Red October malware discovered after years of stealing data in the wild - crabtreelunarned

A shadowy group of hackers has siphoned intelligence data worldwide from diplomatic, government, and scientific research computer networks for more five years, including targets in the U.S., according to a report from Kaspersky Laboratory.

Kaspersky Lab began researching the malware attacks in October and dubbed them "Rocra," short for "Cherry-red Oct." Rocra uses a come of certificate vulnerabilities in Microsoft Excel, Word, and PDF documents types to infect PCs, smartphones, and computing device networking equipment. On Tuesday researchers discovered the malware platform also uses Network-settled Java exploits.

Information technology's not unsubtle who is behind the attacks, but Rocra uses leastwise three publicly celebrated exploits earlier created by Chinese hackers. Rocra's programming, however, appears to glucinium from a separate grouping of Russian-speaking operatives, according to the report from Kaspersky Lab.

The attacks are ongoing and targeted at tall-level institutions in what are known every bit spear-fishing attacks. Kaspersky estimates that the Red Oct attacks have likely obtained hundreds of terabytes of data in the time information technology has been operational, which could be as earlyish A May 2007.

Rocra infections were discovered in more than 300 countries between 2022 and 2022, based happening data from Kaspersky's antivirus products. Elocutionary countries were primarily former members of the United StatesS.R., including Russia (35 infections), Kazakhstan (21), and Azerbaijan (15).

Other countries with a high number of infections include Belgium (15), India (14), Afghanistan (10), and Armenia (10). Cardinal infections were uncovered at embassies located in the United States. Because these numbers came only from machines victimisation Kaspersky software, the real number of infections could be much higher.

Look at it all

Kaspersky said the malware used in Rocra sack steal data from PC workstations and smartphones adjacent to PCs including the iPhone, Nokia, and Windows Transferrable handsets. Rocra can acquire network configuration information from Coregonus artedi-proprietary equipment, and seize files from removable disk drives including deleted data.

The malware political platform can also steal electronic mail messages and attachments, record all keystrokes of an infected car, take screenshots, and take hold of browse history from Chrome, Firefox, Explorer, and Opera Network browsers. As if that wasn't enough, Rocra also grabs files stored on local meshwork FTP servers and can replicate itself crosswise a local anesthetic network.

Par for the course

Even though Rocra's capabilities appear extended, not everyone in the certificate field was impressed by Rocra's methods of attack. "It appears the exploits used were not advanced in some way," the security firm F-Protected said connected its company blog. "The attackers victimised old, long-familiar Word, Stand out and Java exploits. Til now, at that place is atomic number 102 signalize of zero-day vulnerabilities being old." A zero-day vulnerability refers to previously unknown exploits discovered in the wild.

Scorn being unimpressed by its technical electrical capacity, F-Covert says the Red October attacks are intriguing because of the length of time Rocra has been active and the scale of the espionage undertaken by a individualistic mathematical group. "However," F-Secure added. "The sad truth is that companies and governments are constantly under analogous attacks from many different sources."

Rocra starts when a victim downloads and opens a malicious productivity file (Excel, Word, PDF) that can then retrieve more malware from Rocra's dictation-and-control servers, a method titled a Trojan dropper. This intermediate round of malware includes programs that collect information and send that information back to hackers.

Stolen information can admit quotidian file types so much as plain text, lavish schoolbook, Watchword, and Excel, only the Bolshevik October attacks also go after cryptographic information much arsenic pgp and gpg encrypted files.

In add-on, Rocra looks for files that use "Sulphurous Cryptofile" extensions, which is cryptographic package secondhand by governments and organizations including the European Union and the North Atlantic Treaty System. It's not clear whether the people buttocks Rocra are equal to of deciphering any encrypted information they obtain.

E-mail rebirth

Rocra is also particularly resistive to interference from law enforcement, according to Kaspersky. If the campaign's command-and-command servers were fold, the hackers have designed the system so they can regain control over their malware platform with a simple e-chain armour.

One of Rocra's components searches for any incoming PDF or Office document that contains executable code and is flagged with special metadata tags. The document will pass all security checks, Kaspersky says, but once it's downloaded and opened, Rocra can get down a malicious application attached to the document and continue feeding data to the bad guys. Using this trick, completely the hackers have to do is set skyward some unprecedented servers and email malicious documents to previous victims to fetch back in business sector.

Rocra's servers are put off up as a series of proxies (servers hiding can other servers), which makes it untold harder to discover the source of the attacks. Kasperksy says the complexity of Rocra's substructure rivals that of the Flame malware, which was also accustomed taint PCs and slip sensitive data. There is no better-known connection betwixt Rocra, Flame, or malware such arsenic Duqu, which was built on code similar to Stuxnet.

As noted by F-Secure, the Red October attacks don't appear to be doing anything particularly fresh, but the amount of time this malware military campaign has been in the wild is impressive. Similar to other cyber espionage campaigns such as Flare, Red October relies on duping users into downloading and orifice malicious files or visiting malicious websites where code can make up injected into their devices. This suggests that spell computer espionage may get on the rise, the fundamentals of computer surety rump go a long way to forbid these attacks.

Take precautions

Useful precautions such as being wary of files from unknown senders or observation out for files that are out of character from their purported transmitter is a good start. It's also useful to be wary of visiting websites you Don't know or trust, specially when using corporate equipment. Finally, make sure enough you have all the latest surety updates for your version of Windows, and seriously consider turning off Java unless you absolutely need it. You Crataegus oxycantha not be able to prevent all manner of attacks, but adhering to basic security practices can protect you from many spoiled actors online.

Kaspersky says it's not clear if the Red October attacks are the work of a nation state or criminals looking to sell radiosensitive information on the black market. The protection fellowship plans to release more information about Rocra in the coming years.

If you're concerned about whether any of your systems are affected by Rocra, F-Secure says its antivirus software can detect the currently known exploits used in the Red October attacks. Kaspersky's antivirus software can also detect threats from Rocra.