Researchers find unusual malware targeting Tibetan users in cyberespionage operation
The malware abuses the Windows Management Instrumentation (WMI) service to remain undetected, researchers from ESET said
IDG News Service - Security researchers from antivirus vendor ESET discovered a piece of cyberespionage malware targeting Tibetan activists that uses unusual techniques to evade detection and achieve persistency on infected systems.
The malware, which was dubbed Win32/Syndicasec.A, bypasses the UAC (User Account Control) mechanism in Windows to run arbitrary commands with elevated privileges without prompting users for confirmation.
It exploits a design flaw in the Windows UAC whitelist functionality that was documents back in 2009 by a developer named Leo Davidson. In fact, the malware uses Davidson's proof-of-concept code with almost no modifications, said Alexis Dorais-Joncas, Security Intelligence Team Lead at ESET, Thursday in a blog post.
The abuse of WMI in malware is not new, but is a rare occurrence, Dorais-Joncas said. "This technique has the excellent property (from the attacker's point of view) of not requiring any malicious code to be stored as a regular file on disk. This causes standard dynamic analysis tools such as Process Monitor to fail to clearly highlight the malicious activity."
The Stuxnet cyberespionage malware, which targeted Iran's nuclear fuel enrichment plant at Natanz, also used this technique, he said.
The rogue WMI script added by the malware makes HTTP requests to hardcoded URLs that point to the RSS feeds of free blog sites. The title tags of RSS entries in those feeds contain encrypted commands that, when decoded, reveal the URLs of the actual command-and-control (C&C) servers.
The ESET researchers infected a test machine with Win32/Syndicasec in order to monitor its traffic and found that the interactions between the C&C server and the malware didn't appear to be automated.
"Every day would bring different commands sent at non-regular time intervals, making it look just as if someone was sitting behind a console and manually controlling infected hosts," Dorais-Joncas said.
The observed commands suggested that the attackers were browsing through the machine's file system and were gathering details about its network settings, attached drives and running programs.
The ESET researchers located different versions of the master script, the oldest of which dated from July 2010, suggesting that this cyberespionage operation has been active for several years.
The domain names used for the C&C servers included references to Tibet, for example tbtworld.info and tbtsociety.info. The most recent C&C domain, which was set up in late April, is called nedfortibt.info.
The 'ned' in 'nedfortibt.info' is likely a reference to the National Endowment for Democracy (NED), a nonprofit foundation funded by the U.S. Congress that supports non-governmental groups who are working for democratic goals in over 90 countries and which is openly supportive of Tibetans in their relations with China, Dorais-Joncas said.
According to the ESET researchers, the infection scale of Win32/Syndicasec is small and strictly limited to Nepal and China.
"The lack of built-in commands [in the master script] prevents us from discovering the real end-goal of this operation," Dorais-Joncas said. "However, we can affirm that the various characteristics observed around this threat are similar to other espionage campaigns against Tibetan activists that we have observed."
- Where You Mitigate Heartbleed Matters Read this article to learn more about why customers must choose the most strategic point in the network at which to deploy their...
- Mitigating Multiple DDoS Attack Vectors It's time to rethink and refine the enterprise security architecture, so organizations can remain agile and resilient against future threats. Download this infographic...
- SIP Migration: Addressing CIOs' Concerns Recent data from IDG Research shows that many IT executives are counting on SIP to help them meet employee efficiency and customer experience...
- City Solved Network Mystery - Saves $30K The City of Jacksonville put their hunch to work and not only solved a mystery, but found a new and innovative use for...
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily...
- On Demand: Mastering the Art of Mobile Content Management Mobile device usage in the enterprise has skyrocketed, and it continues to escalate. IT must answer to users who demand access to their... All Network Security White Papers | Webcasts