Tool only drops malware after painstakingly dismantling AV and other defenses. A campaign that targeted a European energy company wielded malware that’s so sneaky and advanced it almost certainly is the work of a wealthy nation, researchers said Tuesday.
Once the malware has gained administrative control of a computer, it uses its lofty perch to survey the connected network, report its findings to its operators, and await further instructions. From then on, attackers have a network backdoor that allows them to install other types of malware, either for more detailed espionage or potentially sabotage. Researchers from security firm SentinelOne found the malware circulating in an underground forum and say it has already infected an unnamed energy company in Europe.
“If you wanted an implant on a network where you could run whatever you wanted with impunity, this is that thing,” SentinelOne Senior Researcher Joseph Landry told Ars. “All you’ve got to do is get this on one of the machines in the network and from there you can pivot to whatever you want.” He continued:
You don’t have to worry about being detected because even if [administrators] were to find this computer doesn’t have the antivirus product installed, it’s deliberately breaking the ability to reinstall any new antivirus on it and if you do get one installed it won’t update. [The operators] wanted to get in for a while, not just a quick wham bam thankyou ma’am. They wanted to be able to explore the network and so they set this up as the machine they could run whatever they wanted to without being detected.
Landry and SentinelOne Chief Security Officer Udi Shamir said the so-called malware dropper is the parent of Furtim, another piece of highly cautious malware that came to light in May. Like the newly discovered dropper, Furtim is able to evade antivirus and other security defenses. It can then harvest account credentials stored in installed programs and disable sleep and hibernation modes so infected machines remain connected to command and control channels almost continuously.
Discovery of the dropper helps explain how Furtim and possibly other malware takes hold in highly sensitive companies. Because the dropper communicates with a command and control channel, it allows operators to customize attacks based on the specific machines and other features found on a targeted network. And like Furtim, which had the ability to evade some 250 different security-related sites, the dropper is similarly careful to bypass security defenses. The level of evasion makes the dropper one of the sneakiest to come to light this year, Shamir said.
As advanced as the dropper is, it relied on some surprisingly crude methods for gaining administrative access to the computers it infected. One method was exploits for CVE-2014-4113 andCVE-2015-1701, which are Windows escalation-of-privilege vulnerabilities fixed in October 2014 andMay 2015, respectively. Shamir of SentinelOne said it’s not unusual for industrial systems to remain unpatched, because updates often cause the highly specialized equipment the computers control to malfunction. In the event the escalation exploits don’t work, the dropper can display a fake prompt instructing the end user to grant it administrative access.
The amount of time and effort required to develop the dropper almost certainly means that it’s the work of a wealthy government. Based on how concise the code is, Landry said he suspects it was developed by engineers located in Eastern Europe, possibly Russia, but he sounded the oft-repeated warning about how easy it is for researchers to misattribute these types of attacks and said his assessment was little more than speculation. Landry said he still doesn’t know how the dropper gets installed.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
