Hacker hands at work with interface around from Shutterstock.com

Kaspersky Lab researchers have detected multiple attempts to infect foreign diplomatic entities in Iran with homebrew spyware. The attacks appear to be using an updated Remexi backdoor. Several legitimate tools were also used during the campaign. The Remexi backdoor is linked to a suspected Farsi-speaking cyberespionage group known as Chafer, previously associated with the cyber-surveillance of individuals in the Middle East. The targeting of embassies could suggest a new focus for the group.

The operation highlights how threat actors in emerging regions are mounting campaigns against targets of interest using relatively basic, homebrew malware combined with publically available tools. In this instance, the attackers used an improved version of the Remexi backdoor – a tool that enables remote administration of a victim’s machine.

Remexi was first detected in 2015, being used by a cyberespionage group named Chafer for a cyber-surveillance operation targeting individuals and a number of organizations across the Middle East. The fact that the backdoor used in the new campaign has code similarities with known Remexi samples, combined with the target victim set means that Kaspersky Lab’s researchers have linked it to Chafer with medium confidence.

The newly discovered Remexi malware is able to execute commands remotely and to seize screenshots, browser data including user credentials, login data and history, and any typed text, among other things.

The stolen data is exfiltrated using the legitimate Microsoft Background Intelligent Transfer Service (BITS) application – a Windows component designed to enable background Windows updates.

The trend towards combining malware with appropriated or legitimate code helps attackers both to save time and resources when creating malware and to make attribution more complicated.

“When we talk about likely state-sponsored cyberespionage campaigns, people often imagine advanced operations with complex tools developed by experts. However, the people behind this spyware campaign look more like system administrators than sophisticated threat actors,” said Denis Legezo, security researcher at Kaspersky Lab

They know how to code, but their campaign relies more on the creative use of tools that exist already, than on new, advanced features or elaborate architecture of the code. However, even relatively simple tools can cause significant damage so we urge organizations to protect their valuable information and systems against all level of threats, and to use threat intelligence to understand how the landscape is evolving,” he added.

To protect yourself from targeted spyware:

  • Use a proven, corporate grade security solution with anti-targeted attack capabilities and threat intelligence, such as Kaspersky Threat Management and Defense solution. It is capable of spotting and catching advanced targeted attacks by analyzing network anomalies and giving cybersecurity teams full visibility over the network and response automation.
  • Introduce security awareness initiatives enabling employees to master the skill of identifying suspicious messages. Email is common entry point for a targeted attack, and Kaspersky Lab customers would benefit from Kaspersky Security Awareness Training.
  • Provide your security team with access to up to date threat intelligence data, to keep pace with the latest tactics and tools used by cybercriminals, and enhance security controls already in use.

Read the full version of the report on Securelist.com.

Subscribe
Notify of
0 Comments
Inline Feedbacks
View all comments
You May Also Like

Elon Musk says new Twitter chief has been hired

Elon Musk has announced that he has hired a new CEO to replace him at Twitter and its parent company, X Corporation. Musk’s running of Twitter has faced criticism, and he plans to transition to the role of executive chair and chief technology officer. The move comes after an unscientific Twitter poll in which the majority voted for Musk to step down as CEO.

Total prize pool of S$360,000, attractive publishing contracts await indie game developers at ‘Storm the World 2021’ competition

Storms, a game publisher and social gaming community app, has announced the…

Chinese hackers breached US govt email accounts: Microsoft

Chinese hackers, referred to as Storm-0558 by Microsoft, breached the email accounts of several US government agencies. The hackers primarily targeted government agencies in Western Europe and engaged in espionage, data theft, and credential access. While the targets were not identified, the US State Department confirmed detecting anomalous activity and taking immediate steps to secure their systems. The incident remains under investigation, and the full extent of the breach is being assessed.

Singapore defends misinformation law after criticism

Singapore has defended a controversial new law against misinformation that it has…