Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Mahdi Malware Hits Middle Eastern Targets

Despite attacking critical infrastructure, financial services, and government embassy targets in Iran and Israel, the "Messiah" malware doesn't appear to tie directly to Flame.

Two security firms this week disclosed that they're working to eradicate a malware campaign that targets users in several Middle Eastern countries and which has been active for at least eight months.

The attackers used malware that's been dubbed "Mahdi"--which in Islamic eschatology is synonymous with Messiah--by Seculert, which said it discovered the malware several months ago, and found the word Mahdi used in multiple strings of code. Interestingly, the malware was introduced via a spear-phishing attack that included a fake Microsoft Word document. Opening the attachment would execute the malware, as well as open a copy of a Daily Beast article analyzing Israel's potential electronic warfare capabilities against Iran.

After Kaspersky Lab announced in May 2012 that it had discovered the Flame malware, Seculert said it reached out to the security firm to help it ascertain whether Flame and Mahdi might be connected. But so far, the security firms said there's no evidence of a link, although the targets are similar.

"While we couldn't find a direct connection between the campaigns, the targeted victims of Mahdi include critical infrastructure companies, financial services, and government embassies, which are all located in Iran, Israel, and several other Middle Eastern countries," according to a blog post from Seculert. So far, victim systems have been located as being in Iran (387 infected systems found), Israel (54), Afghanistan (14), United Arab Emirates (6), and Saudi Arabia (4).

[ Learn One Secret That Stops Hackers: Girlfriends. ]

"Large amounts of data collection reveal the focus of the campaign [is] on Middle Eastern critical infrastructure engineering firms, government agencies, financial houses, and academia," and some targets appear to have been monitored by attackers for extended periods of time, according to an analysis published by the global research and analysis team at Kaspersky Lab. "The campaign relied on a couple of well-known, simpler attack techniques to deliver the payloads, which reveals a bit about the victims' online awareness"--or lack thereof, it said.

As of Tuesday, the malware campaign appeared to still be operating. "We are working with various organizations to clean up and prevent further infections," said Kaspersky. According to Seculert, to date it's identified four command-and-control servers running the Mahdi-related malware.

Mahdi's authors preferred to distribute their malware via social-engineering attacks, disguising their malware as legitimate PowerPoint file slideshows, or sending out executables with filenames that were disguised to make them look like images or PDF files. Running the executable or paging through the PowerPoint slideshow, meanwhile, would trigger a malicious Trojan dropper file to download further malware onto the targeted device, giving attackers a backdoor to the system.

"The backdoors that were delivered to approximately 800 victim systems were all coded in Delphi," said Kaspersky. "This would be expected from more amateur programmers, or developers in a rushed project." Furthermore, the malicious executables appear to be repackaged--using legitimate compression software--on a regular basis, which means the "quickly shifting code will get the code past some gateway security products."

What's interesting about Mahdi is that the attack only appears to be as complex as it needed to be. "Most of the components are simple in concept, but effective in practice," according to Kaspersky. "No extended zero-day research efforts, no security researcher commitments or big salaries were required. In other words, attacking this set of victims without zero-day--in this region--works well enough."

That differentiates the malware from Flame, which was built using world-class cryptographic expertise. Notably, Flame's creators found a way to spoof the Microsoft signing service, allowing them to install entire copies of the malicious application automatically, using the Windows Update functionality built into all versions of Microsoft Windows.

While Mahdi is simple by comparison, it still offers attackers a range of monitoring capabilities, including logging all keystrokes on the device, capturing screenshots at preset intervals or when triggered by specified events, such as the user actively using Facebook, Gmail, Google+, Hotmail, Skype, or Yahoo Mail. In addition, the backdoor software could download additional functionality; analyze the disk structure of the infected PC; and record audio as a .WAV file. Additional functionality, including enabling the malware to automatically delete itself, appears to have been added in but not finalized.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CVE-2020-15277
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.
CVE-2020-7373
PUBLISHED: 2020-10-30
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is ...