Experts Warns of Notable Increase in QuickBooks Data Files Theft Attacks

New research has uncovered a significant increase in QuickBooks
file data theft using social engineering tricks to deliver malware
and exploit the accounting software.

“A majority of the time, the attack involves basic malware that
is often signed, making it hard to detect using antivirus or other
threat detection software,” researchers from ThreatLocker said in
an analysis shared today with The Hacker News.

QuickBooks is an accounting software package developed and
marketed by Intuit.

The spear-phishing attacks take the form of a PowerShell command
that’s capable of running inside of the email, the researchers
said, adding, a second attack vector involves decoy documents sent
via email messages that, when opened, runs a macro to download
malicious code which uploads QuickBooks files to an
attacker-controlled server.

Alternatively, bad actors have also been spotted running a
PowerShell command called Invoke-WebRequests^[1]
on target systems to upload relevant data to the Internet without
the need for downloading specialized malware.

“When a user has access to the Quickbooks database, a piece of
malware or weaponized PowerShell is capable of reading the user’s
file from the file server regardless of whether they are an
administrator or not,” the researchers said.

Furthermore, the attack surface increases exponentially in the
event QuickBooks file permissions are set to the “Everyone^[2]” group, as an attacker
can target any individual in the company, as opposed to a specific
person with the right privileges.

That’s not all. Besides selling the stolen data on the dark web,
the researchers say they found instances where the operators behind
the attacks resorted to bait-and-switch tactics to lure customers
into making fraudulent bank transfers by posing as suppliers or
partners.

Advising users to remain vigilant of these attacks, ThreatLocker
recommends that file permissions are not set to the “Everyone”
group to limit exposure.

“If you are using a Database Server Manager, be sure to check
the permissions after running a database repair and confirm they
are locked down,” the researchers said.