Your Source for Leaks Around the World!

MiniDuke: New Cyber-Attack Hacks Governments for Political Secrets

In Archive, Hacking, Malware on February 28, 2013 at 5:12 AM

02/27/2013

The governments of at least 20 countries may have fallen victim to a sophisticated new cyber-attack. Security experts believe the hackers are attempting to steal political intelligence.

The governments of at least 20 countries may have fallen victim to a sophisticated new cyber-attack. Security experts believe the hackers are attempting to steal political intelligence.

Computer security firms Kaspersky Lab and CrySyS Lab discovered that the malware, dubbed “MiniDuke,” targeted government computers in the Czech Republic, Ireland, Portugal and Romania along with think tanks, research institutes and healthcare providers in the United States.

“The technical indicators from our analysis show this is a new type of threat actor that hasn’t been seen before,” Kurt Baumgartner, a senior security researcher with Kaspersky Lab, told RT.

Although experts avoid speculating on who the attackers may be, Baumgartner clarified that “based on the target victims and the functionality of the malware” the objective of MiniDuke’s authors is “to collect geopolitical intelligence.”

The threat operates on low-level code to stay hidden, and uses Twitter and Google to get instructions and updates. It allegedly infected PCs when ‘victims’ opened a cleverly disguised Adobe PDF attachment to an email.

“The high level of encryption in the malware and the flexible system it used to communicate with the C2 via Twitter and Google indicates this was a strategically planned operation,” Baumgartner said.

The PDF documents were specifically tailored to their targets, according to the researchers. The attachments referred to highly relevant topics subjects like “foreign policy,” a “human rights seminar,” or “NATO membership plans.”

MiniDuke 1

When the files were opened, MiniDuke would install itself on the user’s computer.

So far it is only known that the malware then connects to two servers, one in Panama and one in Turkey, but security researchers say there are no clear indications of who was behind the online attacks.

According to Karpersky Lab the spyware was written in “assembler language,” a low-level code where each statement corresponds to a specific command, and is very small in size, only 20 kilobytes. Assembler language codes are written specifically for each system they are meant to attack, as opposed to higher-level codes, which can infect multiple types of technologies.

The way the malware was created and used indicates that the attackers “have knowledge from the elite, ‘old school’  type of malicious programmers who were extremely effective at creating highly complex viruses in the past,” Baumgartner says. “MiniDuke’s attackers have combined these skills with the newly advanced sandbox-evading exploits to target high-profile victims, which is unique and something we haven’t seen before.”

MiniDuke is a three-stage attack, technology news and information website Arstechnica explains. First it tricks a victim into opening an authentic-looking PDF document, and then infected machines start using Twitter or Google “to retrieve encrypted instructions showing them where to report for additional backdoors.”

“These accounts were created by MiniDuke’s Command and Control (C2) operators and the tweets maintain specific tags labeling encrypted URLs for the backdoors,” Kaspersky Lab said in a statement. “Based on the analysis, it appears that the MiniDuke’s creators provide a dynamic backup system that also can fly under the radar – if Twitter isn’t working or the accounts are down, the malware can use Google Search to find the encrypted strings to the next C2.

Stages two and three are hidden inside a GIF image file which is downloaded from the command server and “disguised as pictures that appear on a victim’s machine.”

MiniDuke 2

The attackers left a small clue in the code, in the form of the number 666 (0x29A hex) before one of the decryption subroutines:

MiniDuke3

By analysing the logs from the command servers, 59 unique victims in 23 countries were discovered:

Belgium, Brazil, Bulgaria, Czech Republic, Georgia, Germany, Hungary, Ireland, Israel, Japan, Latvia, Lebanon, Lithuania, Montenegro, Portugal, Romania, Russian Federation, Slovenia, Spain, Turkey, Ukraine, United Kingdom and United States.

Eugene Kaspersky, founder and chief executive of Kaspersky Lab, compared the highly-advanced MiniDuke to “malicious programming from the end of the 1990s and the beginning of the 2000s”, saying it has the potential to be “extremely dangerous” because it was an “elite, old-school” attack.

“This is a very unusual cyber-attack,” the statement emailed to RT read.

“I remember this style of malicious programming from the end of the 1990s and the beginning of the 2000s. I wonder if these types of malware writers, who have been in hibernation for more than a decade, have suddenly awoken and joined the sophisticated group of threat actors active in the cyber world. These elite, “old school” malware writers were extremely effective in the past at creating highly complex viruses,”Kaspersky’s CEO added.

Neither Kaspersky nor CrySyS is disclosing what the malware does once it takes hold of a victim until they have had a chance to privately warn infected organizations, Arstechnica reported.

According to the technology news and information website, at least 60 victims have been affected. Kaspersky has identified at least 23 affected countries, including the US, Hungary, Ukraine, Belgium, Portugal, Romania, the Czech Republic, Brazil, Germany, Israel, Japan, Russia, Spain, the UK, and Ireland.

Revelations about the new malware come two weeks after Silicon Valley security firm FireEye discovered security flaws in Reader and Acrobat software.

  1. […] by four other highly advanced pieces of malware, including Turla, Careto/Mask, ItaDuke (See Also MiniDuke), and Animal Farm. A never-before-seen sample of malware on the computer piqued […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: