MiniDuke does not come only via email
Posted on 11.03.2013
Researchers from Kaspersky and CrySyS Lab continue to analyze the MiniDuke backdoor and have discovered two previously unknown infection mechanisms.

Recently discovered to have been used to attack multiple government entities and institutions worldwide, MiniDuke is highly customized and very small in size, and was spotted being delivered to victims via malicious PDF documents rigged with exploits attacking Adobe Reader versions 9, 10, and 11, bypassing its sandbox.

But, as it turns out, this might not the only method by which it propagates.

While rifling through one of MiniDuke's C&C servers, the researchers have unearthed files that seem to have been prepared for infecting visitors using web-based vulnerabilities.

One of these HTML files consist of two frames - one for loading a decoy web page, and the other for performing malicious activities. This second one includes mostly JavaScript code, and actually works as a primitive exploit pack, the researchers noted. The exploit are located on other web pages.

The exploit page serves either an exploit for the Java CVE-2013-0422 vulnerability or the IE8 CVE-2012-4792 flaw. Both exploits are very similar to the ones published in the Metasploit kit, and both deliver MiniDuke's main backdoor module that then fetches instructions from the same Twitter account.


Pen-testing drone searches for unsecured devices

You're sitting in an office, and you send a print job to the main office printer. You see or hear a drone flying outside your window. Next thing you know, the printer buzzes to life and, after spitting out your print job, it continues to work and presents you with more filled pages than you expected.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Oct 9th