Report about hack threat to Tibetan activists used as lure in attack against them
- 22 March, 2012 02:20
Hackers are using a recent report about cyberthreats to Tibetan activists as a lure in a new attack against pro-Tibet organizations that distributes Windows and Mac malware, researchers from security vendor AlienVault said on Monday.
On March 13, AlienVault published a report about email-based cyberattacks against Tibetan activist organizations including the Central Tibet Administration and the International Campaign for Tibet.
The rogue emails seen in those attacks distributed a booby-trapped Word document that exploited a Microsoft Office vulnerability (designated CVE-2010-3333) to install a variant of Gh0st RAT, a remote access computer Trojan.
AlienVault researchers believe that the Tibet attack campaign was organized by the same group of Chinese hackers that launched the so-called Nitro attacks against dozens of chemical sector companies last year.
However, it seems that even though the cyberespionage operation was exposed, hackers haven't given up on targeting pro-Tibet organizations. In fact, they started using AlienVault's report about the campaign as a lure in new attacks against Tibetan activists, said AlienVault researcher Jaime Blasco in a blog post on Monday.
Newly intercepted rogue emails that use spoofed headers to appear as originating from AlienVault warn recipients that Tibetan activist organizations have been targeted in recent cyberattacks.
Successful exploitation attempts result in computer backdoors being installed on both Windows and Mac OS X systems. The Mac backdoor had a zero detection rate on VirusTotal when scanned by AlienVault on Monday, Blasco said. Now, it is detected by six out of the 43 antivirus engines used by the service.
The Mac piece of malware connects to a command and control server hosted on a domain name that was associated in the past with attacks involving the Protux backdoor, Blasco said.
It's not clear whether the Nitro gang is responsible for the new attacks against Tibetan activists, but the group is known to have used similar techniques before. In December 2011, Symantec reported a series of malicious emails sent by the Nitro gang that used the company's original report about the group's operations as a lure.
CVE-2011-3544 exploits have been observed in many targeted attacks during the past month. Last Friday, Kaspersky Lab reported the same vulnerability being exploited in an attack against visitors to popular Russian news websites.
Microsoft also reported a spike in the usage of CVE-2011-3544 exploits, even though they have not been incorporated in popular drive-by download toolkits like Blackhole or Phoenix yet. Users are advised to update their Java installations and remove older versions from their systems in order to thwart attacks that leverage this vulnerability, Microsoft researchers said in a blog post on Tuesday.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Protection Storage Architecture: The What, Why, and How
- ‘A Little Extra Service’ Raises Customer Satisfaction and Lowers Costs
- Convergence with Vblock Systems: A Value Measurement - IDC In-depth assessment
- Pathways Advanced ICT Leadership Development Program Course Outline and Big 6 2013
- Chandler Macleod recruits new user virtualization platform
- Some Australian businesses 'unlikely' to be ready for Privacy Act changes: survey
- BYOA 'shadow IT' grows in the enterprise: Telsyte
- Cost of a Privacy Act breach could extend to ongoing audits: legal expert
- How Hunter Water is saving $50k a year in software licences
- Audit agency does BYOD with BlackBerry
Trust issue looms large for tech companies capitalizing on personal data
5 women who've made it in IT
Five trends affecting legal CIOs
CIO Roundtable: The changing face of security
Bitcoin malware count soars as cryptocurrency value climbs
The Collaboration Paradox
In this whitepaper, we look at how new collaboration tools enable global executives to get more out of teams and make faster decisions. However, these teams feel restricted by outdated communication methods that lead to slower decision making and ultimately wasted time and money. Download to hear from the most enthusiastic adopters of collaboration tools and the benefits they have seen in their workplace.
Pathways Course Curriculum 2014
Developed by the CIO Executive Council, Pathways is a unique, flexible, self-managed, self-paced 12-month professional development program that brings together best practices, thought leadership and business insights for today’s most promising ICT professionals. Pathways is designed and delivered by leading local and global CIOs; enabling participants to capitalise on mentor CIOs personal experiences, expertise and knowledge.
451 Group Research Report MDM Trends
As the BYOD model continues to grow at twice the rate of corporate-owned devices, enterprises are facing an increasingly diversified mobility landscape. And though BYOD brings many benefits, complex management and security challenges are also ushered in. Read this report to understand what MDM can and cannot do for you and which solutions are being chosen today - and tomorrow.