERA is an information stealing trojan used in attacks against cryptotrading platforms and their users.
Threat details
Introduction
First observed in 2019, GMERA is an information-stealing trojan that targets cryptocurrency trading platforms and their users.
Delivery
GMERA is delivered asa ZIP archive file disguised as applications from a number of legitimate cryptocurrency trading platforms. At the time of publication, it is unclear how these spoof applications are distributed, although there are reports suggesting they may be hosted directly through the targeted platforms, raising the possibility that their websites may have been previously compromised.
Activities
When opened, the ZIP will install several component in the background whilst opening a browser window and navigating to the legitimate site.
These components will then attempt to extract user and system information before bas64 encoding it and sending it a command and control server. A number of the components contain additional functionality that does not appear to be working or is reliant on unreachable TOR addresses
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that the NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 27 July 2020 1:23 pm