# FontPack: A dangerous update **blog.group-ib.com/fontpack** 03.06.2021 Attribution secrets: Who is behind stealing credentials and bank card data by asking to install fake Flash Player, browser or font updates? Attribution is our main focus here at Group-IB Threat Intelligence & Attribution, and it becomes harder every year. The number of unique malicious programs is decreasing while affiliate programs (collaborations between threat actors) are on the rise, with the number and quality of attacks both going up. Today Nikita Rostovtsev, an analyst at Group-IB Threat Intelligence, will show you attribution in practice by examining a malicious landing page that Group-IB specialists are tracking as FontPack. You will see what this page distributes and how it does so, as well as learn other interesting things that Group-IB has uncovered. First and foremost we need to find out who is behind the landing page, down to the specific hacking group or particular threat actor. All we know so far is that the page is hosted on compromised websites by injecting JS scripts. The scripts imitate a website crashing and display a message saying that users must update their software, e.g., the browser, Adobe Flash Player, or fonts. The code name used by our team, FontPack, is based on the decoy methods employed in the campaign we will analyze in this report. ----- Threat actors decide what particular fake to show their victim and how often to do so by changing relevant variables in the script code. According to our data, multiple unconnected hackers use the tool. Let us focus on one campaign whose goal was to deliver the RedLine stealer to victim devices. When successful, threat actors were able to collect their victims' credentials, autocomplete field data, and bank card information. Our analysis revealed that, since November 2020, FontPack has infected at least 20 websites, including six that were involved in one campaign. But first things first. What is FontPack? By "landing page" we mean a target webpage that is shown to users and urges them to download a malicious file that will then be executed. The FontPack landing page has been [known to Threat Intelligence & Attribution researchers since 2018. Other specialists may](https://blog.malwarebytes.com/threat-analysis/2020/02/domen-toolkit-gets-back-to-work-with-new-malvertising-campaign/) know it as "Domen toolkit" because of its variable called "var domen". How is FontPack injected into websites? Attacks start with injecting FontPack-containing JS scripts into websites created and controlled by the threat actors. Compromised legitimate websites are also used for the same purpose. ----- A fake window urging the user to update their browser, shown on top of a legitimate website Often, victims visit websites that they trust and that they have already been visiting for months, until one day the website asks them to update an outdated plugin. When they do so, malware is downloaded to their computer. This type of attack is the most effective for threat actors and the most dangerous for regular users because victims do not suspect an infection from a website they trust. Readers who do not yet understand what such websites can look like might find the gif below helpful: So, what exactly happened there? We see that a user goes to a website that they have visited before. After the victim spends some time there, the website contents starts to visually "break" and the browser asks the user to update Flash Player so that everything works properly again. The victim does so. ----- Landing page code analysis To understand how such attacks work, we looked at the contents of the malicious JS script. By analyzing the website contents, we detected a JS script called "wp-kernel.js". Example of FontPack landing page code showing that a fake website created using it will work both on desktop computers and mobile devices The script contents clearly show that, in addition to personal computers, it can infect mobile devices running Android and Blackberry OS, as well as devices that use the mobile browsers IEMobile and Opera Mini. The script identifies what browser is used for the connection and based on this information provides the victim with a link to the relevant file. The script changes fake windows by changing the value of the variable var banner: _Fake browser update window_ ----- _Fake font update window_ _Fake Adobe Flash Player update window_ The variable var startTime sets the time (in milliseconds) after which the user will be shown a fake window. The variable var linkMobile creates a link to an app for mobile devices (the link is not active in this particular case). As a result, in this particular campaign, we could only identify an infection designed for the Windows operating system. As mentioned above, when the script is working website contents are visually distorted — this is what the variable var bugs does. For this to happen, the variable must be set to True. When the variable is set to False, there are no changes to the website. The variable oneTimeShow, sets the frequency with which the script functions. If the variable is set to True, the script will only function once for every user. ----- In addition, the script contains a set of 27 language systems for which the fake windows will be shown. Spoiler alert: you will not find anything related to the post-Soviet region there. The aim of the report is not to describe how the script works in detail, however, so let us move on. The JS script code has the variable var domen with the value browsertelemetry[.]tk. The domain contains an admin panel hosted at https://browsertelemetry[.]tk/admin/login. The admin panel uses the Cyrillic alphabet on the authentication page: _Admin panel used in the FontPack campaign_ Underground platform profile analysis In a report released on February 28, 2020, Malwarebytes researchers showed that the landing page in question was put up for sale on April 10, 2019. In a screenshot provided by the researchers, the thread author is a user with the username xxbtc. The same landing page was distributed by users with the usernames grinGo and holeo. It is noteworthy that the item was put up for sale by three different users on different underground platforms. ----- Every screenshot above has roughly the same text (with some variation) about selling a Russian-language landing page with the following content: "Script for achieving EXE/APK installations! The script is designed for achieving installations from websites/shells/fakes It is adapted to both computers and mobile devices The JS script connects to any website through