Microsoft Analysts discovered a hacker campaign in which users are asked to solve CAPTCHA before they gain access to malicious content – an Excel document. This file contains macros that install GraceWire Trojan victims on the machine, which steals confidential information (for example, passwords).
Responsibility for this campaign is blamed on the hacking group Chimborazo, which experts have been observing since January of this year.
This campaign was named Chimborazo Dudear. Initially, hackers acted according to the classical pattern and applied malicious Excel documents to phishing emails. Then they switched to links embedded in messages. In recent weeks, the group began sending out phishing emails containing links to redirecting sites (usually legitimate resources that were hacked), and sometimes an HTML attachment containing a malicious iframe is attached to the emails.
By clicking on such a link or opening an attachment, the victim will in any case be taken to the site with the download of a malicious file. However, before accessing the file itself, the user will be forced to solve CAPTCHA. Thus, the attackers tried to complicate the work of automatic defense mechanisms, which should detect and block such attacks. Typically, this analysis is performed using bots that download malvari samples, run them, and analyze them on virtual machines. CAPTCHA, on the other hand, guarantees that a living person will load the Malvari sample.
In January of this year, Security Intelligence specialists have already wrote Chimborazo attacks. Researchers then said that a hacker group uses IP address tracking to identify computers from which they downloaded a malicious Excel file. Presumably, this was also done in order to avoid automatic detection.
Malwarebytes expert Jérôme Segura writes that the use of CAPTCHA by hackers is a rare but not unprecedented case. For example, he refers to tweet another information security specialist dated late December 2019. Then, a fake CAPTCHA was also discovered, which the attackers successfully used to complicate the work of automatic analysis.
CAPTCHA discovered by Microsoft may also be fake. As you can see in the picture above, the cybercriminals' website claims to use reCAPTCHA, but below it is stated that Cloudflare provides protection against DDoS attacks. These are two separate services, although it is possible that the hackers used both separately.