Security researchers have identified an ongoing cyber-espionage campaign that compromised 59 computers belonging to government organizations, research institutes, think tanks, and private companies from 23 countries in the past 10 days.
The attack campaign was discovered and analyzed by researchers from security firm Kaspersky Lab and the Laboratory of Cryptography and System Security (CrySyS) of the Budapest University of Technology and Economics.
[ Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to stop them in InfoWorld's "Fight Today's Malware" Shop Talk video and Malware Deep Dive Report. | Learn how to secure your systems with InfoWorld's Security Central newsletter. ]
Dubbed MiniDuke, the attack campaign used targeted email messages -- a technique known as spear phishing -- that carried malicious PDF files rigged with a recently patched exploit for Adobe Reader 9, 10, and 11.
The exploit was originally discovered in active attacks earlier this month by security researchers from FireEye and is capable of bypassing the sandbox protection in Adobe Reader 10 and 11. Adobe released security patches for the vulnerabilities targeted by the exploit on Feb. 20.
The new MiniDuke attacks use the same exploit identified by FireEye, but with some advanced modifications, said Costin Raiu, director of Kaspersky Lab's global research and analysis team, on Wednesday. This could suggest that the attackers had access to the toolkit that was used to create the original exploit.
The malicious PDF files are rogue copies of reports with content relevant to the targeted organizations and include a report on the informal ASEM (Asia-Europe Meeting) seminar on human rights, a report on Ukraine's NATO membership action plan, a report on Ukraine's regional foreign policy, and a report on the 2013 Armenian Economic Association, and more.
If the exploit is successful, the rogue PDF files install a piece of malware that's encrypted with information gathered from the affected system. This encryption technique was also used in the Gauss cyber-espionage malware and prevents the malware from being analyzed on a different system, Raiu said. If run on a different computer, the malware will execute, but will not initiate its malicious functionality, he said.
Another interesting aspect of this threat is that it's only 20KB in size and was written in Assembler, a method that's rarely used today by malware creators. Its small size is also unusual when compared to the size of modern malware, Raiu said. This suggests that the programmers were "old-school," he said.
The piece of malware installed during this first stage of the attack connects to specific Twitter accounts that contain encrypted commands pointing to four websites that act as command-and-control servers. These websites, which are hosted in the U.S., Germany, France, and Switzerland, host encrypted GIF files that contain a second backdoor program.
