{"id":61816,"date":"2018-02-07T10:00:24","date_gmt":"2018-02-07T18:00:24","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=61816"},"modified":"2026-06-11T15:27:18","modified_gmt":"2026-06-11T22:27:18","slug":"threat-brief-hancitor-actors","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2018\/02\/threat-brief-hancitor-actors\/","title":{"rendered":"Threat Brief: Hancitor Actors"},"content":{"rendered":"

If you need to understand one thing about cybercrime, it\u2019s that it is all about business.<\/p>\n

In our latest Unit 42 research on cybercriminals using the Hancitor malware, we show that not only are their attacks about business, we can see these cybercriminals deftly applying some fundamental business principles around timing, specialization, and globalization.<\/p>\n

Hancitor is a malware that focuses getting other malware onto the victim\u2019s system. In the case of Hancitor, it\u2019s typically banking Trojans that steal the victim\u2019s banking information.<\/p>\n

In our latest research, we can see the attackers behind Hancitor have been timing their attacks to happen during the busiest time of the global working week, the middle of the week. And we\u2019ve seen that in adapting their attacks to better evade detection, they\u2019ve specialized their operations around the globe.<\/p>\n

Hancitor isn\u2019t particularly advanced in its tactics: it\u2019s ideal target is an old or outdated version of Microsoft Windows like Windows 7 or even Windows XP. But it\u2019s effective enough that when used in several hundred different spam campaigns every month it pays for the criminals to keep up these attacks against targets around the world.<\/p>\n

 <\/p>\n

Timing <\/span><\/p>\n

In our most recent research, one of the things that jumped out for our researchers is the clear pattern around the timing of the attacks. As you can see in Figure 1 below, throughout 2017, the Hancitor attacks show clear spikes in their occurrence and these spikes happen during the middle of the week.<\/p>\n

\"Hancitor_1\"<\/span><\/div><\/p>\n

Figure 1: Timeline of Hancitor campaign activity since January 2017.<\/em><\/p>\n

The attackers behind Hancitor aren\u2019t the first to time their spam attacks like this, but it is an effective tactic to try and increase their chances of success, especially when combined with the other innovation that we\u2019ve seen.<\/p>\n

 <\/p>\n

Adapting the Attacks<\/span><\/p>\n

In the past, Hancitor was sent as a malicious attachment in a spam email which would then download and install the attackers\u2019 final malware like a banking Trojan. When they would do this, the Hancitor attachment would download and install the final malware from a malicious or compromised site.<\/p>\n

But as organizations have gotten more effective at blocking malicious attachments like Hancitor, we\u2019ve seen the attackers behind Hancitor adapt to evade detection and prevention.<\/p>\n

They\u2019ve done this by moving the Hancitor malware from being a malicious attachment in spam to itself being a malicious download. The spam the attackers use no long has a malicious attachment but instead a malicious link that downloads the malicious Hancitor attachment.<\/p>\n

To do this, they make the spam look like something that requires you to click and download something like and invoice, a message, or a delivery notification. Figure 2 shows one of these that was made to look like an Amazon shipping notice.<\/p>\n

\"Hancitor_4\"<\/span><\/div><\/p>\n

Figure 2: Hancitor malspam example from February 2017.<\/em><\/p>\n

This means that a Hancitor attack now has two downloads rather than one and what these attackers did around the malicious downloads shows another modern business tactic: globalization.<\/p>\n

 <\/p>\n

Globalizing the Attacks<\/span><\/p>\n

Figure 3 below is a map showing where our Unit 42 researchers have found webistes involved in Hancitor attacks.<\/p>\n

\"Hancitor_7\"<\/span><\/div><\/p>\n

Figure 3: Hancitor distribution servers globally thus far in 2017<\/em><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Country<\/td>\nNumber of Distribution servers<\/td>\n<\/tr>\n
United States<\/td>\n197<\/td>\n<\/tr>\n
Japan<\/td>\n23<\/td>\n<\/tr>\n
Vietnam<\/td>\n13<\/td>\n<\/tr>\n
Singapore<\/td>\n12<\/td>\n<\/tr>\n
Russia<\/td>\n7<\/td>\n<\/tr>\n
Brazil<\/td>\n6<\/td>\n<\/tr>\n
Malaysia<\/td>\n6<\/td>\n<\/tr>\n
Hong Kong<\/td>\n5<\/td>\n<\/tr>\n
South Africa<\/td>\n4<\/td>\n<\/tr>\n
Thailand<\/td>\n4<\/td>\n<\/tr>\n
India<\/td>\n2<\/td>\n<\/tr>\n
Ireland<\/td>\n2<\/td>\n<\/tr>\n
Kazakhstan<\/td>\n2<\/td>\n<\/tr>\n
Taiwan<\/td>\n2<\/td>\n<\/tr>\n
Turkey<\/td>\n2<\/td>\n<\/tr>\n
Ukraine<\/td>\n2<\/td>\n<\/tr>\n
Argentina<\/td>\n1<\/td>\n<\/tr>\n
Canada<\/td>\n1<\/td>\n<\/tr>\n
Germany<\/td>\n1<\/td>\n<\/tr>\n
Israel<\/td>\n1<\/td>\n<\/tr>\n
Italy<\/td>\n1<\/td>\n<\/tr>\n
Netherlands<\/td>\n1<\/td>\n<\/tr>\n
Republic of Korea<\/td>\n1<\/td>\n<\/tr>\n
Republic of Lithuania<\/td>\n1<\/td>\n<\/tr>\n
United Kingdom<\/td>\n1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 1 \u2013 Number of Distribution Servers by Country<\/em><\/p>\n

 <\/p>\n

The hot spots in the United States represents distribution servers which are created using fraud based accounts at various hosting providers that are hosting the Hancitor documents while the hotspots in Asia represent legitimate sites for small and medium businesses that have been compromised by the actors behind Hancitor campaign to host the malicious Hancitor documents.<\/p>\n

 <\/p>\n

Conclusion<\/span><\/p>\n

Attackers are always making business decisions to optimize their attacks in ways that are most successful and profitable. What is most interesting about Hancitor is the way these decisions so clearly reflect an awareness of business realities (by targeting peak working times) and dividing up the \u201cwork\u201d of their attacks in a way that so clearly mirrors mainstream business decisions around globalizing operations.<\/p>\n

In the end, while Hancitor may not be sophisticated, these steps to adapt and stay effective seem to be succeeding. And we expect to continue to see Hancitor be a global threat for the foreseeable future.<\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Read this Threat Brief to learn how Hancitor threat actors use fundamental business tactics to deliver attacks <\/p>\n","protected":false},"author":287,"featured_media":25785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[10737],"tags":[1302,5410,2506],"coauthors":[3069],"class_list":["post-61816","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-intelligence","tag-cybercrime","tag-cybercrime-business","tag-hancitor"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2017\/03\/Linkedin.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/61816","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/287"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=61816"}],"version-history":[{"count":3,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/61816\/revisions"}],"predecessor-version":[{"id":61828,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/61816\/revisions\/61828"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/25785"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=61816"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=61816"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=61816"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=61816"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}