Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Java 'Icefog' Malware Variant Infects US Businesses

APT attack campaign uses tough-to-detect Java backdoor to compromise US oil company and two other organizations.

9 Notorious Hackers Of 2013
9 Notorious Hackers Of 2013
(Click image for larger view and for slideshow.)

Beware Java-based malware that's been used to exploit at least three US-based organizations.

That warning of a new advanced persistent threat (APT) attack campaign came via Kaspersky Lab, which said that it's traced a malicious Java archive (a.k.a. JAR) file to eight infected systems inside three US-based organizations, which it declined to name. "Based on the IP address, one of the victims was identified as a very large American independent oil and gas corporation, with operations in many other countries," Kaspersky Lab researchers Costin Raiu, Vitaly Kamluk, and Igor Soumenkov said in a joint blog post Tuesday. "As of today, all victims have been notified about the infections. Two of the victims have removed it already."

The attacks have been tied to the Icefog APT attack campaign, which historically has used Windows Preinstallation Environment files to infect targets.

What's unusual about the latest attacks is that the "Javafog" malware used by attackers was, as the name implies, written in Java. Furthermore, it includes only basic functionality, such as the ability to upload files to a designated server, as well as change the command-and-control (C&C) server to which it reports. "The backdoor doesn't do much else," according to Kaspersky Lab. "It allows the attackers to control the infected system and download files from it. Simple, yet very effective."

[Will US tech businesses pay a steep price for government surveillance? See NSA Fallout: Why Foreign Firms Won’t Buy American Tech.]

Why bother with a backdoor written in Java? "Malware written in Java code, like the Javafog Trojan, is extremely difficult to detect and therefore can remain stealthy for longer periods of time," says Dana Tamir in an email. Tamir is director of enterprise security at IBM-owned Trusteer, which sells a number of products that employ Java. As of Tuesday, the malware was being spotted by only three out of 47 antivirus engines on VirusTotal.

Blocking Java-based malware isn't difficult, provided businesses can eradicate older versions of the Java browser plug-in. "To prevent Java exploits and malware-based infiltrations, it is important to restrict execution only to known trusted Java files," says Tamir. "Organizations should at least restrict execution to files that have been signed by trusted vendors, or downloaded from trusted domains."

Patching known vulnerabilities is also a must. Indeed, at least one of the Javafog infections resulted from attackers exploiting known vulnerabilities in systems inside targeted organizations. "In one particular case, we observed the attack commencing by exploiting a Microsoft Office vulnerability, followed by the attackers attempting to deploy and run Javafog, with a different C&C," the Kaspersky Lab researchers said. "We can assume that based on their experience, the attackers found the Java backdoor to be more stealthy and harder to notice, making it more attractive for long-term operations."

If so, that would represent a changeup in the tactics being employed by the group behind the normal "smash and grab" Icefog attack campaign, which Kaspersky Lab discovered in September 2013. Kaspersky Lab said it has targeted "government institutions, military contractors, maritime, and ship-building groups." Previously the majority of targets were located in Japan and South Korea.

Whereas most APT campaigns employ "low and slow" attacks to create an undetected, long-term presence inside a targeted network, Icefog attacks differ. Notably, attackers appeared to be grabbing what they wanted and then ceasing their attack. Kaspersky Lab said that modus operandi suggested that the attackers were a "cybermercenary group" intent on stealing only designated bits of information.

If so, who commissioned the Icefog campaign? According to threat intelligence firm CrowdStrike, which refers to the attack campaign as "Dagger Panda," it's being run from China, which suggests that the hackers for hire have the backing of the Chinese government.

Last year, Adam Meyers, CrowdStrike's head of intelligence, said that China's five-year plan to modernize its infrastructure, including adding more deep-sea military capabilities, appeared to tie to a series of cyberattacks against US targets. Those attacks resulted in the theft of information pertaining to satellite technology, torpedoes, naval antennas, radar, and a naval ballistic-missile defense system, amongst other technology, all of which would be useful for improving deep-sea operations.

Icefog-related attacks date to at least 2011. That's when related malware was first discovered, which exfiltrated data from infected systems via email, and which was used to successfully infect systems inside both the Japanese House of Representatives and House of Councillors. Subsequent versions of Icefog added C&C capabilities and script-based proxy servers. A Mac OS X version dubbed "Macfog" also appeared to have been used to successfully infect several hundred Mac systems.

Kaspersky Lab said that although it only recently verified Javafog's existence, the underlying JAR file dates to Nov. 30, 2012, which suggests that it was in use for some time before being discovered, and that it may tie to long-term operations against US targets. "This brings another dimension to the Icefog gang's operations, which appear to be more diverse than initially thought," the Kaspersky Lab researchers said.

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter.

Next-gen intrusion-prevention systems have fuller visibility into applications and data. But do newer firewalls make IPS redundant? Also in the The IPS Makeover issue of Dark Reading Tech Digest: Find out what our 2013 Strategic Security Survey respondents have to say about IPS and firewalls. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
BryanB881
50%
50%
BryanB881,
User Rank: Apprentice
1/16/2014 | 8:32:33 PM
Targeted Attacks are the Strongest Attacks
I think this kind of attack is more common than the public knows.  Corporate and Nation State sponsered espionage will continue to rise.  If a company, particulary a manufacturing/processing compnay has valuable trade secrets there are millions to be made by finding those out.  Once it's founds out a company uses antivirus X and Firewall Y high level programmers can buy the same set up and test agaisnt it until they have the perfect worm. 

IT budgets will grow to protect from this.  Security is going to be layered.  White/black lists.  Multi scanning with a variety of AV engines.  Sandboxing.  Of course employeed education has to be there too. 
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20477
PUBLISHED: 2020-02-19
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
CVE-2019-20478
PUBLISHED: 2020-02-19
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
CVE-2011-2054
PUBLISHED: 2020-02-19
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper in...
CVE-2015-0749
PUBLISHED: 2020-02-19
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker ...
CVE-2015-9543
PUBLISHED: 2020-02-19
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is rel...