Attacks/Breaches
7/22/2011
04:22 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

New Targeted Attack Campaign Against Defense Contractors Under Way

Researchers at Invincea, ThreatGrid discover stealthy attack that lets attackers quietly steal information from victims

The U.S. Defense industry once again is under siege by cyberspies in an attack that provides a link to a rigged spreadsheet containing a real list of high-level defense industry executives who attended a recent Intelligence Advanced Research Projects Activity (IARPA) event.

A Defense contractor friend of Anup Ghosh, CEO of Invincea, sent him a copy of a targeted yet suspicious email with the attachment he had received unsolicited. "He said he has been a nonstop target of a lot of spear-phishing attempts, but this one was very compelling because it was purported to have names of attendees to a recent IARPA meeting," Ghosh says. It appears that the attackers sent the same email and malicious attachment to the other 163 event attendees, he says.

The embedded URL -- which appears to be a subdomain of a domain that redirects to the legitimate research project website -- provides a ZIP archive to the attendee roster, which includes the names of directors, presidents, and CEOs of major Defense and intelligence companies.

"Unzipped, you see an XLS-looking file, but it's actually an executable," Ghosh says. "It extracts another custom program that's an HTTP client. This client beacons out to a server. You wouldn't notice it even if you were looking at your system process table: It looks like standard browser activity."

It's not until the system is rebooted, however, that the badness begins: The client reaches out to a command-and-control (C&C) server, which sends it another executable file. "That's the payload of the weapon," he says.

Dean De Beer and his team at ThreatGrid analyzed the executable, and found that it's a remote C&C Trojan hosted on a website. That Trojan gives the attackers full control of the victim's machine and Internet settings in the registry, and is able to update the root certificate lists that could be used for SSL man-in-the-middle attacks.

The researchers have alerted the targeted victims, as well as other members of the Defense industry and law enforcement.

They are unable to tell just how far the attackers got or what they might have stolen. "We would have to hack back into their server, and even then we may not see the actual data. But we don't do that, and we didn't do that," De Beer says. "We know the remote command-and-control built-in commands can exfiltrate data."

The attack appears to be an ongoing, active campaign targeting multiple Defense contractors, the researchers say, with similar methods but some different documents and executables. "The M.O. was the same," Invincea's Ghosh says.

Others have used different files but use the same outbound URL format as the "beaconing URLs" used in the IARPA event spear-phish, the researchers say.

The full attack analysis is available in an Invincea blog post here.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web