Sof39s bar bitcoin price
46 comments
Ethereum prison id
ESET researchers have found that Turla, the notorious state-sponsored cyberespionage group, has added a fresh weapon to its arsenal that is being used in new campaigns targeting embassies and consulates in the post-Soviet states. In so doing, the attackers essentially misuse the Adobe brand to trick users into downloading malware. The victims are made to believe that the only thing that they are downloading is authentic software from adobe.
Unfortunately, nothing could be further from the truth. The new malicious tool also shares similarities with other malware families spread by the group.
Importantly, however, it is safe to rule out a scenario involving some sort of compromise of Adobe. The possibility involving a compromise of the Adobe Flash Player download website has also been practically discarded. Note that the scenario under 5 is seen as very unlikely.
Once the fake Flash installer is downloaded and launched, one of several backdoors is dropped. It could be Mosquito, which is a piece of Win32 malware, a malicious JavaScript file communicating with a web app hosted on Google Apps Script, or an unknown file downloaded from a bogus and non-existent Adobe URL. This information includes the unique ID of the compromised machine, the username, and the list of security products installed on the device. At the final part of the process, the fake installer drops — or downloads — and then runs a legitimate Flash Player application.
ESET researchers have seen in the wild, new samples of the backdoor known as Mosquito. It also creates an administrative account that allows remote access. It uses a custom encryption algorithm and can execute certain predefined actions.
The backdoor keeps track of everything it does on the compromised machine in an encrypted log file. Turla has been operating for a number of years and its activities have been monitored and analyzed by ESET research laboratories.
Diplomats in Eastern Europe bitten by a Turla mosquito. You are commenting using your WordPress. You are commenting using your Twitter account. You are commenting using your Facebook account. Notify me of new comments via email. Notify me of new posts via email. The possible attack vectors ESET researchers considered are: This would effectively involve on-the-fly redirection of the traffic of the targeted machine to a compromised machine on the local network.
All the known victims are located in different countries, and we identified them using at least four different ISPs. Leave a Reply Cancel reply Enter your comment here Fill in your details below or click an icon to log in: Email required Address never made public.
Post was not sent - check your email addresses! Sorry, your blog cannot share posts by email.