Trend Micro has uncovered a campaign of targeted attacks that have successfully compromised defense industry companies in Japan, Israel, India and the USA. We have been able to identify eight victims of this attack and are in the process of notifying them. In total, the attackers compromised 32 computers; however, there were multiple compromises at several locations. This network has been active since July 2011 and is continuing to send out malicious documents in an attempt to compromise additional targets.
We have analyzed a sample that connects to the same command-and-control (C&C) server in this targeted attack. We also analyzed the second stage malware used by the attackers that was built specifically for one of the targeted companies as well as a remote access Trojan (RAT) used by the attackers.
Attack Vector
The attackers sent out emails with a malicious .PDF attachment, detected by Trend Micro as TROJ_PIDIEF.EED which exploits a vulnerability in specific versions of Adobe Flash and Reader (CVE_2011-0611) to drop malicious files on the target’s computer. This malicious payload, detected by Trend Micro as BKDR_ZAPCHAST.QZ, connects to a C&C server and communicates some pieces of information about itself and awaits further commands.
The second stage of the attacks involves two components. The attackers issue commands that instruct the compromised computer to report back networking information and file names within specified directories. Certain targets are instructed to download custom DLLS, detected by Trend Micro as BKDR_HUPIG.B, that contain specific functionality related to the compromised entity.
Once inside the network, the attackers issue commands that cause the compromised computer to download tools that allow them to move laterally throughout the network including those that enable “ pass-the-hash” techniques. They then issue additional commands that cause the compromised computer to download a remote access Trojan (RAT) that allows the attackers to take real-time control of the compromised system. Trend Micro detects this RAT as BKDR_HUPIGON.ZXS and BKDR_HUPIGON.ZUY.
Remote Access Trojan
The RAT is called “MFC Hunter” and has three components:
- Server – installed on the victims machine and connects to the “hub”
- Hub – installed on an intermediary machine and serves as a proxy connection between victim and attacker
- MFC – the RAT client that the attackers use to control the victim’s compromised computer
 |
By staging the attacks this way, the attackers maintain two separate methods of control. The first allows them to schedule commands to be run by the compromised computer when it connects to the command and control server. The second allows attackers to take real-time control of the compromised computer using the RAT.
While this network has managed to compromise a relatively small number of victims, there is a high concentration of defense industry companies among the victims. Moreover, the fact that specific malware components are created for specific victims indicates a level of intentionality among the attackers.
Trend Micro is continuously monitoring this ongoing threat and will post updates on this blog for any noteworthy developments.
Leave a reply
