Hacker hands at work with interface around from Shutterstock.com

Kaspersky Lab researchers have detected multiple attempts to infect foreign diplomatic entities in Iran with homebrew spyware. The attacks appear to be using an updated Remexi backdoor. Several legitimate tools were also used during the campaign. The Remexi backdoor is linked to a suspected Farsi-speaking cyberespionage group known as Chafer, previously associated with the cyber-surveillance of individuals in the Middle East. The targeting of embassies could suggest a new focus for the group.

The operation highlights how threat actors in emerging regions are mounting campaigns against targets of interest using relatively basic, homebrew malware combined with publically available tools. In this instance, the attackers used an improved version of the Remexi backdoor – a tool that enables remote administration of a victim’s machine.

Remexi was first detected in 2015, being used by a cyberespionage group named Chafer for a cyber-surveillance operation targeting individuals and a number of organizations across the Middle East. The fact that the backdoor used in the new campaign has code similarities with known Remexi samples, combined with the target victim set means that Kaspersky Lab’s researchers have linked it to Chafer with medium confidence.

The newly discovered Remexi malware is able to execute commands remotely and to seize screenshots, browser data including user credentials, login data and history, and any typed text, among other things.

The stolen data is exfiltrated using the legitimate Microsoft Background Intelligent Transfer Service (BITS) application – a Windows component designed to enable background Windows updates.

The trend towards combining malware with appropriated or legitimate code helps attackers both to save time and resources when creating malware and to make attribution more complicated.

“When we talk about likely state-sponsored cyberespionage campaigns, people often imagine advanced operations with complex tools developed by experts. However, the people behind this spyware campaign look more like system administrators than sophisticated threat actors,” said Denis Legezo, security researcher at Kaspersky Lab

They know how to code, but their campaign relies more on the creative use of tools that exist already, than on new, advanced features or elaborate architecture of the code. However, even relatively simple tools can cause significant damage so we urge organizations to protect their valuable information and systems against all level of threats, and to use threat intelligence to understand how the landscape is evolving,” he added.

To protect yourself from targeted spyware:

  • Use a proven, corporate grade security solution with anti-targeted attack capabilities and threat intelligence, such as Kaspersky Threat Management and Defense solution. It is capable of spotting and catching advanced targeted attacks by analyzing network anomalies and giving cybersecurity teams full visibility over the network and response automation.
  • Introduce security awareness initiatives enabling employees to master the skill of identifying suspicious messages. Email is common entry point for a targeted attack, and Kaspersky Lab customers would benefit from Kaspersky Security Awareness Training.
  • Provide your security team with access to up to date threat intelligence data, to keep pace with the latest tactics and tools used by cybercriminals, and enhance security controls already in use.

Read the full version of the report on Securelist.com.

Subscribe
Notify of
0 Comments
Inline Feedbacks
View all comments
You May Also Like

Commuters can now tap for fares with fitness bands from Garmin

EZ-Link Pte Ltd, Singapore’s largest issuer of CEPAS compliant cards, today announced…

Temasek Holdings CEO Ho Ching decries adoption of TraceTogether app, highlights impact on iPhone battery life

The drain on the battery life of iPhones is Singapore’s government-developed contact…

Sensitive data of ST Engineering’s US subsidiary was breached by group of cybercriminals

Recently, it has been discovered that a “sophisticated” group of cybercriminals, known…

StarHub ushering cable customers to all-fibre networks

StarHub will cease the provision of cable services after 30 June 2019 as…